dotfilesCAUTION

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

mkdir -p ~/projects/personal
git clone https://github.com/seanogdev/dotfiles.git ~/projects/personal/dotfiles
cd ~/projects/personal/dotfiles
./setup.sh

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: manage-skills
description: Install, update, back up, and restore GitHub-hosted Claude Code skills for this dotfiles setup. Use when the user wants to add a skill from a GitHub repo, keep installed skills current, back up or restore the skill inventory across machines, or asks about `gh skill`, `.Skillfile`, or the skills-install/backup/restore/update fish functions — even when they don't say "skill," e.g. "set this laptop up with my usual skills" or "is there an update for that thing I installed." Does not cover editing the two dotfiles-specific skills under `.agents/skills/<name>` in this repo (`manage-skills`, `manage-stow`).
license: MIT
---

Manage GitHub-hosted skills with `gh skill` (GitHub CLI, preview) via `skills-install`, `skills-backup`, `skills-restore`, and `skills-update`. Each takes `--help`. Install each one to the canonical location `~/.agents/skills/`, the agentskills.io convention. Claude Code reads from `~/.claude/skills/`. Each managed skill there is a symlink into `~/.agents/skills/<name>`.

Two skills are different: `manage-skills` and `manage-stow` are dotfiles-specific, so they live in this repo as real files at `.agents/skills/<name>/SKILL.md` instead of being installed by `gh skill`. `.claude/skills/<name>` is a symlink to `../../.agents/skills/<name>`. Stow projects both into `$HOME`.

## Gotchas

- `gh skill` keeps no lock file. It reads no manifest. It writes source-tracking metadata into the frontmatter of each `SKILL.md`. `gh skill update` needs that metadata to detect a change.
- Scope `gh skill update` with `--dir`. Unscoped, it scans every agent host on the machine. These hosts include `~/.config/goose/skills/` and `~/.config/opencode/skills/`. The scan buries the real output in warnings.
- `gh skill` does not follow a symlinked skill directory. `manage-skills` and `manage-stow` are each a symlink in `~/.agents/skills/`. Every scan skips them. The scan gives no warning. This is correct here. Neither has `github-repo` frontmatter, so `gh skill` has nothing to update.
- Each `.Skillfile` line is `<owner/repo> <skill-path> [pin]`. The pin is the `github-pinned` frontmatter value, a tag or commit SHA. It is there only for a skill installed with `--pin`. `gh skill update` skips a pinned skill. To move a pin, reinstall with `skills-install <owner/repo> <skill-path> <new-pin>`, then run `skills-backup`. The path is the exact repo path from the `github-path` frontmatter. Do not substitute the namespaced name that `gh skill list` reports. The path `accessibility-compliance/wcag-audit-patterns` fails to install. The path `plugins/accessibility-compliance/skills/wcag-audit-patterns` works. `gh skill list --json` has no field for the exact path. Therefore `skills-backup` reads the frontmatter to get it.
- `skills-restore` makes `~/.agents/skills/` agree with `.Skillfile`. It removes each skill that has `github-repo` frontmatter but no `.Skillfile` line, and it removes the `~/.claude/skills/` symlink of that skill. To remove a skill, delete its `.Skillfile` line, then run `skills-restore`. After `skills-install`, run `skills-backup`. If you do not, the next `skills-restore` removes the new skill.
- `.Skillfile` excludes every skill without `github-repo` frontmatter. Private skills have none, so they never appear in `.Skillfile`. They live in the iCloud Store, and `stow-icloud` puts them in `~/.agents/skills/`.
- The dotfiles repo is the exception to keeping project-scope and user-scope skills apart: its `.claude/skills/` holds the symlinks that stow projects into `$HOME`.
- `seanogdev/skills`, not this repo, is the Claude Code plugin root for the general-purpose skills. Its `.claude-plugin/plugin.json` declares the plugin `seanog-skills`. To add a skill to that plugin, add it under `skills/` there. There is no list to update.

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

declared (1 observation(s))

Dependencies

pinned

Secrets in source

none-found

Findings (8)

.claude/skills/manage-skills

.claude/skills/manage-stow

.Brewfile

.Skillfile

.gitignore_global

.stow-local-ignore

.claude/AGENTS.md

.config/ghostty/CLAUDE.md

Gates applied: no_behavioural_pass.