dot: Skill for Claude Code

.agents/skills/chezmoi/SKILL.md

chezmoi is a skill for Claude Code, Codex from fmind/dot. It costs 26 tokens per session (1,682 once invoked), scanned B, original, MIT.

A guide for managing chezmoi, a tool that stores configuration files and deploys them into your home directory.

In plain words
What is it for?
It helps edit dotfiles, render templates, manage age-encrypted files, compare changes, and apply them safely.
Why use it?
It prevents edits from being overwritten and explains how filenames control paths, permissions, templates, symlinks, and encrypted secrets.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents); mentions AGENTS.md.

This is fmind/dot's own configuration. It tells Claude Code and Codex how to work on dot itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything dot configures →

Reuse

Borrowing it

Nothing to install: this file belongs to fmind/dot. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/fmind/dot/main/.agents/skills/chezmoi/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/fmind/dot

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for chezmoi

README.md
[![agentmods](https://agentmods.dev/badge/skills/fmind/dot/chezmoi/github.svg)](https://agentmods.dev/skills/fmind/dot/chezmoi)
Your own site
<a href="https://agentmods.dev/skills/fmind/dot/chezmoi"><img src="https://agentmods.dev/badge/skills/fmind/dot/chezmoi/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for chezmoi

Your own site · 80×15
<a href="https://agentmods.dev/skills/fmind/dot/chezmoi"><img src="https://agentmods.dev/badge/skills/fmind/dot/chezmoi.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 26 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,682 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00026 $0.01682
Opus 5.5 $0.00010 $0.00673
Sonnet 5.5 $0.00005 $0.00336
Haiku 4.5 $0.00003 $0.00168

Measured 4d ago against content hash cedcc3fa1694, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

chezmoi scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

chmod 600 ~/.config/<tool>/secret
.agents/skills/chezmoi/SKILL.md · 58 lines

How it starts

The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Chezmoi Source Standard

The source tree (~/.local/share/chezmoi) is the only thing to edit; chezmoi apply renders it into $HOME, so a change made under ~/.config or ~/.gemini is overwritten on the next apply. File names encode target path, mode, encryption, and rendering; mise wraps the commands as tasks.

Naming

Read source names when adding or renaming a managed target; attributes depend on the target type.

Workflow

  1. Edit the source, never the deployed copy; chezmoi cd opens a shell in the source root.

  2. Manage an existing file: chezmoi add <target> infers the attributes; --template templatizes; set a secret to 0600 before --encrypt imports it as encrypted_private_<name>.age (with dot_ before a leading-dot name):

    chmod 600 ~/.config/<tool>/secret
    chezmoi add --encrypt ~/.config/<tool>/secret   # import and encrypt into the source
    chezmoi edit ~/.config/<tool>/secret            # edit the plaintext, re-encrypt on save
    
  3. Preview: mise run diff (chezmoi diff --force --no-pager; restrict to affected targets). Diffs exclude encrypted targets so plaintext secrets never reach transcripts; chezmoi status still lists their drift.

  4. Validate rendering: mise run check:chezmoi uses temporary configuration and destination with a dry run excluding encrypted files. It checks the current platform; exercise changed Linux/macOS branches separately and report unexercised branches or encrypted targets.

  5. Check repeatability: for Bash/profile modifier changes, add existing-target and second-pass cases under dot/tests/, using the isolated rendering approach in test_shell_modifiers.py. Their blocks go through .chezmoitemplates/managed-block.tmpl, which rewrites the block between its begin and end markers in place, so a body change needs no migration code. JSON/TOML modifier changes need the same cases in test_harness_config.py. Inspect affected run_* hooks: ordinary hooks run on each apply; once/onchange hooks can rerun when their content changes.

  6. Apply within scope: mise run apply (chezmoi apply --force, so a diverged target never blocks scripts on a prompt; --force does not expand authorized targets or side effects). Themes (one fmind/theme commit) and fonts (release URLs) are checksum-pinned externals that refetch when their URL changes; a checksum mismatch fails apply instead of deploying changed content, and mise run upgrade advances the theme pin only while every copied block in the COPIED map of dot/dot_tasks/theme_pin.py matches. The Google Sans, Google Sans Code, and Nerd Fonts releases have no upgrade task: when a newer release exists, bump each URL and its checksum together.

  7. Pull target edits back: chezmoi re-add folds manual changes to a managed file (a regenerated lockfile, for example) into the source.

  8. Diagnose: mise run doctor (dot doctor, chezmoi doctor, and mise doctor); chezmoi managed and chezmoi unmanaged list coverage; dot orphan lists former managed targets (orphans); the installed-link recovery guide covers retired skill links, and approved cleanup moves them to recoverable backups. Use command help and dot-cli for cleanup flags.

Read the full file on GitHub · 58 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago Changed cedcc3fa1694
  2. 7d ago Changed 481ce6c07842
  3. 9d ago Changed 49642e988bc2
  4. 10d ago Changed · +1 lines c7046f712444
  5. 23d ago Changed · -2 lines d366a72ad693
  6. 24d ago Changed 34c485321fbe
  7. 26d ago Changed 4a2c68d4ff2d
  8. 1mo ago Changed 0fa31039a080
  9. 1mo ago Changed · +2 lines scan A → B 89a161ccc0e0
  10. 1mo ago First seen · 57 lines · 26 tokens per session scan A 5f76a8a81536

Subscribe to this mod's changes

chezmoi is a skill published in the GitHub repository fmind/dot (12 stars, last pushed yesterday), licensed MIT. It adds 26 tokens to every session and 1,682 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

dotfiles-bootstrap

Bootstrap a workstation with the dotfiles framework. Takes a GitHub user / owner+repo / explicit clone URL and runs dot config init (which shells out to chezmoi) with the right safety prompts. Honors the active agent profile (ask / plan / apply / audit) so it defaults to dry-run in safer modes and full apply in apply.

sebastienrousseau/dotfiles · 89 tokens

vibe

Delegate a coding task to a cheap AI model (Mistral Vibe by default, but any provider Vibe knows about — DeepSeek, Gemini Flash, etc.) and supervise the result via git diff. Claude orchestrates, the cheap model codes. Claude consumes 500-1500 tokens per delegation regardless of how many file reads the delegate does…

sebastienrousseau/dotfiles · 137 tokens

go-stack

Build Go projects, libraries, CLIs, TUIs, web apps, or ADK agents with the standard package layout and pinned tooling.

fmind/dotfiles · 31 tokens

python-stack

Build typed Python projects with uv, Ruff, ty, pytest, Litestar, and Typer. Use for packages, CLIs, web apps, tests, typing, or API verification.

fmind/dotfiles · 41 tokens

hugo

Canonical Hugo static-site stack with the Hextra docs theme — Hugo Modules, mise tasks, dprint, lefthook, and GitHub Pages deploy. Use for documentation sites, project docs, and static websites.

fmind/dotfiles · 46 tokens

k8s-local

Create and manage local Kubernetes clusters (k3d or kind) and deploy to them with kubectl, helm, helmfile, and skaffold. Use for local k8s cluster setup, dev loops, and debugging.

fmind/dotfiles · 50 tokens