fix(skills): prevent PAT pollution of bundled skills and orphan secrets on delete

Five connected gaps in the original PAT feature, all in company-skills.ts:

1. upsertImportedSkills only protected bundled rows from overwrite when the
   incoming source claimed to be paperclipai/paperclip. A SKILL.md from any
   other org/repo whose key resolves to paperclipai/paperclip/<slug> would
   hijack the bundled row and gain a sourceAuthSecretId. Broadened: any
   non-bundled incoming is rejected when existing is paperclip_bundled.

2. The metadata-build block preserved sourceAuthSecretId from existing
   indiscriminately, so any pollution of a bundled row was kept across every
   ensureBundledSkills re-upsert. Skip preservation when existing is bundled.

3. importFromSource's auth-token loop wrote sourceAuthSecretId for every
   imported skill including any bundled ones that snuck through. Defense in
   depth: skip skills with sourceKind === "paperclip_bundled".

4. updateSkillAuth had no guard, so the PATCH /skills/:id/auth route could
   attach a PAT to a bundled skill via direct API call. Reject explicitly.

5. deleteSkill removed the secret without checking whether any sibling skill
   still referenced it via metadata.sourceAuthSecretId. Re-imports preserve
   that reference, so two skills could share a secret and deleting one would
   orphan the other's reference. Now skip the remove if another skill in the
   same company still references the secret.

packages/shared/src/index.ts

@@ -473,7 +473,6 @@ export type {
   CompanyPortabilityImportRequest,
   CompanyPortabilityImportResult,
   CompanyPortabilityExportRequest,
-  CompanyPortabilitySecretEntry,
   EnvBinding,
   AgentEnvConfig,
   CompanySecret,
@@ -813,6 +812,7 @@ export {
   companySkillDetailSchema,
   companySkillUpdateStatusSchema,
   companySkillImportSchema,
+  companySkillUpdateAuthSchema,
   companySkillProjectScanRequestSchema,
   companySkillProjectScanSkippedSchema,
   companySkillProjectScanConflictSchema,

packages/shared/src/types/company-portability.ts

@@ -1,4 +1,4 @@
-import type { AgentEnvConfig, SecretProvider } from "./secrets.js";
+import type { AgentEnvConfig } from "./secrets.js";
 import type { RoutineVariable } from "./routine.js";
 
 export interface CompanyPortabilityInclude {
@@ -18,10 +18,6 @@ export interface CompanyPortabilityEnvInput {
   requirement: "required" | "optional";
   defaultValue: string | null;
   portability: "portable" | "system_dependent";
-  secretName?: string | null;
-  secretProvider?: string | null;
-  /** Binding type — stored in extension.inputs.env but not in the manifest type itself */
-  type?: "secret_ref" | "plain";
 }
 
 export type CompanyPortabilityFileEntry =
@@ -170,15 +166,6 @@ export interface CompanyPortabilityManifest {
   projects: CompanyPortabilityProjectManifestEntry[];
   issues: CompanyPortabilityIssueManifestEntry[];
   envInputs: CompanyPortabilityEnvInput[];
-  secrets?: CompanyPortabilitySecretEntry[];
-}
-
-export interface CompanyPortabilitySecretEntry {
-  name: string;
-  provider: SecretProvider;
-  description: string | null;
-  latestVersion: number;
-  currentValue: string;
 }
 
 export interface CompanyPortabilityExportResult {
@@ -330,5 +317,4 @@ export interface CompanyPortabilityExportRequest {
   selectedFiles?: string[];
   expandReferencedSkills?: boolean;
   sidebarOrder?: Partial<CompanyPortabilitySidebarOrder>;
-  includeSecrets?: boolean;
 }

packages/shared/src/types/index.ts

@@ -304,7 +304,6 @@ export type {
   CompanyPortabilityImportRequest,
   CompanyPortabilityImportResult,
   CompanyPortabilityExportRequest,
-  CompanyPortabilitySecretEntry,
 } from "./company-portability.js";
 export type {
   JsonSchema,

