Skillscript

Upgrade impact: none (additive). Removes a false positive introduced in 0.25.1; no change to valid skills beyond unblocking them.

• Regression fix (adopter finding). The 0.25.1 source-level backstop counted every {{secret.NAME}} in the raw source — including one written as prose in a # Description: line ("…auth via the sealed {{secret.KEY}} marker…"). Since a description isn't an executable position, the AST scan didn't account for it, so the backstop saw a surplus and fired secret-use-only (tier-1) — blocking every skill that documents its own secret, including the recommended shell(argv=[...]) sink form. The backstop now excludes frontmatter/#-header lines from its count (op lines are always indented and never start with #), so a documented marker is ignored while a marker in a genuinely-dropped op line (the 0.25.1 bare-emit case) is still caught. Verified against the real perry-inbox-check / perry-email-send shapes.

Known issue (fix in progress): a {{secret.NAME}} marker that arrives at a sink via runtime data (a ${VAR} value that happens to contain the literal marker text) is currently resolved — a data-borne injection path. The fix is author-template-only resolution (only markers literally in the skill source resolve; data/var-borne marker text is inert). Until it lands, don't interpolate untrusted input into a secret-bearing sink. Tracked for the next patch.