← 返回 Skills 市场

Dotfile Sync Manager

Name: Dotfile Sync Manager
Author: drumrobot

作者 es6kr · GitHub ↗ · v0.1.0 · MIT-0

cross-platform ⚠ suspicious

总下载

当前安装

版本数

在 OpenClaw 中安装

/install dotfile

功能描述

Synchronization management with external tools. chezmoi - dotfile template management [chezmoi.md], knowledge - session knowledge → Serena memory [knowledge....

使用说明 (SKILL.md)

Sync

Manages data synchronization with external tools (Serena, chezmoi, Syncthing, etc.).

Topics

Topic	Description	Guide
chezmoi	dotfile chezmoi template management	chezmoi.md
knowledge	Session knowledge → Serena memory sync	knowledge.md
mcp	MCP server sync (delegated to chezmoi)	mcp.md
syncthing	chezmoi source Syncthing sync and diagnostics	syncthing.md

Quick Reference

Knowledge Sync

"knowledge sync"        → Current project session → Serena memory

Chezmoi

"chezmoi add"           → Add a dotfile to chezmoi
"dotfile management"    → chezmoi template operations

Configurations managed by chezmoi:

~/.utcp_config.json - UTCP global config
~/.claude.json, ~/.cursor/mcp.json - MCP server config
~/Library/.../Syncthing/config.xml - Syncthing default config

MCP server sharing:

Single source: .chezmoitemplates/mcp-servers.json
chezmoi apply → Automatically applied to all apps

MCP

"MCP server add"        → Edit mcp-servers.json → chezmoi apply
"MCP sync"              → Apply MCP config to all apps

Syncthing

"syncthing setup"       → chezmoi source sync configuration
".stignore"             → Ignore pattern configuration
"sync incomplete"       → Per-folder status/need item diagnostics
"DB reset"              → Stale index reset (delete index-v2)

Auto-generated .stignore:

.git
(?d).DS_Store — Prevents orphaned .DS_Store on remote deletion
*.bak

安全使用建议

This skill largely does what it says (manage chezmoi/Syncthing/MCP and save session knowledge), but it performs sensitive actions: reading local config files (including Syncthing's config.xml to extract an API key), calling the Syncthing REST API on localhost, modifying chezmoi templates that propagate to multiple app configs, and deleting Syncthing index directories (destructive). It also extracts and writes conversation-derived 'infrastructure info' into Serena memory, which could persist sensitive details. Before installing or invoking: 1) Back up your chezmoi source and any app config files the skill touches (e.g., ~/.claude.json, ~/.cursor/mcp.json, ~/.utcp_config.json, Syncthing config/index directories). 2) Require explicit prompts/consent before the skill performs destructive actions (index deletion, rm -rf). 3) Confirm where Serena memory is stored and who can access it; avoid automatically persisting sensitive conversation content. 4) Validate local Syncthing API behavior and ensure API keys are handled only locally and not exfiltrated. 5) Consider running the skill in a supervised mode (user-invoked only) rather than allowing autonomous invocation until you’re comfortable with its actions.

功能分析

Type: OpenClaw Skill Name: dotfile Version: 0.1.0 The skill bundle manages sensitive configuration files and synchronization tools (chezmoi, Syncthing, MCP). It contains high-risk capabilities including extracting the Syncthing API key from local XML configs, making local network requests via curl to the Syncthing REST API, and performing destructive actions like stopping system services and deleting database directories (index-v2) for troubleshooting (syncthing.md). While these actions are aligned with the stated purpose of synchronization management and diagnostics, the high level of privilege and potential for misuse of these administrative commands warrants a suspicious classification.

能力评估

ℹ Purpose & Capability

The name/description (dotfile/sync management) aligns with the instructions (chezmoi, Syncthing, MCP, and knowledge sync). However, the skill expects to read and modify multiple user config files (~/.claude.json, ~/.cursor/mcp.json, ~/.utcp_config.json, Syncthing config.xml, chezmoi templates) while declaring no required config paths or credentials — a mild incoherence. Writing a single source of truth for MCP servers to many apps is consistent with the stated purpose but has high impact and should be explicit.

⚠ Instruction Scope

The SKILL.md instructs the agent to read local config files (Syncthing config.xml), extract an API key, call local REST endpoints (curl to localhost:8384), edit and apply chezmoi templates (which will modify many app configs), and delete index directories (rm -rf index-v2). It also instructs extracting 'infrastructure info' from conversations and writing it to Serena memory, which may capture and persist sensitive details from user sessions. Those file reads, writes, destructive operations, and memory writes go beyond simple advisory tasks and require explicit user consent and clearer limits.

✓ Install Mechanism

Instruction-only skill with no install spec and no code files — lowest installation risk. There is no downloaded code or installation script to evaluate.

⚠ Credentials

The skill declares no required env vars or credentials, but its instructions access local configuration files (which may contain API keys/tokens) and use local service APIs (Syncthing) and internal MCP/UTCP tools for Serena memory writes. Because sensitive data may be read from those files and then transmitted to Serena memory or propagated across apps, the lack of declared credentials/config paths is disproportionate and reduces transparency.

ℹ Persistence & Privilege

always is false and the skill is not permanently installed, which limits persistent attack surface. However, its runtime behavior includes overwriting centralized dotfile templates and MCP server lists (which have cross-application scope) and saving into Serena memory — actions that have persistent effects on the user's environment and stored data and therefore require explicit confirmation.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install dotfile
安装完成后，直接呼叫该 Skill 的名称或使用 /dotfile 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.1.0

Initial release: chezmoi, knowledge, mcp, syncthing topics

元数据

Slug dotfile

版本 0.1.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题