packages/shared/src/validators/company-portability.ts

@@ -21,9 +21,6 @@ export const portabilityEnvInputSchema = z.object({
   requirement: z.enum(["required", "optional"]),
   defaultValue: z.string().nullable(),
   portability: z.enum(["portable", "system_dependent"]),
-  secretName: z.string().min(1).nullable().optional(),
-  secretProvider: z.string().min(1).nullable().optional(),
-  type: z.enum(["secret_ref", "plain"]).optional(),
 });
 
 export const portabilityFileEntrySchema = z.union([
@@ -178,13 +175,6 @@ export const portabilityManifestSchema = z.object({
   projects: z.array(portabilityProjectManifestEntrySchema).default([]),
   issues: z.array(portabilityIssueManifestEntrySchema).default([]),
   envInputs: z.array(portabilityEnvInputSchema).default([]),
-  secrets: z.array(z.object({
-    name: z.string().min(1),
-    provider: z.string().min(1),
-    description: z.string().nullable(),
-    latestVersion: z.number().int().nonnegative(),
-    currentValue: z.string(),
-  })).optional(),
 });
 
 export const portabilitySourceSchema = z.discriminatedUnion("type", [
@@ -227,7 +217,6 @@ export const companyPortabilityExportSchema = z.object({
   selectedFiles: z.array(z.string().min(1)).optional(),
   expandReferencedSkills: z.boolean().optional(),
   sidebarOrder: portabilitySidebarOrderSchema.partial().optional(),
-  includeSecrets: z.boolean().optional(),
 });
 
 export type CompanyPortabilityExport = z.infer<typeof companyPortabilityExportSchema>;

packages/shared/src/validators/company-skill.ts

@@ -68,6 +68,11 @@ export const companySkillUpdateStatusSchema = z.object({
 
 export const companySkillImportSchema = z.object({
   source: z.string().min(1),
+  authToken: z.string().min(1).optional(),
+});
+
+export const companySkillUpdateAuthSchema = z.object({
+  authToken: z.string().min(1).nullable(),
 });
 
 export const companySkillProjectScanRequestSchema = z.object({
@@ -135,3 +140,4 @@ export type CompanySkillImport = z.infer<typeof companySkillImportSchema>;
 export type CompanySkillProjectScan = z.infer<typeof companySkillProjectScanRequestSchema>;
 export type CompanySkillCreate = z.infer<typeof companySkillCreateSchema>;
 export type CompanySkillFileUpdate = z.infer<typeof companySkillFileUpdateSchema>;
+export type CompanySkillUpdateAuth = z.infer<typeof companySkillUpdateAuthSchema>;

packages/shared/src/validators/index.ts

@@ -63,6 +63,7 @@ export {
   companySkillDetailSchema,
   companySkillUpdateStatusSchema,
   companySkillImportSchema,
+  companySkillUpdateAuthSchema,
   companySkillProjectScanRequestSchema,
   companySkillProjectScanSkippedSchema,
   companySkillProjectScanConflictSchema,
@@ -74,6 +75,7 @@ export {
   type CompanySkillProjectScan,
   type CompanySkillCreate,
   type CompanySkillFileUpdate,
+  type CompanySkillUpdateAuth,
 } from "./company-skill.js";
 export {
   agentSkillStateSchema,

server/src/__tests__/company-portability.test.ts

@@ -14,7 +14,6 @@ const companySvc = {
 
 const agentSvc = {
   list: vi.fn(),
-  getById: vi.fn(),
   create: vi.fn(),
   update: vi.fn(),
 };
@@ -28,7 +27,6 @@ const accessSvc = {
 
