ClawHub
Back to skill

Security audit

chezmoi

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed chezmoi dotfile helper, but it includes a persistent SourceGit launcher that starts Claude with permission checks disabled.

Review this carefully before installing. The chezmoi documentation is mostly coherent, but do not install or use the included claude-source.sh unless you are comfortable with it launching Claude in permission-bypass mode. Avoid putting plaintext tokens into chezmoi-managed files; use separate environment files or encrypted secret handling instead.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The script launches Claude with --dangerously-skip-permissions, explicitly bypassing normal safety and permission checks for whatever repository path is supplied. That capability is unrelated to the stated chezmoi functionality and creates a high-risk trust boundary violation, especially because the script is presented as a convenience launcher inside a skill package where users may not expect agent permission bypass behavior.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
This file implements a SourceGit/Claude launcher, not chezmoi management logic, which is a concerning mismatch between packaged skill purpose and actual behavior. Capability mismatch is dangerous because it can conceal unexpected execution paths and reduce user scrutiny, particularly when combined here with automatic launching of Claude in a privileged mode.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
The reverse-migration guidance tells users to inspect auxiliary env files and may lead them to place secret values into chezmoi-managed configuration. In a dotfile synchronization context, that creates a realistic risk of unintentionally propagating secrets across machines, storing them in template-managed files, or committing sensitive values to source control.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The skill advertises broad activation phrases like 'cross platform', 'missing script', and 'MCP sync' that can match common user requests outside the intended chezmoi scope. Over-broad triggers can cause the wrong skill to activate and perform file-management or configuration guidance in an unintended context, increasing the risk of unsafe or confusing actions.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The quick-reference examples include generic prompts such as 'merge templates', 'missing script', 'add MCP server', and 'MCP sync' without clear chezmoi qualifiers. In an agent environment, these can broaden unintended invocation and lead to config changes, copying scripts, or synchronization advice when the user did not intend to use this skill.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The command is constructed to start Claude with permission bypass enabled and no user-facing warning, review step, or consent prompt before execution. In skill context this is more dangerous because users may invoke it as a routine helper and unknowingly grant an agent unrestricted operation over the supplied repository and accessible environment.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the user to run `chezmoi apply`, which writes configuration changes to the local system, but it does not explicitly warn that this step will modify files outside the skill itself. In a dotfile-management context, this can lead to unintended overwrites or propagation of bad template changes, especially after consolidation steps that alter shared scripts used by multiple targets.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The guidance discusses handling secret token values and even suggests embedding actual values into chezmoi-managed state without a strong privacy/security warning. That can expose credentials through plaintext config, synchronization to multiple apps, local backups, or accidental version-control inclusion.

Session Persistence

Medium
Category
Rogue Agent
Content
# macOS
SCRIPT=~/.claude/skills/chezmoi/bin/claude-source.sh
TARGET=~/bin/claude-source.sh
[[ -f "$TARGET" ]] && echo "OK" || { mkdir -p ~/bin && cp "$SCRIPT" "$TARGET" && chmod +x "$TARGET" && echo "INSTALLED"; }

# Windows (Git Bash)
SCRIPT=~/.claude/skills/chezmoi/bin/claude-source.bat
Confidence
84% confidence
Finding
mkdir -p ~/bin && cp "$SCRIPT" "$TARGET" && chmod +x "$TARGET" && echo "INSTALLED"; } # Windows (Git Bash) SCRIPT=~/.claude

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.