chezmoi

• Outcome: Review
• Latest audit: Sep 18, 2026 · 4:16 PM UTC
• Version: 0.4.3

Overview

This skill mostly matches dotfile-management workflows, but it also installs a SourceGit helper that launches Claude with permission checks disabled, which is high-impact and under-disclosed.

Review this skill carefully before installing. The chezmoi workflows are understandable, but do not install or run the SourceGit helper unless you are comfortable with it launching Claude on repository contents while bypassing normal permission prompts. Prefer removing --dangerously-skip-permissions, avoiding --resume for untrusted repositories, and keeping tokens out of plaintext chezmoi-managed files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: bin/claude-source.sh:4
• Finding: Installed Helper Launches Claude with Permission Enforcement Disabled## Vulnerability Details **File Location**: `bin/claude-source.sh`, lines 4–5 **Vulnerability Type**: Agent permission-control bypass **Risk Level**: High **Vulnerable code:** ```bash REPO="$1" CMD="cd \$HOME/works/.vscode && claude --add-dir '$REPO' --dangerously-skip-permissions --resume" ``` The installation workflow is documented in `doctor.md`, lines 42–47 and 67–70, which copies this packaged helper into `~/bin/claude-source.sh` and marks it executable. ### Technical Analysis The helper launches Claude with `--dangerously-skip-permissions`, explicitly disabling the normal permission prompts that mediate access to commands, files, and other tools. It simultaneously grants the agent access to the repository supplied through `REPO` using `--add-dir` and resumes an existing session with `--resume`. Repository content can include untrusted instructions or prompt-injection material. When that repository is exposed to an agent whose permission checks have been disabled, such content can influence tool use without the normal per-operation authorization boundary. Resuming a prior session can also combine the untrusted repository context with existing session state. This behavior is embedded in the installed command rather than exposed as an exceptional, explicitly approved per-run option. Consequently, users invoking the SourceGit action do not receive the ordinary Claude permission controls. ### Attack Path 1. The Skill's doctor workflow copies `bin/claude-source.sh` to `~/bin/claude-source.sh` and makes it executable. 2. A repository containing malicious or untrusted agent instructions is opened through the SourceGit custom action. 3. The repository path is passed to the helper as `REPO`. 4. The helper launches Claude with that repository added to its accessible context. 5. The hard-coded `--dangerously-skip-permissions` option suppresses normal authorization prompts. 6. Malicious repository instructions can then in ...[truncated 689 chars]
• Remediation: ## Remediation Suggestions 1. Remove `--dangerously-skip-permissions` from the hard-coded command. 2. Launch Claude with its normal permission enforcement enabled and require approval for sensitive tool operations. 3. Avoid `--resume` when opening an untrusted repository; start a fresh, isolated session to prevent mixing repository content with prior session state. 4. Restrict agent filesystem access to the explicitly selected repository rather than launching from an unrelated workspace with additional ambient context. 5. If a permission-bypass mode must be supported for a narrowly defined administrative workflow, make it an explicit opt-in option and display a clear warning describing the affected repository, available privileges, and loss of confirmation controls. 6. Prefer sandboxing or a restricted operating-system account for processing repositories whose contents are not fully trusted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill metadata and description present a narrowly scoped chezmoi management tool, but the static finding indicates materially broader behaviors such as launching Claude Code sessions, terminal automation via osascript/System Events, accepting repository paths, and use of --dangerously-skip-permissions. A capability mismatch like this is dangerous because it can mislead users and reviewers about the true execution surface, hide privilege-sensitive actions, and increase the chance of unauthorized command execution or filesystem access under the guise of benign dotfile management.

