nix-store-scan SKILL.md skillA
nix-store-scan from ncaq/konoka is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add ncaq/konoka/nix-store-scan@git:20260824.d96d6dcPins git:20260824.d96d6dc in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- ncaq/konoka
- Path
plugins/nix-tasuke/skills/nix-store-scan/SKILL.md- Versions recorded
- 5
- Latest version
- git:20260824.d96d6dc, committed Aug 24, 2026
- First version recorded
- Aug 24, 2026
- Size
- 6,319 bytes
- Repository stars
- 3
- License
- Apache-2.0
Never scan /nix/store without limits, such as shell wildcard/glob expansion or recursive search over the whole store, because it contains hundreds of thousands of entries and can crash the agent process via OOM. Resolve the exact store path with nix commands first and operate scoped to that single path, or cap depth and result count like fd --max-depth 1 --max-results. Use when searching, listing, or accessing files under /nix/store.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# /nix/storeの無制限な走査の禁止 `/nix/store`全体を無制限に走査する操作は禁止です。 ワイルドカード展開はその代表例ですが、 再帰検索や上限なしの全件列挙も同様に禁止です。 ## 禁止される操作 - シェルのglob展開: `ls /nix/store/*ghc*`, `du -sh /nix/store/*`, `echo /nix/store/**/*.so` - Claude CodeのGlobツールやGrepツールを`/nix/store`全体に向けること - `rg`や`grep -r`を`/nix/store`全体に再帰させること - `ls /nix/store`や`nix path-info --all`のような全件列挙。 これらは全件を読み終えてから出力するため、 `head`などで出力を絞っても走査自体は打ち切れず禁止です ## なぜ危険か - `/nix/store`直下だけで数十万エントリに達することが珍しくありません。 glob展開はシェルが全エントリ名をメモリ上に構築・ソートするため、 この時点で数十MBのメモリ消費が発生します。 - 展開結果を外部コマンドへ渡す場合は、 `ARG_MAX`(通常2MiB)を超えて`E2BIG`で失敗します。 失敗するのに展開のコストだけは支払うことになります。 - `echo`のような組み込みコマンドや`for`のような組み込み構文はエラーにならず、 シェルがメモリと時間を消費し切った上で巨大な出力を生みます。 組み込みや`xargs`を経由すれば安全になるわけではありません。 - `**`による再帰globは、 zshやbashの`globstar`有効時にはストア全体の数百万から数千万のファイルを走査し、 時間とメモリを大量に消費します。 `globstar`が無効な既定のbashでも`**`は`*`と同義なので、 `/nix/store/*/*.so`相当の数十万エントリ規模の展開が起きて危険です。 - Claude Codeのツール経由で実行した場合、 巨大な結果をClaude Code本体のプロセスが蓄積するため、 シェルの子プロセスではなくClaude Code自身がOOM Killerに殺されます。 - 仮に完走しても巨大な出力がコンテキストを圧迫します。 ## 原則 ストア全体を無制限に走査しないことが原則です。 Nixのメタデータで正確なストアパスを1つ特定してから、 そのパスに限定して操作するのが基本形です。 ストア全体を対象にする場合は、 深さと件数の上限を必ず付けてください。 これが許されるのは`fd`のように、 `--max-depth`で走査範囲そのものを限定でき、 …
Read the whole file at its exact version.
How to install
mdr add ncaq/konoka/nix-store-scan@sha256:10974861c1d2f1fbThe line at the top of this page pins the label git:20260824.d96d6dc, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_fmik3twjokvm2cqn)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, all committed on Aug 24, 2026.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260824.d96d6dc latest | 2026-08-24 | d96d6dc | 6,319 B | A | view · diff |
| git:20260824.5ebb932 | 2026-08-24 | 5ebb932 | 6,316 B | A | view · diff |
| git:20260824.ae06ced | 2026-08-24 | ae06ced | 6,119 B | A | view · diff |
| git:20260824.6dbddfa | 2026-08-24 | 6dbddfa | 5,683 B | A | view · diff |
| git:20260824.33a873b | 2026-08-24 | 33a873b | 5,569 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6319 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
ncaq/konoka · 3 stars · license Apache-2.0 · pushed 2026-10-19 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_fmik3twjokvm2cqn GET https://markdownregistry.com/api/v1/resolve?ref=ncaq/konoka/nix-store-scan GET https://markdownregistry.com/api/v1/blob/10974861c1d2f1fb5265e1278d79df3d005dfae8aa597cd7719005f8ff3b5c46
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.