chezmoi-sync
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Executes shell commands using the Bash tool to run
chezmoiandgit. These commands are used to detect file changes, add files to the source repository, and commit/push changes. - [DATA_EXFILTRATION]: The skill facilitates the transfer of local configuration files (dotfiles) to a remote git repository. This is the core functionality of the skill and uses the user's pre-configured repository settings in
chezmoi. - [PROMPT_INJECTION]: Ingests local file content through
chezmoi diffandchezmoi status. This creates an indirect prompt injection surface where malicious file content could attempt to influence the agent's behavior. However, the skill incorporatesAskUserQuestionas a boundary marker, requiring human oversight before executing sync or git operations.
Audit Metadata