Skip to content

Slim down SKILL.md to reduce scanner false positive #1223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brunobuddy merged 3 commits into from
Mar 22, 2026
Merged

Slim down SKILL.md to reduce scanner false positive #1223

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f4f6b1a
Slim down SKILL.md to essential setup and usage info
brunobuddy Mar 22, 2026
17406cc
Update SKILL.md description, features, and provider categories
brunobuddy Mar 22, 2026
eb5eca3
Revert SKILL.md to full version, update description and fix metadata
brunobuddy Mar 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/slim-skill-md.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"manifest": patch
---

Slim down SKILL.md to essential setup and usage instructions. Detailed security, privacy, routing, and troubleshooting docs moved to GitHub README.
4 changes: 2 additions & 2 deletions skills/manifest/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Mar 22, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: The added verbose security/routing/reference sections make SKILL.md substantially larger and likely reintroduce the scanner false positives this PR is intended to eliminate.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At skills/manifest/SKILL.md, line 17:

<comment>The added verbose security/routing/reference sections make SKILL.md substantially larger and likely reintroduce the scanner false positives this PR is intended to eliminate.</comment>

<file context>
@@ -1,64 +1,229 @@
 
 Source: [github.com/mnfst/manifest](https://github.com/mnfst/manifest) — MIT licensed. Homepage: [manifest.build](https://manifest.build)
 
+## Security & Privacy
+
+> **TL;DR** — OTLP telemetry collects only metadata (model, tokens, latency, tool names) — never prompt or response text. When `manifest/auto` routing is active, the last 10 non-system messages are sent to the routing endpoint for tier scoring; set a fixed model to avoid this. The API key (`mnfst_*`) authenticates your telemetry — it is not exfiltration. In local mode, all data stays on your machine.
</file context>
Fix with Cubic

name: manifest
description: Smart LLM Router for OpenClaw. Save up to 70% by routing every request to the right model. No coding required.
metadata: {"openclaw":{"requires":{"bins":["openclaw"]},"primaryEnv":"MANIFEST_API_KEY","homepage":"https://github.com/mnfst/manifest"}}
description: Model Router for OpenClaw. Save up to 70% by routing requests to the right model. Choose LLM fallback to avoid API rate limits, set thresholds and reduce token consumption.
metadata: {"openclaw":{"requires":{"bins":["openclaw"]},"homepage":"https://github.com/mnfst/manifest"}}
---

# Manifest — LLM Router & Observability for OpenClaw
Expand Down
Loading