chezmoi

This skill appears to implement a real chezmoi workflow, but there are several things to check before you install or let an agent run it autonomously: - Review the included helper script (bin/claude-source.sh). It launches a local 'claude' command with --dangerously-skip-permissions which bypasses permissions checks for that CLI; only install if you trust that binary and understand the consequences. - Expect the skill to copy files into your home (~/bin) and to modify multiple application config files (~/.claude.json, ~/.cursor/mcp.json, ~/.utcp_config.json, etc.) via chezmoi apply. Make backups and run chezmoi diff yourself before applying any changes. - The SKILL.md references several environment variables (MCP_JSON, EXTRA_SETTINGS, SOURCEGIT_EXECUTABLE, CHEZMOI_OS) but the skill metadata does not declare them. Ask the author (or inspect templates) to confirm which variables are required and where they come from. Treat any steps that use undeclared env vars as potentially risky. - Because the skill can write files and run commands, prefer explicit user invocation rather than allowing autonomous runs. If you will let an agent run it, ensure AskUserQuestion prompts are enforced and review the diffs/ask prompts before any 'chezmoi apply' is executed. - If anything is unclear, request the maintainer to: (1) declare required env vars in metadata, (2) remove or explain --dangerously-skip-permissions usage, and (3) provide a dry-run-only mode that never writes to home without explicit signed confirmation. If you want, I can extract the specific lines that reference undeclared env vars and the exact files that will be written so you can audit them more easily.