nicknisi/dotfiles is a personal collection of configuration files and setup scripts for tools such as Neovim, zsh, Git, tmux, and Homebrew. It helps its author bootstrap and maintain a development machine, with a devcontainer for checking portable terminal settings. The catalogue entries extend the repository’s setup and coding-agent workflow.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nicknisi/dotfiles --skill add-themegit clone --depth 1 https://github.com/nicknisi/dotfilesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nicknisi/dotfiles/add-theme)<a href="https://agentmods.dev/skills/nicknisi/dotfiles/add-theme"><img src="https://agentmods.dev/badge/skills/nicknisi/dotfiles/add-theme/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nicknisi/dotfiles/add-theme"><img src="https://agentmods.dev/badge/skills/nicknisi/dotfiles/add-theme.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 127 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 127 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Rogue Agent · line 60 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.01135 |
| Opus 5.5 | $0.00024 | $0.00454 |
| Sonnet 5.5 | $0.00012 | $0.00227 |
| Haiku 4.5 | $0.00006 | $0.00113 |
Grade B, and why
add-theme scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`cat ~/.local/state/theme/current/mode`; `jq -r .theme ~/.claude/settings.json` How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Add a theme pack
One command themes everything: bin/theme <name> renders the pack into
~/.local/state/theme/current/theme/ and nudges every consumer. A pack is
themes/<name>/ and needs only:
colors.toml— the contract. Either style: semantic (mode,accent,background,foreground,muted,red,bright_red,dark_background, ...) or ANSI (accent,background,foreground,color0-color15).bin/theme-color -f colors.toml --allshows the full set after aliasing and derivation; anything missing is mixed from what is there.backgrounds/— images.theme <name> [N]picks the Nth (sorted by name),theme bg nextcycles. Name them<index>-<description>.<ext>; the fzf picker previews the filename.theme.conf—TAGLINE="one line of whimsy"(printed on switch, shown in the tmux cheat sheet). Optional but every pack has one.icons.theme— optional, a GTK icon theme name (Yaru-* is common); applied on Linux only if that icon set is installed.
Every app file (ghostty, kitty, wezterm, tmux, nvim, btop, starship, pi,
claude, hyprland borders, hyprlock, wofi, sketchybar, borders, slack) is
rendered from themes/templates/*.tpl. A pack may ship a file under the
same name to hand-tune one app (hyprland.lua for a gradient border,
btop.theme, ...); it wins over the template. Do NOT hand-author the rest.
Work directly in the repo (subagent worktrees don't see uncommitted theme files and have flipped the user's live theme by running theme from the wrong tree — do NOT run theme for validation until told, and never from a worktree).
Sources
- An existing theme repo (any
themes/<name>/laid out as above): copycolors.toml,backgrounds/,icons.theme. Skipneovim.lua,vscode.json,preview*.png,unlock.png,shell*.toml,keyboard.rgb,chromium.theme. Keep a shippedbtop.theme; keep a shippedhyprland.luaonly if it is plainhl.config(theo.window(...)helper style some repos use does not exist here). An older theme with onlyalacritty.tomland nocolors.toml: transcribe its[colors.*]into ANSI-stylecolors.toml. - Just a wallpaper: first run
bin/theme adopt <image>. It compares the extracted palette with every existing pack and, when the closest score is 60 or lower, copies the image into that pack'sbackgrounds/with the next numeric prefix. A weaker match changes nothing and prints the three closest packs. Then usebin/theme from-image <name> <image>to create a new pack; it writescolors.toml+backgrounds/+ an emptytheme.conf. Both commands use heuristic hue mapping, so eyeball the result.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -45 lines · +1 tokens per session scan A → B 1ef7dd7353c9
- 1mo ago First seen · 130 lines · 58 tokens per session scan A f2cce2d157c7
add-theme is a skill published in the GitHub repository nicknisi/dotfiles (3,002 stars, last pushed 3d ago), licensed MIT. It adds 59 tokens to every session and 1,135 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
smart-commit
Analyze staged changes and split them into multiple logical commits following Conventional Commits.
create-pr
Rebase from the latest origin/main, squash the commits from it, and then create a PR on github with intelligent commit messages based on staged changes.
scan-commit
Automatically scan the repository for unstaged/untracked changes, group them into logical commits using hunk-level analysis, stage and commit them following Conventional Commits.
pr-review
Intelligent PR code review with dynamic agent allocation based on change types. Analyzes PR changes and generates targeted review tasks.
analyze-pr
Analyze a GitHub/GitLab Pull Request by fetching its diff, reading its web description, and generating a comprehensive document. Use when the user provides a PR link and wants to understand what changes the PR introduces, or asks to review/analyze/summarize a pull request.
gen-commit-msg
Generate intelligent commit messages based on staged changes following Conventional Commits format.