managing-chezmoi-packages

managing-chezmoi-packages is a skill for Claude Code, Codex from martinemde/dotfiles. It costs 88 tokens per session (1,525 once invoked), scanned A, original, ISC.

A guide for managing packages and external tools in a chezmoi dotfiles repository. Chezmoi is a tool that keeps personal computer configuration files consistent across machines.

In plain words
What is it for?
Adding, updating, or removing Homebrew packages, command-line tools, Python tools, Docker dependencies, external files, and installed command-line programs.
Why use it?
It helps put each dependency in the right configuration file, pin it to a fixed version, and keep automated updates working. This reduces differences between machines and prevents unnoticed outdated pins.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/martinemde/dotfiles/chezmoi
Any agent
npx skills add martinemde/dotfiles --skill chezmoi
Clone the repo
git clone --depth 1 https://github.com/martinemde/dotfiles

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for managing-chezmoi-packages

README.md
[![agentmods](https://agentmods.dev/badge/skills/martinemde/dotfiles/chezmoi.svg)](https://agentmods.dev/skills/martinemde/dotfiles/chezmoi)
Your own site
<a href="https://agentmods.dev/skills/martinemde/dotfiles/chezmoi"><img src="https://agentmods.dev/badge/skills/martinemde/dotfiles/chezmoi.svg" alt="Measured on agentmods" height="20"></a>
Per session 88 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,525 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00088 $0.01525
Opus 5 $0.00044 $0.00763
Sonnet 5 $0.00018 $0.00305
Haiku 4.5 $0.00009 $0.00153

Measured 5d ago against content hash e9df70ad2ba9, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

managing-chezmoi-packages scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -fsSL https://github.com/USER/REPO/raw/SHA/path # file exists at that SHA
.claude/skills/chezmoi/SKILL.md · 135 lines

How it starts

The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Managing Chezmoi Packages

Adding a dependency here means three things, not one: picking the right ecosystem, pinning it to something immutable, and making sure Renovate can see the pin. Skip the third and the pin quietly rots — which is worse than no pin, because it looks maintained.

Pick the ecosystem first

The wrong manifest usually works on the machine you're sitting at and diverges elsewhere, so resolve this before editing anything. ./ecosystem-guide.md covers the trade-offs; the short version:

Use case Ecosystem Location
macOS packages (Homebrew) brew/cask/mas home/.chezmoidata/packages.yaml
CLI developer tools mise (Aqua) .mise.toml or home/dot_config/mise/config.toml
Python tools pip home/dot_config/dotfiles/requirements.txt
Docker/devcontainer docker home/dot_config/docker-compose/*.yml, .devcontainer/
External files/repos chezmoi externals home/.chezmoiexternals/*.toml[.tmpl]
Install script CLIs cli-versions home/dot_config/dotfiles/cli-versions.toml

Pin immutably

Type Pinning method Example
Git repo Commit SHA in revision revision = "abc123..."
GitHub file Commit SHA in URL path raw/<sha>/file.ext
Release binary Version tag + checksum v1.2.3 + checksum = "sha256:..."
Docker image Digest image:tag@sha256:...

latest tags, bare branch names, version ranges, and URLs without a SHA or checksum all resolve to something different tomorrow. ./externals-reference.md has the full type specifications and field semantics.

Read the full file on GitHub · 135 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 135 lines · 88 tokens per session scan A e9df70ad2ba9

Subscribe to this mod's changes

managing-chezmoi-packages is a skill published in the GitHub repository martinemde/dotfiles (9 stars, last pushed 5d ago), licensed ISC. It adds 88 tokens to every session and 1,525 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

dotfiles-bootstrap

Bootstrap a workstation with the dotfiles framework. Takes a GitHub user / owner+repo / explicit clone URL and runs dot init (which shells out to chezmoi) with the right safety prompts. Honors the active agent profile (ask / plan / apply / audit) so it defaults to dry-run in safer modes and full apply in apply.

sebastienrousseau/dotfiles · 88 tokens

vibe

Delegate a coding task to a cheap AI model (Mistral Vibe by default, but any provider Vibe knows about — DeepSeek, Gemini Flash, etc.) and supervise the result via git diff. Claude orchestrates, the cheap model codes. Claude consumes 500-1500 tokens per delegation regardless of how many file reads the delegate does…

sebastienrousseau/dotfiles · 137 tokens

aiq-research

Use when asked to run deep research or AI-Q research through a reachable NVIDIA AI-Q Blueprint backend.

laurigates/dotfiles · 25 tokens

obsidian-bases

Obsidian Bases database feature for YAML-based interactive note views. Use when creating .base files, writing filter queries, building formulas, configuring table/card views, or working with Obsidian properties and frontmatter databases.

laurigates/dotfiles · 49 tokens

telegram

Send notifications, interactive questions, or multiple-choice polls to the user via Telegram. Use when the user asks to be notified ("ping me", "notify me on Telegram", "ask me when..."), when a long-running task finishes and the user is likely away, when an irreversible action needs out-of-band confirmation, or when…

laurigates/dotfiles · 117 tokens

chezmoi-expert

Comprehensive chezmoi dotfiles management expertise including templates, cross-platform configuration, file naming conventions, and troubleshooting. Covers source directory management, reproducible environment setup, and chezmoi templating with Go templates. Use when user mentions chezmoi, dotfiles, cross-platform…

laurigates/dotfiles · 88 tokens