--- name: feedback-hermes-skill-migration-secret-redaction description: When copying Hermes skill files from ~/.hermes/profiles/ into skills//, a live Feishu Base token is hardcoded in some source SKILL.md files and must be redacted, not copied verbatim. metadata: type: feedback --- When migrating `~/.hermes/profiles/.../SKILL.md` content into this repo's `skills//` (2026-08-04, 12-skill migration task), a literal Feishu Base token (labeled "Base"/"Base Token" — a Feishu Bitable identifier used with `lark-cli ... --as user`; value intentionally omitted here, see git history pre-redaction commits if the actual value is ever needed for incident response) is hardcoded in plaintext in at least 3 source files: `planning-requirement-expansion/SKILL.md`, `qa-task-validation/SKILL.md`, `code-task-development/SKILL.md`. A sibling file in the same source tree (`code/skills/software-development/code-agent-engineering/references/graphagent-base-state-machine.md`) already redacts this exact same value to `[REDACTED]` with a comment that it's injected at runtime by a cron job and must not be written into rule files — i.e. a prior human/agent already decided this value is secret-class, just didn't fix the other 3 copies at the source. **Why:** committing this literal token into this git repo's history would violate this agent's own "never read/output credentials or secrets" constraint, regardless of the migration task's "copy verbatim, do not rewrite/summarize" instruction — the verbatim instruction is about not editorializing content, not license to commit a live credential. This repo's own `agents/coder/SOUL.md` migration note independently documents the same category of Feishu Base token being excised during the 2026-07-31 SOUL.md migration, so this is a repeated pattern, not a one-off. **How to apply:** if asked to migrate/copy more Hermes profile skill content into this repo (or any other target repo) in the future, grep the source tree for this literal token string (and generally for "Base Token"/"Base：" lines with an inline value) before copying, and replace matches with `[REDACTED]` plus a short inline note, mirroring the existing `graphagent-base-state-machine.md` precedent — do this before running byte-diff verification, and document the specific files/lines changed in the final report so Validator can review the deviation from "verbatim" explicitly.