 const projectSvc = {
   list: vi.fn(),
-  getById: vi.fn(),
   create: vi.fn(),
   update: vi.fn(),
   createWorkspace: vi.fn(),
@@ -64,26 +62,6 @@ const assetSvc = {
 const secretSvc = {
   normalizeAdapterConfigForPersistence: vi.fn(async (_companyId: string, config: Record<string, unknown>) => config),
   resolveAdapterConfigForRuntime: vi.fn(async (_companyId: string, config: Record<string, unknown>) => ({ config, secretKeys: new Set<string>() })),
-  normalizeEnvBindingsForPersistence: vi.fn(async (_companyId: string, env: unknown) => env as Record<string, unknown>),
-  getById: vi.fn(async (id: string) => {
-    if (id === "secret-1") return { id: "secret-1", name: "anthropic-api-key", provider: "local_encrypted" };
-    if (id === "secret-2") return { id: "secret-2", name: "gh-token", provider: "local_encrypted" };
-    return null;
-  }),
-  resolveSecretValue: vi.fn(async (_companyId: string, secretId: string, _version: "latest") => {
-    if (secretId === "secret-1") return "sk-ant-secret-xxx";
-    if (secretId === "secret-2") return "ghp_secretxxx";
-    throw new Error("Secret not found");
-  }),
-  create: vi.fn(async (companyId: string, input: { name: string; provider: string; value: string; description?: string | null }) => ({
-    id: `new-secret-${input.name}`,
-    companyId,
-    name: input.name,
-    provider: input.provider,
-    description: input.description ?? null,
-    latestVersion: 1,
-  })),
-  getByName: vi.fn(async (_companyId: string, name: string) => null),
 };
 
 const agentInstructionsSvc = {
@@ -470,6 +448,7 @@ describe("company portability", () => {
     expect(extension).not.toContain("instructionsFilePath");
     expect(extension).not.toContain("command:");
     expect(extension).not.toContain("secretId");
+    expect(extension).not.toContain('type: "secret_ref"');
     expect(extension).toContain("inputs:");
     expect(extension).toContain("ANTHROPIC_API_KEY:");
     expect(extension).toContain('requirement: "optional"');
@@ -1220,9 +1199,6 @@ describe("company portability", () => {
         requirement: "optional",
         defaultValue: "",
         portability: "portable",
-        secretName: "anthropic-api-key",
-        secretProvider: "local_encrypted",
-        type: "secret_ref",
       },
       {
         key: "GH_TOKEN",
@@ -1233,9 +1209,6 @@ describe("company portability", () => {
         requirement: "optional",
         defaultValue: "",
         portability: "portable",
-        secretName: "gh-token",
-        secretProvider: "local_encrypted",
-        type: "secret_ref",
       },
     ]);
   });
@@ -1359,9 +1332,6 @@ describe("company portability", () => {
       requirement: "optional",
       defaultValue: "",
       portability: "portable",
-      secretName: null,
-      secretProvider: null,
-      type: "plain",
     });
   });
 
@@ -2676,191 +2646,6 @@ describe("company portability", () => {
     }));
   });
 
