Run any Skill in Manus with one click

writing-nix

Stars4

Forks0

UpdatedJune 22, 2026 at 08:35

Idiomatic Nix review and authoring matched to THIS engineer's flake-parts dotfiles conventions. Covers the readDir-pipe auto-discovery module layout, the NixOS/Home Manager/Darwin module system (mkOption/mkEnableOption, mkIf/ mkMerge/mkDefault, options/config split), packaging with finalAttrs and SRI hashes, override vs overrideAttrs, the nix.dev anti-patterns, and the nixfmt/ statix/deadnix toolchain. Use when writing or reviewing Nix — flake.nix, a module default.nix, an overlay, a package, home-manager/NixOS/darwin config — in this repo or another flake. Knows to ALWAYS validate with nix flake check and format with nix fmt after a .nix change.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

Hayao0819

Hayao0819/dotfiles

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

6 files

SKILL.md

readonly

name

writing-nix

description

Writing Nix

A reviewer tuned to this engineer's established flake conventions, not generic Nix advice. The dotfiles repo is a flake-parts flake for NixOS + Home Manager + nix-darwin with an auto-discovery module layout; this skill mimics that style and flags regressions. Where the upstream nix.dev rulebook conflicts with the repo's deliberate local style, the repo wins (and the skill says so).

Compatibility: flakes + nix-command + pipe-operators (|>) — all three are still experimental in Nix as of mid-2026 (pipe-operators is load-bearing here, so the flag is mandatory on every invocation). pkgs.nixfmt (Haskell) is the official RFC-166 formatter; this repo deliberately uses the separate Rust pkgs.nixfmt-rs via nix fmt (they are distinct packages, not aliases). After any .nix change: format, then nix flake check --extra-experimental-features 'nix-command flakes pipe-operators'.

When to use

Writing or reviewing any .nix: flake.nix, a module default.nix, an overlay, a pkgs/* derivation, a NixOS/Home-Manager/Darwin config.
Adding an app/module/package (and respecting the no-index-edit auto-import rule).

How to read this skill

Open this	When
reference/flake-structure.md	flake-parts layout, the readDir-pipe auto-discovery idiom, inputs/follows
reference/modules.md	options/config, mkOption/mkEnableOption, mkIf/mkMerge/priorities
reference/packaging.md	finalAttrs, SRI hashes, callPackage, override vs overrideAttrs, overlays
reference/anti-patterns.md	the nix.dev anti-patterns + what this repo does differently on purpose

This repo's conventions (mimic these)

flake-parts. flake.nix is a thin dispatcher: flake-parts.lib.mkFlake with a flake = {...} block for system-agnostic outputs and perSystem for per-system ones. Outputs split into top-level dirs (modules/, nixos/, pkgs/, overlays/, home-manager/, …), each a default.nix taking { inputs } or { inputs, outputs }.
Auto-discovery, never edit an index. Aggregators use the readDir |> attrNames |> filter (≠ default.nix) |> map import |> listToAttrs pipeline. Adding a module/host/package means creating a directory with a default.nix — do not add it to an index file. → reference/flake-structure.md
Module shape: modules/<layer>/<category>/<name>/default.nix, header { config, pkgs, lib, ... }:, an explicit options/config split, lib.mkEnableOption for toggles, config = lib.mkIf cfg.enable { ... }, a cfg = config.<name> alias in larger modules. Write lib.* fully-qualified in module bodies (no with lib;). → reference/modules.md
Packaging: new derivations use the finalAttrs: pattern and SRI hash = "sha256-...";; writeShellApplication for script packages; overlays named (additions, modifications, unstable-packages) with final: prev:. → reference/packaging.md
Deliberate local style (don't "fix" these): with builtins; atop the readDir aggregators, and with pkgs; / with lib; scoped to a package list or meta block. These coexist with the nix.dev "avoid with" rule by being tightly scoped. → reference/anti-patterns.md

Highest-leverage review checks

Adding something must not touch an index file. If a change edits a default.nix aggregator to register a new module/package, that's wrong — the readDir pipeline already picks it up. → reference/flake-structure.md
mkIf wraps the config value, not the options. And two definitions at the same priority conflict — use mkDefault (1000) / mkForce (50) to resolve, and mkMerge to compose conditional blocks. → reference/modules.md
New packages use finalAttrs:, not rec — so an overrideAttrs that changes version correctly updates a src built from it. SRI hash =, not legacy sha256 = "0x...";. → reference/packaging.md
overrideAttrs (patch the derivation) vs override (swap a dependency arg) — pick the right one; prefer overrideAttrs for src/flags/phases.
Reproducibility: no builtins.currentTime, no <nixpkgs> lookup paths, no --impure; flakes only see git-tracked files (a new untracked file is invisible to nix flake check). → reference/anti-patterns.md
nativeBuildInputs (build-time tools) vs buildInputs (runtime libs) — the wrong split silently breaks cross-compilation.

