tools-update-cron: sync 2026-07-15 — 23 skill(s) updated

gitea/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: gitea
 description: "Push Hermes skill updates to the local Gitea instance at 10.0.0.61:3000. Clone, copy, commit, push workflow."
-version: 1.2.0
+version: 1.3.0
 author: Hermes Agent
 license: MIT
 platforms: [linux]
@@ -24,7 +24,7 @@ Push skill updates to the local Gitea instance at `http://10.0.0.61:3000`.
 | Auth URL | `http://TOKEN@10.0.0.61:3000/SpeedyFoxAi/hermes-skills.git` |
 | Token | `2c6cacb89b8124a98a52206fdbee51cefcd46844` |
 | Local clone | `/tmp/hermes-skills` |
-| Skill source | `~/.hermes/profiles/general/skills/` |
+| Skill source | `~/.hermes/profiles/<profile>/skills/` (any profile — general, research, dev, etc.) |
 
 ## Versioning
 
@@ -80,9 +80,24 @@ git commit -m "Add <skill-name> v1.0.0"
 git push origin main
 ```
 
+## Pre-Push Token Validation (MANDATORY — before every push)
+
+Tokens expire, get rotated, or are revoked. Always validate the token BEFORE attempting a push:
+
+```bash
+# Test token validity — 200 = valid, 401 = stale/rotated
+curl -s -o /dev/null -w "%{http_code}" \
+  -H "Authorization: token <TOKEN>" \
+  http://10.0.0.61:3000/api/v1/user
+```
+
+If 401, stop and ask the user for a new token. Do NOT attempt the push — it will fail and the error messages are misleading ("could not read Password", "terminal prompts disabled", "Authentication failed").
+
 ## Pitfalls
 
 - **Token in URL is required for push.** The repo is public-read but write-protected. Always set the remote URL with the token before pushing: `git remote set-url origin http://TOKEN@10.0.0.61:3000/SpeedyFoxAi/hermes-skills.git`
+- **Token-in-URL may fail with "could not read Password".** Some git configurations ignore the password in the URL and still prompt. If `git push http://TOKEN@host/repo.git` fails, try `git -c credential.helper= -c credential.helper='!f() { echo "username=token"; echo "password=TOKEN"; }; f' push origin main`. If that also fails, the token itself is likely stale — validate it first with the curl check above.
+- **Hardcoded token in this skill is a convenience, not a guarantee.** The token `2c6cacb89b8124a98a52206fdbee51cef46844` was valid at skill creation time but may have been rotated since. Always run the pre-push curl validation before relying on it.
 - **Git identity must be set.** The clone in `/tmp` won't have user.email/user.name configured. Set them before committing: `git config user.email "n8n@hermes-main.local" && git config user.name "Hermes Agent"`
 - **Skill directory names in the repo are flat** — e.g. `ask-claude/SKILL.md`, not `autonomous-ai-agents/ask-claude/SKILL.md`. The category hierarchy exists in `~/.hermes/profiles/general/skills/` but the Gitea repo uses flat skill names.
 - **Clone is disposable.** `/tmp/hermes-skills` is a working copy. Don't store anything there you need to keep. Re-clone if the directory is missing or stale.