-  describe("secret env vars", () => {
-    beforeEach(() => {
-      // Reset create/getByName to ensure clean state per test
-      secretSvc.create.mockReset();
-      secretSvc.getByName.mockReset();
-      secretSvc.getById.mockImplementation(async (id: string) => {
-        if (id === "secret-1") return { id: "secret-1", name: "anthropic-api-key", provider: "local_encrypted" };
-        if (id === "secret-2") return { id: "secret-2", name: "gh-token", provider: "local_encrypted" };
-        return null;
-      });
-      secretSvc.resolveSecretValue.mockImplementation(async (_companyId: string, secretId: string) => {
-        if (secretId === "secret-1") return "sk-ant-secret-xxx";
-        if (secretId === "secret-2") return "ghp_secretxxx";
-        throw new Error("Secret not found");
-      });
-      secretSvc.create.mockImplementation(async (companyId: string, input: { name: string; provider: string; value: string; description?: string | null }) => ({
-        id: `new-secret-${input.name}`,
-        companyId,
-        name: input.name,
-        provider: input.provider,
-        description: input.description ?? null,
-        latestVersion: 1,
-      }));
-      secretSvc.getByName.mockResolvedValue(null);
-    });
-
-    it("exports secret env var metadata with secretName and secretProvider", async () => {
-      const portability = companyPortabilityService({} as any);
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-      });
-      const secretInput = exported.manifest.envInputs.find(
-        (e: any) => e.key === "ANTHROPIC_API_KEY" && e.kind === "secret",
-      );
-      expect(secretInput).toBeDefined();
-      expect(secretInput.secretName).toBe("anthropic-api-key");
-      expect(secretInput.secretProvider).toBe("local_encrypted");
-    });
-
-    it("exports secret values to manifest when includeSecrets is true", async () => {
-      const portability = companyPortabilityService({} as any);
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-        includeSecrets: true,
-      });
-      expect(exported.manifest.secrets).toBeDefined();
-      expect(exported.manifest.secrets).toContainEqual(expect.objectContaining({
-        name: "anthropic-api-key",
-        provider: "local_encrypted",
-        currentValue: "sk-ant-secret-xxx",
-      }));
-    });
-
-    it("omits secrets section when includeSecrets is false", async () => {
-      const portability = companyPortabilityService({} as any);
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-        includeSecrets: false,
-      });
-      expect(exported.manifest.secrets).toBeUndefined();
-    });
-
-    it("writes placeholder when resolveSecretValue throws (cross-instance decryption failure)", async () => {
-      secretSvc.resolveSecretValue.mockImplementation(async () => {
-        throw new Error("Decryption failed: missing master key");
-      });
-      const portability = companyPortabilityService({} as any);
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-        includeSecrets: true,
-      });
-      const secretEntry = exported.manifest.secrets?.find((s: any) => s.name === "anthropic-api-key");
-      expect(secretEntry?.currentValue).toBe("<decryption-key-missing:anthropic-api-key>");
-      expect(exported.warnings).toContainEqual(expect.stringContaining("could not be decrypted during export"));
-    });
-
-    it("imports secrets and remaps secret_ref bindings to new secret IDs", async () => {
-      const portability = companyPortabilityService({} as any);
-      agentSvc.create.mockImplementation(async (companyId: string, patch: Record<string, unknown>) => ({
-        id: "new-agent-1",
-        companyId,
-        ...patch,
-      }));
-      agentSvc.update.mockImplementation(async (id: string, patch: Record<string, unknown>) => patch as any);
-      agentSvc.getById.mockImplementation(async (id: string) => {
-        if (id === "new-agent-1") {
-          return { id: "new-agent-1", adapterConfig: { env: { ANTHROPIC_API_KEY: { type: "secret_ref", secretId: "placeholder-secret" } } } };
-        }
-        return null;
-      });
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-        includeSecrets: true,
-      });
-      const imported = await portability.importBundle({
-        source: { type: "inline", rootPath: exported.rootPath, files: exported.files },
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        target: { mode: "existing_company", companyId: "company-imported" },
-        agents: ["claudecoder"],
-        collisionStrategy: "rename",
-      }, "user-1");
-      expect(secretSvc.create).toHaveBeenCalled();
-      expect(agentSvc.update).toHaveBeenCalledWith(
-        "new-agent-1",
-        expect.any(Object),
-      );
-    });
-
-    it("reuses existing secret on conflict during import", async () => {
-      secretSvc.getByName.mockImplementation(async (_companyId: string, name: string) => {
-        if (name === "anthropic-api-key") return { id: "existing-secret-1", name, provider: "local_encrypted" };
-        return null;
-      });
-      const portability = companyPortabilityService({} as any);
-      agentSvc.create.mockImplementation(async (companyId: string, patch: Record<string, unknown>) => ({
-        id: "new-agent-1",
-        companyId,
-        ...patch,
-      }));
-      agentSvc.update.mockImplementation(async (id: string, patch: Record<string, unknown>) => patch as any);
-      agentSvc.getById.mockImplementation(async (id: string) => {
-        if (id === "new-agent-1") {
-          return { id: "new-agent-1", adapterConfig: { env: { ANTHROPIC_API_KEY: { type: "secret_ref", secretId: "placeholder-secret" } } } };
-        }
-        return null;
-      });
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-        includeSecrets: true,
-      });
-      await portability.importBundle({
-        source: { type: "inline", rootPath: exported.rootPath, files: exported.files },
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        target: { mode: "existing_company", companyId: "company-imported" },
-        agents: ["claudecoder"],
-        collisionStrategy: "rename",
-      }, "user-1");
-      expect(agentSvc.update).toHaveBeenCalled();
-    });
-
-    it("exports plain env vars faithfully", async () => {
-      agentSvc.list.mockResolvedValue([{
-        id: "agent-1",
-        name: "TestAgent",
-        status: "idle",
-        role: "agent",
-        title: null,
-        icon: null,
-        reportsTo: null,
-        capabilities: null,
-        adapterType: "process",
-        adapterConfig: {
-          env: {
-            PLAIN_VAR: { type: "plain", value: "plain-value" },
-            ANOTHER_VAR: { type: "plain", value: "another-value" },
-          },
-        },
-        runtimeConfig: {},
-        permissions: {},
-        budgetMonthlyCents: 0,
-        metadata: null,
-      }]);
-      const portability = companyPortabilityService({} as any);
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["testagent"],
-      });
-      const plainInputs = exported.manifest.envInputs.filter((e: any) => e.kind === "plain");
-      expect(plainInputs).toContainEqual(expect.objectContaining({
-        key: "PLAIN_VAR",
-        defaultValue: "plain-value",
-      }));
-      expect(plainInputs).toContainEqual(expect.objectContaining({
-        key: "ANOTHER_VAR",
-        defaultValue: "another-value",
-      }));
-    });
-  });
-
   it("nameOverrides applied after collision detection do not re-validate uniqueness", async () => {
     const portability = companyPortabilityService({} as any);
 

