dbs-update

SUSPICIOUS: the skill is purpose-aligned as an updater, but it performs transitive installation of another skill pack and does so through an unpinned remote `npx skills add ... --all` flow. No credential harvesting, secret-file access, or off-purpose data exfiltration is evident, so this is not malicious; the main concern is supply-chain and inherited trust from installing all skills in the target repo.