Findings from scanning skills/ + optional-skills/ with NVIDIA
SkillEvaluator's deterministic Tier 1 checks (PII/secrets, unicode
smuggling, script lint):
- pixel-art, pokemon-player: remove hardcoded /home/teknium/ personal
paths (use ~ / portable phrasing); pokemon-player no longer claims
machine-specific state as fact
- kanban-video-orchestrator: replace <path> angle-bracket token in
frontmatter credits (flagged as XML-in-frontmatter prompt injection)
- comfyui, hermes-agent, unsloth, 1password, actual-setup: rephrase
placeholder secrets so they no longer pattern-match real credentials
(your-* placeholder convention, comment markers, {env:...} form)
- docker-management, pytorch-lightning: drop user:pass@ from example
connection strings (env/secret-manager guidance instead)
- evm: break up Keccak round constant that Luhn-validates as a credit
card number (digit-group underscores, value unchanged)
All targeted skills now pass pii+unicode+lint 3/3 except unsloth, which
retains scanner false positives only (Colab notebook IDs read as Bitcoin
addresses; an email inside a quoted upstream system prompt).
Follow-up to PR #883 (arceus77-7):
- Add setup.collect_secrets for OP_SERVICE_ACCOUNT_TOKEN so the skill
prompts users to configure their token on first load
- Fix broken code examples: garbled op run export line, truncated
secret reference in cli-examples.md
- Add Authentication Methods section documenting all 3 auth flows
(service account, desktop app, connect server) with service account
recommended for Hermes
- Clarify tmux pattern is only needed for desktop app flow, not
service account token flow
- Credit original author (arceus77-7) in frontmatter
- Add DESCRIPTION.md for security/ category
Co-authored-by: arceus77-7 <arceus77-7@users.noreply.github.com>
Teknium
teknium1
arceus77-7