diff --git a/CLAUDE.md b/CLAUDE.md
index d66ba47d..90ca492e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -195,7 +195,7 @@ All three inherit from `BaseHttpClient` (`http_base.py`) which provides shared r
 
 11. **Error accumulation**: multi-project operations collect per-project errors without stopping. One project failing doesn't block others (see `lineage_service.py`, `org_service.py`).
 
-12. **Manage token security**: never persisted, never passed as CLI argument, never logged. Default-deny since 0.28.0: only via interactive hidden prompt; the `KBC_MANAGE_API_TOKEN` env var is **ignored** unless the top-level `--allow-env-manage-token` flag is passed. Default-deny closes the AI-exfiltration risk where any subprocess (including the AI agent itself) inherits the manage token via env. CI/CD callers must opt in explicitly.
+12. **Manage token security**: never persisted, never passed as CLI argument, never logged. Default-deny since 0.29.0: only via interactive hidden prompt; the `KBC_MANAGE_API_TOKEN` env var is **ignored** unless the top-level `--allow-env-manage-token` flag is passed. Default-deny closes the AI-exfiltration risk where any subprocess (including the AI agent itself) inherits the manage token via env. CI/CD callers must opt in explicitly.
 
 13. **Idempotency**: `org setup` skips already-registered projects by matching `project_id`. Safe to re-run.
 
diff --git a/plugins/kbagent/skills/kbagent/SKILL.md b/plugins/kbagent/skills/kbagent/SKILL.md
index 649656aa..f4a73f40 100644
--- a/plugins/kbagent/skills/kbagent/SKILL.md
+++ b/plugins/kbagent/skills/kbagent/SKILL.md
@@ -30,11 +30,15 @@ description: >
   data-app create, data-app deploy, data-app password, data-app start,
   app proxy, simpleAuth, app auto-suspend, configVersion, redeploy contract,
   Data Science API, /apps endpoint, app password, KBC::Project ciphertext,
-  local workspace, project directory, kbagent init.
+  data-app secrets, app secrets, app runtime secrets, secrets-set,
+  secrets-list, secrets-get, secrets-remove, encrypt app secret,
+  app environment variable, validate repo, validate-repo,
+  data-app golden rule, pre-flight repo check, repo structure check,
   local workspace, project directory, kbagent init,
   invite user, invite member, project invitation, manage members,
   list members, remove member, change role, project role,
-  bulk invite, invite from CSV, project access, member management.
+  bulk invite, invite from CSV, project access, member management,
+  manage token prompt, --allow-env-manage-token, KBC_MANAGE_API_TOKEN.
 ---
 
 # kbagent -- Keboola Agent CLI