server/src/__tests__/company-skills-routes.test.ts

@@ -14,6 +14,8 @@ const mockAccessService = vi.hoisted(() => ({
 const mockCompanySkillService = vi.hoisted(() => ({
   importFromSource: vi.fn(),
   deleteSkill: vi.fn(),
+  updateSkillAuth: vi.fn(),
+  scanProjectWorkspaces: vi.fn(),
 }));
 
 const mockLogActivity = vi.hoisted(() => vi.fn());
@@ -97,6 +99,15 @@ describe("company skill mutation permissions", () => {
       slug: "find-skills",
       name: "Find Skills",
     });
+    mockCompanySkillService.scanProjectWorkspaces.mockResolvedValue({
+      scannedProjects: 1,
+      scannedWorkspaces: 2,
+      discovered: [],
+      imported: [],
+      updated: [],
+      conflicts: [],
+      warnings: [],
+    });
     mockLogActivity.mockResolvedValue(undefined);
     mockAccessService.canUser.mockResolvedValue(true);
     mockAccessService.hasPermission.mockResolvedValue(false);
@@ -294,9 +305,120 @@ describe("company skill mutation permissions", () => {
     expect(mockCompanySkillService.importFromSource).toHaveBeenCalledWith(
       "company-1",
       "https://github.com/vercel-labs/agent-browser",
+      undefined,
     );
   });
 
+  it("passes a PAT through skill import requests", async () => {
+    const res = await request(await createApp({
+      type: "board",
+      userId: "local-board",
+      companyIds: ["company-1"],
+      source: "local_implicit",
+      isInstanceAdmin: false,
+    }))
+      .post("/api/companies/company-1/skills/import")
+      .send({
+        source: "https://github.com/vercel-labs/agent-browser",
+        authToken: "ghp_private_token",
+      });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(201);
+    expect(mockCompanySkillService.importFromSource).toHaveBeenCalledWith(
+      "company-1",
+      "https://github.com/vercel-labs/agent-browser",
+      "ghp_private_token",
+    );
+  });
+
+  it("updates a skill auth token", async () => {
+    mockCompanySkillService.updateSkillAuth.mockResolvedValue({
+      id: "skill-1",
+      slug: "find-skills",
+    });
+
+    const res = await request(await createApp({
+      type: "board",
+      userId: "local-board",
+      companyIds: ["company-1"],
+      source: "local_implicit",
+      isInstanceAdmin: false,
+    }))
+      .patch("/api/companies/company-1/skills/skill-1/auth")
+      .send({ authToken: "ghp_private_token" });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+    expect(mockCompanySkillService.updateSkillAuth).toHaveBeenCalledWith(
+      "company-1",
+      "skill-1",
+      "ghp_private_token",
+    );
+    expect(mockLogActivity).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        companyId: "company-1",
+        action: "company.skill_auth_updated",
+        entityType: "company_skill",
+        entityId: "skill-1",
+        details: { slug: "find-skills" },
+      }),
+    );
+  });
+
+  it("clears a skill auth token", async () => {
+    mockCompanySkillService.updateSkillAuth.mockResolvedValue({
+      id: "skill-1",
+      slug: "find-skills",
+    });
+
+    const res = await request(await createApp({
+      type: "board",
+      userId: "local-board",
+      companyIds: ["company-1"],
+      source: "local_implicit",
+      isInstanceAdmin: false,
+    }))
+      .patch("/api/companies/company-1/skills/skill-1/auth")
+      .send({ authToken: null });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+    expect(mockCompanySkillService.updateSkillAuth).toHaveBeenCalledWith(
+      "company-1",
+      "skill-1",
+      null,
+    );
+    expect(mockLogActivity).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        companyId: "company-1",
+        action: "company.skill_auth_removed",
+        entityType: "company_skill",
+        entityId: "skill-1",
+        details: { slug: "find-skills" },
+      }),
+    );
+  });
+
+  it("allows agents with canCreateAgents to scan project workspaces", async () => {
+    mockAgentService.getById.mockResolvedValue({
+      id: "agent-1",
+      companyId: "company-1",
+      permissions: { canCreateAgents: true },
+    });
+
+    const res = await request(await createApp({
+      type: "agent",
+      agentId: "agent-1",
+      companyId: "company-1",
+      runId: "run-1",
+    }))
+      .post("/api/companies/company-1/skills/scan-projects")
+      .send({});
+
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+    expect(mockCompanySkillService.scanProjectWorkspaces).toHaveBeenCalledWith("company-1", {});
+  });
+
   it("returns a blocking error when attempting to delete a skill still used by agents", async () => {
     const { unprocessable } = await import("../errors.js");
     mockCompanySkillService.deleteSkill.mockImplementationOnce(async () => {

