skills/kriscard/skills/neovim/Gen Agent Trust Hub

neovim

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill bootstraps the lazy.nvim plugin manager by cloning it from its official GitHub repository (https://github.com/folke/lazy.nvim.git). This is a standard initialization step for modern Neovim configurations.
  • [COMMAND_EXECUTION]: Instructs the agent to execute shell commands for configuration management and diagnostics, including stow for symlinking, nvim --startuptime for performance profiling, and rm for removing plugin directories during repair workflows.
  • [DYNAMIC_EXECUTION]: Utilizes Neovim's Lua API to dynamically load plugin specifications and core configuration modules (e.g., require("lazy").setup(...)), which is the intended mechanism for lazy.nvim.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided Neovim configuration files from ~/.dotfiles/.config/nvim/. While this introduces a surface for processing untrusted data, it is the primary function of the skill.
  • Ingestion points: SKILL.md and references/config.md specify reading files within ~/.dotfiles/.config/nvim/ and its subdirectories.
  • Boundary markers: No specific delimiters or "ignore embedded instructions" markers are used to separate user config content from agent instructions.
  • Capability inventory: The skill utilizes shell commands (git, stow, rm, nvim) and filesystem access to manage and repair Neovim configurations.
  • Sanitization: No explicit sanitization or filtering of configuration content is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 06:58 PM