Teknium
2b48ba0249
Findings from scanning skills/ + optional-skills/ with NVIDIA
SkillEvaluator's deterministic Tier 1 checks (PII/secrets, unicode
smuggling, script lint):
- pixel-art, pokemon-player: remove hardcoded /home/teknium/ personal
paths (use ~ / portable phrasing); pokemon-player no longer claims
machine-specific state as fact
- kanban-video-orchestrator: replace <path> angle-bracket token in
frontmatter credits (flagged as XML-in-frontmatter prompt injection)
- comfyui, hermes-agent, unsloth, 1password, actual-setup: rephrase
placeholder secrets so they no longer pattern-match real credentials
(your-* placeholder convention, comment markers, {env:...} form)
- docker-management, pytorch-lightning: drop user:pass@ from example
connection strings (env/secret-manager guidance instead)
- evm: break up Keccak round constant that Luhn-validates as a credit
card number (digit-group underscores, value unchanged)
All targeted skills now pass pii+unicode+lint 3/3 except unsloth, which
retains scanner false positives only (Colab notebook IDs read as Bitcoin
addresses; an email inside a quoted upstream system prompt).
32 lines
599 B
Markdown
32 lines
599 B
Markdown
# op CLI examples
|
|
|
|
## Sign-in and identity
|
|
|
|
```bash
|
|
op signin
|
|
op signin --account my.1password.com
|
|
op whoami
|
|
op account list
|
|
```
|
|
|
|
## Read secrets
|
|
|
|
```bash
|
|
op read "op://app-prod/db/password"
|
|
op read "op://app-prod/npm/one-time password?attribute=otp"
|
|
```
|
|
|
|
## Inject secrets
|
|
|
|
```bash
|
|
echo "api_key: {{ op://app-prod/openai/api key }}" | op inject
|
|
op inject -i config.tpl.yml -o config.yml
|
|
```
|
|
|
|
## Run command with secrets
|
|
|
|
```bash
|
|
export DB_PASSWORD="op://app-prod/db/password" # example op:// reference, resolved by `op run`
|
|
op run -- sh -c '[ -n "$DB_PASSWORD" ] && echo "DB_PASSWORD is set"'
|
|
```
|