Ae1

High

• Category: analysis-evasion

Content

| cross-platform | macOS/Windows compatibility diagnostics and fixes | [cross-platform.md](./cross-platform.md) |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This script is unrelated to the declared chezmoi dotfile-management purpose and instead acts as a launcher for Claude Code with a user-supplied repository path. That mismatch is security-relevant because it can create an unexpected execution path in a trusted skill bundle, increasing the chance that users trigger sensitive tooling without understanding the risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The command line includes --dangerously-skip-permissions, which disables normal permission safeguards when launching Claude against an arbitrary repository path. In the context of a dotfile-management skill, this is unjustified elevated behavior and could expose local files or enable unintended high-trust actions against attacker-controlled repository content.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script silently launches Claude with --dangerously-skip-permissions and no warning, confirmation, or review step. Because the repository path is passed from input and inserted into an automated terminal/GUI launch flow, users may unknowingly open Claude in a high-privilege mode on untrusted content, increasing the risk of unauthorized file access or harmful agent actions.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes broad phrases such as "cross platform," "missing script," and "MCP sync," which can overlap with ordinary support requests and cause the skill to activate outside the user's intended chezmoi workflow. Over-broad triggers are risky because they can route unrelated requests into automation that modifies dotfiles, copies files, or propagates configuration changes.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The quick-reference trigger "merge templates" is ambiguous and could match many unrelated development or documentation tasks, yet in this skill it maps to template consolidation behavior that may rewrite shared scripts or dotfile templates. This raises the risk of unintended invocation and unintended file modifications in a sensitive configuration-management context.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger "missing script" is too generic for a skill that can auto-copy files into ~/bin/, so a routine troubleshooting request could accidentally invoke a workflow that changes executable content on disk. In the context of environment-management skills, unintended file-copying is more dangerous than in read-only advisory skills because it can alter the user's PATH-executed tools.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `.claude.json`, `.cursor/mcp.json` - mcpServers object
- `.utcp_config.json` - manual_call_templates array

### 3. Create Shared Scripts

**Location:** `~/.local/share/chezmoi/.chezmoi-lib/`

• Confidence: 80% confidence
• Finding: The skill directs creation of shared executable scripts under `~/.local/share/chezmoi/.chezmoi-lib/` and later has wrappers `exec` them, which establishes persistent executable content that will be re-used across future template applications. In the context of managing dotfiles and MCP-related configuration, persistent helper scripts can become a long-lived execution point; if their contents are incorrect, overly broad, or later tampered with, they can repeatedly modify user configuration or execute unintended logic.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs running `chezmoi apply` after review, but it does not warn that this command will modify the user's managed dotfiles and local configuration state. In a dotfile-management context, applying changes can alter shells, editors, MCP config, and other persistent settings, so omission of a safety warning increases the chance of unintended system and configuration changes.

Session Persistence

Medium

• Category: Rogue Agent

Content

ls "$APPDATA/AppName/" || ls "$LOCALAPPDATA/AppName/"
```

### 2. Create macOS Source

```bash
chezmoi add ~/Library/Application\ Support/AppName/User/settings.json

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This section instructs copying scripts from the skill directory into ~/bin and making them executable, which modifies the user's environment and introduces executable code into a commonly used path without an explicit warning, consent checkpoint, or integrity verification. In a dotfile-management skill, such persistence is contextually plausible, but it still increases risk because users may execute installed scripts later outside the original review context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The manual execution block provides copy-and-install one-liners that create ~/bin and place scripts there without any user-facing warning about filesystem modification or the security implications of adding runnable scripts. One-line install commands reduce friction for review and can normalize blind execution of local skill content, making accidental persistence more likely.

Session Persistence

Medium

• Category: Rogue Agent

Content

# macOS
SCRIPT=~/.claude/skills/chezmoi/bin/claude-source.sh
TARGET=~/bin/claude-source.sh
[[ -f "$TARGET" ]] && echo "OK" || { mkdir -p ~/bin && cp "$SCRIPT" "$TARGET" && chmod +x "$TARGET" && echo "INSTALLED"; }

# Windows (Git Bash)
SCRIPT=~/.claude/skills/chezmoi/bin/claude-source.bat

• Confidence: 91% confidence
• Finding: This command establishes persistence by copying a script into ~/bin, where it may be reused across future sessions and workflows. Although likely intended for convenience in environment setup, persistence of executable content from a skill directory is security-relevant because later invocations may trust the installed script without re-evaluating its origin or contents.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guidance explicitly suggests embedding secret token values in chezmoi during migration, but does not warn that chezmoi-managed files are often stored in a dotfiles repository and may be synced, backed up, or committed. This can lead to credential exposure through source control, shared configs, or generated plaintext files across multiple applications.

Vague Triggers

Low

• Confidence: 78% confidence
• Finding: The phrase "add MCP server" is broad and may capture requests not intended for this synchronization workflow, potentially leading to changes in shared MCP configuration across multiple applications. While lower impact than direct code execution, unintended propagation of configuration can still disrupt tool behavior or expose services more widely than intended.

Static analysis

No suspicious patterns detected.