Borrowing it
Nothing to install: this file belongs to fmind/dot. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/fmind/dot/main/.agents/skills/chezmoi/SKILL.mdgit clone --depth 1 https://github.com/fmind/dotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fmind/dot/chezmoi)<a href="https://agentmods.dev/skills/fmind/dot/chezmoi"><img src="https://agentmods.dev/badge/skills/fmind/dot/chezmoi/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fmind/dot/chezmoi"><img src="https://agentmods.dev/badge/skills/fmind/dot/chezmoi.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.01682 |
| Opus 5.5 | $0.00010 | $0.00673 |
| Sonnet 5.5 | $0.00005 | $0.00336 |
| Haiku 4.5 | $0.00003 | $0.00168 |
Grade B, and why
chezmoi scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 600 ~/.config/<tool>/secret How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Chezmoi Source Standard
The source tree (~/.local/share/chezmoi) is the only thing to edit; chezmoi apply renders it into $HOME, so a change made under ~/.config or ~/.gemini is overwritten on the next apply. File names encode target path, mode, encryption, and rendering; mise wraps the commands as tasks.
Naming
Read source names when adding or renaming a managed target; attributes depend on the target type.
Workflow
-
Edit the source, never the deployed copy;
chezmoi cdopens a shell in the source root. -
Manage an existing file:
chezmoi add <target>infers the attributes;--templatetemplatizes; set a secret to0600before--encryptimports it asencrypted_private_<name>.age(withdot_before a leading-dot name):chmod 600 ~/.config/<tool>/secret chezmoi add --encrypt ~/.config/<tool>/secret # import and encrypt into the source chezmoi edit ~/.config/<tool>/secret # edit the plaintext, re-encrypt on save -
Preview:
mise run diff(chezmoi diff --force --no-pager; restrict to affected targets). Diffs exclude encrypted targets so plaintext secrets never reach transcripts;chezmoi statusstill lists their drift. -
Validate rendering:
mise run check:chezmoiuses temporary configuration and destination with a dry run excluding encrypted files. It checks the current platform; exercise changed Linux/macOS branches separately and report unexercised branches or encrypted targets. -
Check repeatability: for Bash/profile modifier changes, add existing-target and second-pass cases under
dot/tests/, using the isolated rendering approach intest_shell_modifiers.py. Their blocks go through.chezmoitemplates/managed-block.tmpl, which rewrites the block between its begin and end markers in place, so a body change needs no migration code. JSON/TOML modifier changes need the same cases intest_harness_config.py. Inspect affectedrun_*hooks: ordinary hooks run on each apply; once/onchange hooks can rerun when their content changes. -
Apply within scope:
mise run apply(chezmoi apply --force, so a diverged target never blocks scripts on a prompt;--forcedoes not expand authorized targets or side effects). Themes (one fmind/theme commit) and fonts (release URLs) are checksum-pinned externals that refetch when their URL changes; a checksum mismatch fails apply instead of deploying changed content, andmise run upgradeadvances the theme pin only while every copied block in theCOPIEDmap ofdot/dot_tasks/theme_pin.pymatches. The Google Sans, Google Sans Code, and Nerd Fonts releases have no upgrade task: when a newer release exists, bump each URL and its checksum together. -
Pull target edits back:
chezmoi re-addfolds manual changes to a managed file (a regenerated lockfile, for example) into the source. -
Diagnose:
mise run doctor(dot doctor,chezmoi doctor, andmise doctor);chezmoi managedandchezmoi unmanagedlist coverage;dot orphanlists former managed targets (orphans); the installed-link recovery guide covers retired skill links, and approved cleanup moves them to recoverable backups. Use command help and dot-cli for cleanup flags.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed cedcc3fa1694
- 7d ago Changed 481ce6c07842
- 9d ago Changed 49642e988bc2
- 10d ago Changed · +1 lines c7046f712444
- 23d ago Changed · -2 lines d366a72ad693
- 24d ago Changed 34c485321fbe
- 26d ago Changed 4a2c68d4ff2d
- 1mo ago Changed 0fa31039a080
- 1mo ago Changed · +2 lines scan A → B 89a161ccc0e0
- 1mo ago First seen · 57 lines · 26 tokens per session scan A 5f76a8a81536
chezmoi is a skill published in the GitHub repository fmind/dot (12 stars, last pushed yesterday), licensed MIT. It adds 26 tokens to every session and 1,682 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
dotfiles-bootstrap
Bootstrap a workstation with the dotfiles framework. Takes a GitHub user / owner+repo / explicit clone URL and runs dot config init (which shells out to chezmoi) with the right safety prompts. Honors the active agent profile (ask / plan / apply / audit) so it defaults to dry-run in safer modes and full apply in apply.
vibe
Delegate a coding task to a cheap AI model (Mistral Vibe by default, but any provider Vibe knows about — DeepSeek, Gemini Flash, etc.) and supervise the result via git diff. Claude orchestrates, the cheap model codes. Claude consumes 500-1500 tokens per delegation regardless of how many file reads the delegate does…
go-stack
Build Go projects, libraries, CLIs, TUIs, web apps, or ADK agents with the standard package layout and pinned tooling.
python-stack
Build typed Python projects with uv, Ruff, ty, pytest, Litestar, and Typer. Use for packages, CLIs, web apps, tests, typing, or API verification.
hugo
Canonical Hugo static-site stack with the Hextra docs theme — Hugo Modules, mise tasks, dprint, lefthook, and GitHub Pages deploy. Use for documentation sites, project docs, and static websites.
k8s-local
Create and manage local Kubernetes clusters (k3d or kind) and deploy to them with kubectl, helm, helmfile, and skaffold. Use for local k8s cluster setup, dev loops, and debugging.