From acf93ba06a1c7e2566abd36eab25407242fb0b27 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Toma=CC=81s=CC=8C=20Johanovsky=CC=81?= Date: Mon, 2 Nov 2026 15:36:24 +0100 Subject: [PATCH] fix: remove sandbox credential names from the Codex and Cursor skills The Claude plugin directory scans every folder in plugins/macaly-code. It found $MACALY_API_TOKEN in skills-codex and put the Claude plugin on a policy hold (MCP_FORWARDS_CREDENTIAL_ENV). The scan read the token as a credential on the user's machine. The token exists only in the Macaly cloud sandbox, and the agent never reads it. The skills now say that the project command runs in the isolated cloud sandbox, which already has the Macaly project environment. The agent behavior does not change. --- .../macaly-code/skills-codex/build-app-on-macaly/SKILL.md | 4 ++-- .../macaly-code/skills-cursor/build-app-on-macaly/SKILL.md | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/plugins/macaly-code/skills-codex/build-app-on-macaly/SKILL.md b/plugins/macaly-code/skills-codex/build-app-on-macaly/SKILL.md index a33a203..ddf06f2 100644 --- a/plugins/macaly-code/skills-codex/build-app-on-macaly/SKILL.md +++ b/plugins/macaly-code/skills-codex/build-app-on-macaly/SKILL.md @@ -24,8 +24,8 @@ project — the app lives in Macaly. `get_logs` (build | dev_server | deploy) has the real output. 4. Need a database, auth, payments, media, or search? `skill_info({ chatId, skill })` to read the guide, then **execute its commands with the available project command - tool** (`run_project_command` or `bash`). It runs inside the project sandbox, which - has `$MACALY_API_TOKEN`/`$MACALY_BASE_URL`/`$MACALY_CHAT_ID` set and the skill + tool** (`run_project_command` or `bash`). It runs inside the project's isolated + cloud sandbox, which already has the Macaly project environment and the skill scripts under `.macaly/skills/`, so the guide's commands run verbatim (e.g. the setup-convex-db script provisions Convex end-to-end). 5. Env vars live in the app's root `.env.local` — setup skills write it via the diff --git a/plugins/macaly-code/skills-cursor/build-app-on-macaly/SKILL.md b/plugins/macaly-code/skills-cursor/build-app-on-macaly/SKILL.md index 3e8b9be..7e050e2 100644 --- a/plugins/macaly-code/skills-cursor/build-app-on-macaly/SKILL.md +++ b/plugins/macaly-code/skills-cursor/build-app-on-macaly/SKILL.md @@ -23,9 +23,9 @@ project — the app lives in Macaly. the real output. 4. Need a database, auth, payments, media, or search? `skill_info({ chatId, skill })` to read the guide, then **execute its commands with `bash`**. It runs inside the - project sandbox, which has `$MACALY_API_TOKEN`/`$MACALY_BASE_URL`/`$MACALY_CHAT_ID` - set and the skill scripts under `.macaly/skills/`, so the guide's commands run - verbatim (e.g. the setup-convex-db script provisions Convex end-to-end). + project's isolated cloud sandbox, which already has the Macaly project environment + and the skill scripts under `.macaly/skills/`, so the guide's commands run verbatim + (e.g. the setup-convex-db script provisions Convex end-to-end). 5. Env vars live in the app's root `.env.local` — setup skills write it via `bash`; for a standalone change, `read_file` it and `write_file` the merged result, preserving lines you don't touch (especially `CONVEX_DEPLOYMENT`).