Install
$ agentstack add skill-carlkibler-agent-skills-chezmoi-drift ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Chezmoi Drift
Use this skill as a dotfiles weekly checkup. Report first; mutate later.
Quick Start
src_dir=$(chezmoi source-path)
chezmoi status 2>&1
chezmoi unmanaged 2>&1 | grep -Ev '\.DS_Store|__pycache__|/Library/|/Caches/' | head -60
If chezmoi status is empty, managed files are in sync.
Workflow
1. Check managed-file drift
Run:
chezmoi status 2>&1
Interpret status codes:
M= modified in targetA= present in source but not appliedR= present in target but removed from source
Report exact paths and codes. Do not paraphrase away the useful bits.
2. Find unmanaged files worth tracking
Run:
chezmoi unmanaged 2>&1 | grep -Ev '\.DS_Store|__pycache__|/Library/|/Caches/' | head -60
Flag only files that look intentional and reusable, especially in:
~/~/.local/bin/~/.config/~/.claude/,~/.codex/,~/.gemini/,~/.continue/,~/.cursor/~/.local/share/opencode/
Skip app noise, caches, session files, logs, and secrets.
3. Check script and config coverage
Run:
src_dir=$(chezmoi source-path)
comm -23 \
/dev/null || true
readlink "$host"/chezmoi-drift 2>/dev/null || true
done
Call out:
- missing installs
- copied directories where a symlink should exist
- stale links (broken or pointing to a moved/deleted source)
5. Detect double-installed skills (symlink + plugin)
A skill must load through one mechanism only. The expensive failure mode is a skill present both as a symlink in ~/.claude/skills/ and as an installed plugin (@). It then appears twice in every agent's skill list — wasted context and confusing UX. This has bitten this setup before (the carl-tools marketplace overlapping the live repo symlinks); keep it dead.
Use command ls, not bare ls. Carl's shells alias ls to eza, which prints name -> target for symlinks — every symlinked skill then fails to match and the check silently reports only the real directories. This under-reported 9 of 10 duplicates on gauss (2026-07-08).
comm -12 \
/dev/null | sort -u) \
/dev/null | grep '❯' | sed 's/^[^❯]*❯ *//; s/@.*//' | grep . | sort -u)
Any name printed is double-installed. The fix is to keep one mechanism:
- On a machine where the
agent-skillsrepo is checked out and edited (any of Carl's boxes — gauss/euler/vesta), symlinks are canonical (live edits show instantly). Remove the plugin:claude plugin uninstall @. - On a machine without the repo, plugin install is canonical. Remove the stray symlink instead.
Never install a carl-tools (or any agent-skills-derived) plugin on a box that already symlinks the live repo.
A marketplace with "autoUpdate": true in ~/.claude/settings.json will keep reinstating its plugins. Uninstalling the plugins is not enough — remove the marketplace too: claude plugin marketplace remove .
6. Report
Use this format:
DRIFT REPORT
============
Managed files with drift: ...
Unmanaged files worth tracking: ...
Scripts not in chezmoi: ...
Config dirs not in chezmoi: ...
Shared skill install issues: ...
Double-installed skills (symlink + plugin): ...
Then propose exact commands for anything worth fixing.
Action Rules
- Do not run
chezmoi add,chezmoi re-add,chezmoi apply,rm, or git commands unless the user explicitly asks. - Prefer
chezmoi source-pathover hard-coding the source repo path. - Never add secrets or token-bearing files without converting them to a safe template first.
- For shared skills, prefer
ln -sfn /skills/over copying directories around.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: carlkibler
- Source: carlkibler/agent-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.