Validation pass (after every .nix change — repo rule)

nix fmt        # nixfmt-rs via the flake formatter
nix flake check --extra-experimental-features 'nix-command flakes pipe-operators'
# new files must be git-added first — flakes ignore untracked files
statix check   # anti-pattern linter (in the devshell)
deadnix        # dead-code (unused bindings/args)

What this skill is not

Not a Nix-language tutorial, and not a restatement of statix/deadnix. Route mechanical lint to the tool.
It defers to the repo's deliberate style over generic nix.dev rules where they conflict — the scoped with usages are intentional.
Prose it helps you write (docs, module descriptions) goes through natural-writing.

More from this repository

same repository

writing-tech-article

Hayao0819/dotfiles

Drafts fact-based technical articles for hayao's outlets — Zenn (@hayao), Qiita (@Hayao0819), the personal blog (hayao0819.com) — matching his structural register without faking his personality. Use when writing, drafting, or rewriting a 技術記事 / blog post / Zenn / Qiita article in hayao's name about a technical topic. The LLM writes facts only: it does NOT manufacture his jokes, 毒舌, 自虐, casual throwaway closers, or first-person anecdotes — performing his personality is fabrication and he finds it offensive. Encodes the factual baseline of his writing (genre-driven 敬体/常体, direct openings, plain content-label headings, inline-code density, primary-source links) in a bundled reference.md, and composes with the natural-writing skill. Self-contained — does not depend on machine-local memory. Do NOT use for: non-hayao docs, pure code, commit messages, or chat replies.

2026-06-264

natural-writing

Hayao0819/dotfiles

Rewrites prose so it reads as if a human wrote it — stripping out LLM tells in both English and Japanese. Use whenever producing user-visible writing of any kind: documentation, README, markdown, blog posts, commit messages, PR descriptions, GitHub Issues, code-review comments, code comments and docstrings, replies in issue threads, professional or casual emails, Slack/Discord/chat messages, release notes, design docs, academic-style writeups and 論文. Use it even when the user did not ask for "natural" prose — any drafted text leaving Claude that a human will read should pass through this checklist first. Triggers include: any request to "write", "draft", "compose", "summarize", "explain", "describe", "review", "comment", "reply", or 「書いて」「文章作って」「まとめて」「メール作って」「返信して」「PR/Issueの説明書いて」. Do NOT use for: pure code generation with no prose, raw data transformations, or terse tool output.

2026-06-254

auditing-c-memory

Hayao0819/dotfiles

Security audit of memory-safety vulnerabilities in C/C++ (userland/systems, not kernel), with confidence-gated reporting to keep false positives low. Taint-traces untrusted input (argv, env, files, network, stdin) to memory sinks (copy length, array index, allocation size, format string) and reports only when input is attacker-controlled AND reaches the sink AND bounds aren't enforced. Covers buffer overflow, use-after-free, double-free, OOB read, integer overflow into undersized alloc, format string, the dangerous-function table, hardening flags to verify, and the ASan/UBSan/MSan/fuzzing toolchain. Covers userland/systems C and the SGX enclave/host (ECALL/OCALL) pointer boundary. Use when reviewing C/C++ for memory-corruption bugs. Kernel code → auditing-kernel.

2026-06-224

auditing-kernel

Hayao0819/dotfiles

Security audit of Linux kernel code and out-of-tree modules/drivers, with confidence-gated reporting to keep false positives low. Traces attacker input from userspace entry points (syscalls, ioctl, sysfs/proc/debugfs writes, netlink, char-dev, mmap) — and, for confidential-computing guests, from the untrusted host — to memory/refcount/locking/infoleak sinks. Covers UAF via refcount imbalance, the copy_to/from_user boundary, double-fetch TOCTOU, missing capability checks, integer-overflow allocations, ioctl handler review, and the TDX/SEV-SNP/SGX threat model. Use when reviewing kernel C, a driver/ LKM, an ioctl handler, or enclave/attestation code for vulnerabilities.

2026-06-224

auditing-web-app

Hayao0819/dotfiles

Security audit of web applications — backend implementation and authentication/ authorization flows — with confidence-gated reporting to keep false positives low. Traces attacker-controlled request input (params, body, headers, cookies, path) to sinks, distinguishing server-controlled from attacker-controlled, and reports HIGH only. Leads with broken access control / IDOR (OWASP #1), then injection (and where GORM/sqlc/React are already safe), XSS, SSRF, CSRF, auth (password storage, sessions, reset), and tokens (JWT alg confusion, OAuth/OIDC PKCE). Framework-aware for Go/Gin/GORM/sqlc and Next.js Server Actions. Use when reviewing a web backend, API, route handler, Server Action, or auth flow.

