neovim
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill bootstraps the
lazy.nvimplugin manager by cloning it from its official GitHub repository (https://github.com/folke/lazy.nvim.git). This is a standard initialization step for modern Neovim configurations. - [COMMAND_EXECUTION]: Instructs the agent to execute shell commands for configuration management and diagnostics, including
stowfor symlinking,nvim --startuptimefor performance profiling, andrmfor removing plugin directories during repair workflows. - [DYNAMIC_EXECUTION]: Utilizes Neovim's Lua API to dynamically load plugin specifications and core configuration modules (e.g.,
require("lazy").setup(...)), which is the intended mechanism forlazy.nvim. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided Neovim configuration files from
~/.dotfiles/.config/nvim/. While this introduces a surface for processing untrusted data, it is the primary function of the skill. - Ingestion points:
SKILL.mdandreferences/config.mdspecify reading files within~/.dotfiles/.config/nvim/and its subdirectories. - Boundary markers: No specific delimiters or "ignore embedded instructions" markers are used to separate user config content from agent instructions.
- Capability inventory: The skill utilizes shell commands (
git,stow,rm,nvim) and filesystem access to manage and repair Neovim configurations. - Sanitization: No explicit sanitization or filtering of configuration content is performed before processing.
Audit Metadata