# Chezmoi Drift

> Check chezmoi dotfiles for drift, unmanaged files, and broken skill links.

- **Type:** Skill
- **Install:** `agentstack add skill-carlkibler-agent-skills-chezmoi-drift`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [carlkibler](https://agentstack.voostack.com/s/carlkibler)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [carlkibler](https://github.com/carlkibler)
- **Source:** https://github.com/carlkibler/agent-skills/tree/main/skills/chezmoi-drift

## Install

```sh
agentstack add skill-carlkibler-agent-skills-chezmoi-drift
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Chezmoi Drift

Use this skill as a dotfiles weekly checkup. Report first; mutate later.

## Quick Start

```bash
src_dir=$(chezmoi source-path)
chezmoi status 2>&1
chezmoi unmanaged 2>&1 | grep -Ev '\.DS_Store|__pycache__|/Library/|/Caches/' | head -60
```

If `chezmoi status` is empty, managed files are in sync.

## Workflow

### 1. Check managed-file drift

Run:

```bash
chezmoi status 2>&1
```

Interpret status codes:
- `M` = modified in target
- `A` = present in source but not applied
- `R` = present in target but removed from source

Report exact paths and codes. Do not paraphrase away the useful bits.

### 2. Find unmanaged files worth tracking

Run:

```bash
chezmoi unmanaged 2>&1 | grep -Ev '\.DS_Store|__pycache__|/Library/|/Caches/' | head -60
```

Flag only files that look intentional and reusable, especially in:
- `~/`
- `~/.local/bin/`
- `~/.config/`
- `~/.claude/`, `~/.codex/`, `~/.gemini/`, `~/.continue/`, `~/.cursor/`
- `~/.local/share/opencode/`

Skip app noise, caches, session files, logs, and secrets.

### 3. Check script and config coverage

Run:

```bash
src_dir=$(chezmoi source-path)
comm -23 \
  /dev/null || true
  readlink "$host"/chezmoi-drift 2>/dev/null || true
done
```

Call out:
- missing installs
- copied directories where a symlink should exist
- stale links (broken or pointing to a moved/deleted source)

### 5. Detect double-installed skills (symlink + plugin)

A skill must load through **one** mechanism only. The expensive failure mode is a skill present **both** as a symlink in `~/.claude/skills/` **and** as an installed plugin (`@`). It then appears twice in every agent's skill list — wasted context and confusing UX. This has bitten this setup before (the `carl-tools` marketplace overlapping the live repo symlinks); keep it dead.

Use `command ls`, not bare `ls`. Carl's shells alias `ls` to `eza`, which prints
`name -> target` for symlinks — every symlinked skill then fails to match and the
check silently reports only the real directories. This under-reported 9 of 10
duplicates on gauss (2026-07-08).

```bash
comm -12 \
  /dev/null | sort -u) \
  /dev/null | grep '❯' | sed 's/^[^❯]*❯ *//; s/@.*//' | grep . | sort -u)
```

Any name printed is double-installed. The fix is to keep **one** mechanism:
- On a machine where the `agent-skills` repo is checked out and edited (any of Carl's boxes — gauss/euler/vesta), **symlinks are canonical** (live edits show instantly). Remove the plugin: `claude plugin uninstall @`.
- On a machine without the repo, plugin install is canonical. Remove the stray symlink instead.

Never install a `carl-tools` (or any agent-skills-derived) plugin on a box that already symlinks the live repo.

A marketplace with `"autoUpdate": true` in `~/.claude/settings.json` will keep
reinstating its plugins. Uninstalling the plugins is not enough — remove the
marketplace too: `claude plugin marketplace remove `.

### 6. Report

Use this format:

```text
DRIFT REPORT
============
Managed files with drift: ...
Unmanaged files worth tracking: ...
Scripts not in chezmoi: ...
Config dirs not in chezmoi: ...
Shared skill install issues: ...
Double-installed skills (symlink + plugin): ...
```

Then propose exact commands for anything worth fixing.

## Action Rules

- Do **not** run `chezmoi add`, `chezmoi re-add`, `chezmoi apply`, `rm`, or git commands unless the user explicitly asks.
- Prefer `chezmoi source-path` over hard-coding the source repo path.
- Never add secrets or token-bearing files without converting them to a safe template first.
- For shared skills, prefer `ln -sfn /skills/ ` over copying directories around.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [carlkibler](https://github.com/carlkibler)
- **Source:** [carlkibler/agent-skills](https://github.com/carlkibler/agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-carlkibler-agent-skills-chezmoi-drift
- Seller: https://agentstack.voostack.com/s/carlkibler
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.