Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pantheon-org/tekhne --skill chezmoi-assistantgit clone --depth 1 https://github.com/pantheon-org/tekhneWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pantheon-org/tekhne/chezmoi-assistant)<a href="https://agentmods.dev/skills/pantheon-org/tekhne/chezmoi-assistant"><img src="https://agentmods.dev/badge/skills/pantheon-org/tekhne/chezmoi-assistant/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pantheon-org/tekhne/chezmoi-assistant"><img src="https://agentmods.dev/badge/skills/pantheon-org/tekhne/chezmoi-assistant.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.01349 |
| Opus 5 | $0.00060 | $0.00674 |
| Sonnet 5 | $0.00024 | $0.00270 |
| Haiku 4.5 | $0.00012 | $0.00135 |
Grade B, and why
chezmoi-assistant scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| `private_` | chmod 600/700 on target | How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Chezmoi Assistant
You are an expert in chezmoi, the multi-machine dotfiles manager. You help users track, template, encrypt, and sync their dotfiles using chezmoi's source state model.
Mental Model
chezmoi maps a source directory (~/.local/share/chezmoi) to a target directory (usually $HOME). Filenames in the source directory encode behaviour through prefixes and suffixes — they are never the literal target filenames.
Source: dot_gitconfig.tmpl → Target: ~/.gitconfig (template rendered)
Source: private_dot_ssh/ → Target: ~/.ssh/ (mode 700)
Source: run_once_setup.sh → Target: (executed once, not copied)
Daily Workflow
| Goal | Command |
|---|---|
| Track a file | chezmoi add ~/.zshrc |
| Edit tracked file | chezmoi edit ~/.zshrc |
| Preview changes | chezmoi diff |
| Apply to home | chezmoi apply |
| Edit + apply | chezmoi edit --apply ~/.zshrc |
| Open source dir | chezmoi cd |
| Check what would change | chezmoi status |
| Debug problems | chezmoi doctor |
Source State Attributes
See references/source-attrs.md for the full table. Key ones:
| Prefix | Effect |
|---|---|
dot_ |
Maps to dotfile — dot_zshrc → .zshrc |
private_ |
chmod 600/700 on target |
executable_ |
chmod +x on target |
encrypted_ |
Stored encrypted; decrypted on apply |
run_ |
Executed as a script, not copied |
run_once_ |
Script runs only if it has never run before |
run_onchange_ |
Script runs if its content changes |
before_ / after_ |
Script timing relative to other changes |
exact_ |
Removes unmanaged files from target dir |
create_ |
Creates file if absent; never overwrites |
modify_ |
Script receives current file content on stdin |
Suffix .tmpl → chezmoi renders the file as a Go template before writing.
Prefix order matters. Correct: run_once_before_ — not before_run_once_.
Templates
Use templates for machine-specific or secret values. Variables come from chezmoi data.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 138 lines · 120 tokens per session scan B abfe5e7b7090
chezmoi-assistant is a skill published in the GitHub repository pantheon-org/tekhne (10 stars, last pushed yesterday), licensed MIT. It adds 120 tokens to every session and 1,349 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
obsidian-bases
Create and edit Obsidian Bases (.base files) with views, filters, formulas, and summaries. Use when working with .base files, creating database-like views of notes, or when the user mentions Bases, table views, card views, filters, or formulas in Obsidian.
stay-within-limits
Use when long-running or parallel agent work must respect 5-hour and weekly usage limits by checking usage between waves, pausing near the cap, and resuming only when the window is clear.
find-journalists
Build, refine, dedupe, and enrich small fit-checked journalist lists for newsjack campaigns. Uses the newsjack CLI (preferred) or the medialyst MCP for news search and journalist enrichment, and falls back to a best-effort local mode with no verified contacts; the agent owns how returned data is organized.
agent-estate
Perpetual autonomous work loop for Claude Code — no end condition, no memory regression, no context overfill. Maintains a persistent ledger across all sessions.
story-origin-check
Recover the first public timestamp and canonical major coverage for a newsjacking signal, then decide whether newer coverage is the same story, a different story, or a materially new development.
prompt-proximity-architecture
Turn an approved measurement charter, ICPs, and buyer jobs into a budget-aware prompt coverage blueprint across proximity bands, aided status, information acts, journey states, roles, locales, evidence grades, partitions, and measurement lanes. Use before prompt wording to define required, optional, and prohibited…