2026-06-224

writing-go

Hayao0819/dotfiles

Idiomatic, version-current Go review and authoring for an experienced engineer. Covers deliberate error wrapping (errors.Is/As/Join, AsType), structured concurrency (errgroup, context, the loopvar fix), modern stdlib that replaced old patterns (slices/maps/cmp, log/slog, min/max/clear, range-over-func iterators), table-driven and synctest testing, API design the linter can't check, and Gin/GORM/cobra backend patterns. Use when writing, reviewing, or refactoring Go — .go files, go.mod, goroutines, errors.Is/As, a Go backend or CLI — or before committing Go. Flags outdated pre-1.22 idioms (loopvar v:=v shadows, tools.go, hand-rolled helpers).

2026-06-224

name

writing-nix

description

Writing Nix

Compatibility: flakes + nix-command + pipe-operators (|>) — all three are still experimental in Nix as of mid-2026 (pipe-operators is load-bearing here, so the flag is mandatory on every invocation). pkgs.nixfmt (Haskell) is the official RFC-166 formatter; this repo deliberately uses the separate Rust pkgs.nixfmt-rs via nix fmt (they are distinct packages, not aliases). After any .nix change: format, then nix flake check --extra-experimental-features 'nix-command flakes pipe-operators'.

When to use

Writing or reviewing any .nix: flake.nix, a module default.nix, an overlay, a pkgs/* derivation, a NixOS/Home-Manager/Darwin config.
Adding an app/module/package (and respecting the no-index-edit auto-import rule).

How to read this skill

Open this	When
reference/flake-structure.md	flake-parts layout, the readDir-pipe auto-discovery idiom, inputs/follows
reference/modules.md	options/config, mkOption/mkEnableOption, mkIf/mkMerge/priorities
reference/packaging.md	finalAttrs, SRI hashes, callPackage, override vs overrideAttrs, overlays
reference/anti-patterns.md	the nix.dev anti-patterns + what this repo does differently on purpose

This repo's conventions (mimic these)

flake-parts. flake.nix is a thin dispatcher: flake-parts.lib.mkFlake with a flake = {...} block for system-agnostic outputs and perSystem for per-system ones. Outputs split into top-level dirs (modules/, nixos/, pkgs/, overlays/, home-manager/, …), each a default.nix taking { inputs } or { inputs, outputs }.
Auto-discovery, never edit an index. Aggregators use the readDir |> attrNames |> filter (≠ default.nix) |> map import |> listToAttrs pipeline. Adding a module/host/package means creating a directory with a default.nix — do not add it to an index file. → reference/flake-structure.md
Module shape: modules/<layer>/<category>/<name>/default.nix, header { config, pkgs, lib, ... }:, an explicit options/config split, lib.mkEnableOption for toggles, config = lib.mkIf cfg.enable { ... }, a cfg = config.<name> alias in larger modules. Write lib.* fully-qualified in module bodies (no with lib;). → reference/modules.md
Packaging: new derivations use the finalAttrs: pattern and SRI hash = "sha256-...";; writeShellApplication for script packages; overlays named (additions, modifications, unstable-packages) with final: prev:. → reference/packaging.md
Deliberate local style (don't "fix" these): with builtins; atop the readDir aggregators, and with pkgs; / with lib; scoped to a package list or meta block. These coexist with the nix.dev "avoid with" rule by being tightly scoped. → reference/anti-patterns.md

Highest-leverage review checks

Adding something must not touch an index file. If a change edits a default.nix aggregator to register a new module/package, that's wrong — the readDir pipeline already picks it up. → reference/flake-structure.md
mkIf wraps the config value, not the options. And two definitions at the same priority conflict — use mkDefault (1000) / mkForce (50) to resolve, and mkMerge to compose conditional blocks. → reference/modules.md
New packages use finalAttrs:, not rec — so an overrideAttrs that changes version correctly updates a src built from it. SRI hash =, not legacy sha256 = "0x...";. → reference/packaging.md
overrideAttrs (patch the derivation) vs override (swap a dependency arg) — pick the right one; prefer overrideAttrs for src/flags/phases.
Reproducibility: no builtins.currentTime, no <nixpkgs> lookup paths, no --impure; flakes only see git-tracked files (a new untracked file is invisible to nix flake check). → reference/anti-patterns.md
nativeBuildInputs (build-time tools) vs buildInputs (runtime libs) — the wrong split silently breaks cross-compilation.

Validation pass (after every .nix change — repo rule)

nix fmt        # nixfmt-rs via the flake formatter
nix flake check --extra-experimental-features 'nix-command flakes pipe-operators'
# new files must be git-added first — flakes ignore untracked files
statix check   # anti-pattern linter (in the devshell)
deadnix        # dead-code (unused bindings/args)

What this skill is not

Not a Nix-language tutorial, and not a restatement of statix/deadnix. Route mechanical lint to the tool.
It defers to the repo's deliberate style over generic nix.dev rules where they conflict — the scoped with usages are intentional.
Prose it helps you write (docs, module descriptions) goes through natural-writing.