server/src/routes/company-skills.ts

@@ -4,6 +4,7 @@ import {
   companySkillCreateSchema,
   companySkillFileUpdateSchema,
   companySkillImportSchema,
+  companySkillUpdateAuthSchema,
   companySkillProjectScanRequestSchema,
 } from "@paperclipai/shared";
 import { trackSkillImported } from "@paperclipai/shared/telemetry";
@@ -194,7 +195,8 @@ export function companySkillRoutes(db: Db) {
       const companyId = req.params.companyId as string;
       await assertCanMutateCompanySkills(req, companyId);
       const source = String(req.body.source ?? "");
-      const result = await svc.importFromSource(companyId, source);
+      const authToken = typeof req.body.authToken === "string" ? req.body.authToken.trim() : undefined;
+      const result = await svc.importFromSource(companyId, source, authToken || undefined);
 
       const actor = getActorInfo(req);
       await logActivity(db, {
@@ -318,5 +320,38 @@ export function companySkillRoutes(db: Db) {
     res.json(result);
   });
 
+  router.patch(
+    "/companies/:companyId/skills/:skillId/auth",
+    validate(companySkillUpdateAuthSchema),
+    async (req, res) => {
+      const companyId = req.params.companyId as string;
+      const skillId = req.params.skillId as string;
+      await assertCanMutateCompanySkills(req, companyId);
+      const authToken = req.body.authToken as string | null;
+      const result = await svc.updateSkillAuth(companyId, skillId, authToken);
+      if (!result) {
+        res.status(404).json({ error: "Skill not found" });
+        return;
+      }
+
+      const actor = getActorInfo(req);
+      await logActivity(db, {
+        companyId,
+        actorType: actor.actorType,
+        actorId: actor.actorId,
+        agentId: actor.agentId,
+        runId: actor.runId,
+        action: authToken ? "company.skill_auth_updated" : "company.skill_auth_removed",
+        entityType: "company_skill",
+        entityId: result.id,
+        details: {
+          slug: result.slug,
+        },
+      });
+
+      res.json(result);
+    },
+  );
+
   return router;
 }

