Skills config-auditing

📦

config-auditing

Name: config-auditing
Author: BitYoungjae

Content revision r2 High Risk ⚡ Contains scripts📁 Filesystem access🔑 Env variables⚙️ External commands

Audit Neovim Configurations with Confidence

Neovim configurations can hide deprecated APIs, security issues, and startup bottlenecks. This skill provides structured checks, version guidance, and practical recommendations.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "config-auditing" from https://skillstore.io/skills/bityoungjae-config-auditing.md and its manifest at https://skillstore.io/api/skills/bityoungjae-config-auditing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/bityoungjae-config-auditing.md Signed manifest GET /api/skills/bityoungjae-config-auditing/manifest Signed lockfile GET /api/skills/bityoungjae-config-auditing/lockfile

Test it

Using "config-auditing". Audit my Neovim 0.10 configuration for deprecated option APIs.

Expected outcome:

Warning: A deprecated buffer option setter appears in lua/config/options.lua.
Replace it with the supported buffer-local option interface.
No removed formatting APIs were found.

Using "config-auditing". Explain why my Neovim startup is slow.

Expected outcome:

The report ranks eager plugin loads, startup autocmds, and top-level requires, then recommends targeted lazy-loading changes.

Using "config-auditing". Review my keymaps and configuration organization.

Expected outcome:

Duplicate mappings are grouped by key and source location.
Organization advice separates options, keymaps, autocmds, and plugin specifications.

Security Audit

High Risk

v10 • 7/23/2026 Open versioned report

This documentation skill uses read-only shell checks against local Neovim files; most static alerts misclassify examples, keymap names, and conventional paths. Two checks use predictable temporary files, and the credential scan can print plaintext secrets. Headless validation also executes the active configuration without isolation.

Files scanned

1,189

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:29 SKILL.md:44-47 audit-checklist.md:81 audit-checklist.md:165-178 deprecated-apis.md:13

Unrestricted Neovim configuration execution

Several checks launch Neovim with the active configuration, and one explicitly runs init.lua. An untrusted configuration can execute commands with the agent user's permissions.

The cited commands directly start Neovim without isolating the active configuration, while SKILL.md explicitly executes init.lua with dofile.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

audit-checklist.md:139

Generic API/secret keys

grep -rniE "(api_key|apikey|token|password|secret)\s*=\s*['\"][^'\"]+['\"]" ~/.config/nvim --include

The detection command prints full lines matching token, password, or secret assignments from the user's configuration. Plaintext values can enter agent output and model context, creating a real credential-disclosure risk.

Medium

audit-checklist.md:107

Temp directory access

nvim --startuptime /tmp/startup.log +q && awk '/^[0-9].*--- NVIM/ {print "Total: "$1"ms"}' /tmp/star

The command writes startup data to the fixed path /tmp/startup.log. On a shared system, a predictable path can be pre-created or linked, causing unintended overwrite or disclosure.

Medium

SKILL.md:41

Temp directory access

nvim --startuptime /tmp/nvim-startup.log +q && tail -5 /tmp/nvim-startup.log

The quick check writes startup data to the fixed path /tmp/nvim-startup.log. A predictable shared temporary path can be pre-created or linked, causing unintended overwrite or disclosure.

Risk Factors

⚡ Contains scripts (1)

audit-checklist.md:116

📁 Filesystem access (50)

🔑 Env variables (2)

audit-checklist.md:139 audit-checklist.md:142

⚙️ External commands (4)

deprecated-apis.md:327 SKILL.md:24-48 SKILL.md:48-95 SKILL.md:95-121

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/bityoungjae-config-auditing/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/bityoungjae-config-auditing/security.svg)](https://skillstore.io/skills/bityoungjae-config-auditing?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/bityoungjae-config-auditing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/bityoungjae-config-auditing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/bityoungjae-config-auditing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

BitYoungjae. (2026). config-auditing security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/bityoungjae-config-auditing/audits/10

BibTeX citation

@techreport{bityoungjae-bityoungjae-config-auditing-2026,
  author = {BitYoungjae},
  title = {config-auditing security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/bityoungjae-config-auditing/audits/10},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "config-auditing security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
  - name: "BitYoungjae"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/bityoungjae-config-auditing/audits/10"
identifiers:
  - type: other
    value: "skillstore:bityoungjae-config-auditing:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Review a personal configuration

Find structural, compatibility, and security issues before upgrading Neovim.

Modernize shared editor settings

Replace deprecated APIs and standardize Lua patterns across a maintained configuration.

Investigate slow startup

Identify eager plugin loading, frequent autocmds, and settings that may delay startup.

Try These Prompts

Review configuration structure

Review my Neovim configuration files. Identify structure issues and explain each recommendation without changing files.

Check deprecated APIs

Audit this Neovim configuration for deprecated APIs. Use version [VERSION], cite file paths and lines, and suggest supported replacements.

Assess startup performance

Assess startup performance using existing logs and configuration files. Rank eager plugins, top-level requires, and frequent autocmds by likely impact.

Run a constrained security audit

Audit [CONFIG_PATH] for security and compatibility with Neovim [VERSION]. Do not execute configuration code. Redact secrets and prioritize findings by impact.

Best Practices

Confirm the installed Neovim version before applying version-specific deprecation guidance.
Review every shell command before execution, especially commands that load the active configuration.
Redact credential values and share only the minimum files needed for analysis.

Avoid

Do not treat every deprecated API as removed without checking the target version.
Do not execute an unfamiliar Neovim configuration merely to collect audit data.
Do not paste secrets or complete private configuration trees into prompts.

Frequently Asked Questions

Does this skill modify my Neovim configuration?

No. Its documented workflow analyzes files and recommends changes, but users should review every suggested command.

Which Neovim versions does it cover?

The included reference covers selected deprecations from versions 0.9 through 0.12 nightly.

Which plugin managers are supported?

The guidance focuses on lazy.nvim and includes migration references for legacy packer.nvim configurations.

Can the checks execute my configuration?

Yes. Some headless commands load the active configuration, so review and approve them before use.

How should detected credentials be handled?

Do not share credential values. Redact matches, rotate exposed secrets, and move credentials into protected environment variables.

Does the audit require internet access?

The reference checks are local, but loaded configurations or plugins may perform network operations.

Developer Details

Author

BitYoungjae

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/BitYoungjae/marketplace/tree/main/plugins/nvim-doctor/skills/config-auditing

Ref

8c3e20bba512c392d9b02ee748b18e0b09d4982c

Maintenance freshness

7/24/2026

Usage

9 downloads · 192 views

File structure

📄 audit-checklist.md

📄 best-practices.md

📄 deprecated-apis.md

📄 SKILL.md