dotfiles-sync
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
chezmoi,git, and adotfileshelper utility. These commands are used to inspect file differences, stage changes, commit to a repository, and apply configuration changes to the user's home directory. This is the primary intended function of the skill. - [REMOTE_CODE_EXECUTION]: The skill manages
run_onchange_*scripts which are executed by thechezmoitool. To mitigate risks, the instructions explicitly require the agent to 'Inspect the script before GO' and 'Inspect source to confirm equivalence' before applying changes that could execute code. - [DATA_EXFILTRATION]: The skill performs Git operations (
git fetch,git push) to synchronize local dotfiles with a remote repository. This involves network activity, but it is restricted to the user's configuredchezmoisource repository.
Audit Metadata