server/src/services/company-portability.ts

@@ -26,11 +26,9 @@ import type {
   CompanyPortabilityIssueManifestEntry,
   CompanyPortabilitySidebarOrder,
   CompanyPortabilitySkillManifestEntry,
-  CompanyPortabilitySecretEntry,
   CompanySkill,
   AgentEnvConfig,
   RoutineVariable,
-  SecretProvider,
 } from "@paperclipai/shared";
 import {
   AGENT_DEFAULT_MAX_CONCURRENT_RUNS,
@@ -52,7 +50,7 @@ import {
 } from "@paperclipai/adapter-utils/server-utils";
 import { ensureOpenCodeModelConfiguredAndAvailable } from "@paperclipai/adapter-opencode-local/server";
 import { findServerAdapter } from "../adapters/index.js";
-import { forbidden, HttpError, notFound, unprocessable } from "../errors.js";
+import { forbidden, notFound, unprocessable } from "../errors.js";
 import { ghFetch, gitHubApiBase, resolveRawGitHubUrl } from "./github-fetch.js";
 import type { StorageService } from "../storage/types.js";
 import { accessService } from "./access.js";
@@ -401,7 +399,7 @@ function normalizePortableProjectEnv(value: unknown): AgentEnvConfig | null {
   return parsed.success ? parsed.data : null;
 }
 
-async function extractPortableScopedEnvInputs(
+function extractPortableScopedEnvInputs(
   scope: {
     label: string;
     warningPrefix: string;
@@ -410,11 +408,7 @@ async function extractPortableScopedEnvInputs(
   },
   envValue: unknown,
   warnings: string[],
-  secrets: { getById: (id: string) => Promise<{ name: string; provider: string; description: string | null; latestVersion: number } | null>; resolveSecretValue: (companyId: string, secretId: string, version: "latest") => Promise<string> },
-  secretEntries: CompanyPortabilitySecretEntry[],
-  includeSecrets: boolean,
-  companyId: string,
-): Promise<CompanyPortabilityEnvInput[]> {
+): CompanyPortabilityEnvInput[] {
   if (!isPlainRecord(envValue)) return [];
   const env = envValue as Record<string, unknown>;
   const inputs: CompanyPortabilityEnvInput[] = [];
@@ -426,7 +420,6 @@ async function extractPortableScopedEnvInputs(
     }
 
     if (isPlainRecord(binding) && binding.type === "secret_ref") {
-      const secret = await secrets.getById(String(binding.secretId));
       inputs.push({
         key,
         description: `Provide ${key} for ${scope.label}`,
@@ -436,33 +429,7 @@ async function extractPortableScopedEnvInputs(
         requirement: "optional",
         defaultValue: "",
         portability: "portable",
-        secretName: secret?.name ?? null,
-        secretProvider: secret?.provider ?? null,
       });
-      if (includeSecrets && secret && binding.secretId) {
-        const alreadyExported = secretEntries.some((e) => e.name === secret.name);
-        if (!alreadyExported) {
-          try {
-            const resolvedValue = await secrets.resolveSecretValue(companyId, String(binding.secretId), "latest");
-            secretEntries.push({
-              name: secret.name,
-              provider: secret.provider as SecretProvider,
-              description: secret.description,
-              latestVersion: secret.latestVersion,
-              currentValue: resolvedValue,
-            });
-          } catch {
-            secretEntries.push({
-              name: secret.name,
-              provider: secret.provider as SecretProvider,
-              description: secret.description,
-              latestVersion: secret.latestVersion,
-              currentValue: `<decryption-key-missing:${secret.name}>`,
-            });
-            warnings.push(`Secret "${secret.name}" could not be decrypted during export. Placeholder written.`);
-          }
-        }
-      }
       continue;
     }
 
@@ -472,6 +439,9 @@ async function extractPortableScopedEnvInputs(
       const portability = defaultValue && isAbsoluteCommand(defaultValue)
         ? "system_dependent"
         : "portable";
+      if (portability === "system_dependent") {
+        warnings.push(`${scope.warningPrefix} env ${key} default was exported as system-dependent.`);
+      }
       inputs.push({
         key,
         description: `Optional default for ${key} on ${scope.label}`,
@@ -487,6 +457,9 @@ async function extractPortableScopedEnvInputs(
 
     if (typeof binding === "string") {
       const portability = isAbsoluteCommand(binding) ? "system_dependent" : "portable";
+      if (portability === "system_dependent") {
+        warnings.push(`${scope.warningPrefix} env ${key} default was exported as system-dependent.`);
+      }
       inputs.push({
         key,
         description: `Optional default for ${key} on ${scope.label}`,
@@ -594,14 +567,11 @@ type AgentLike = {
 };
 
 type EnvInputRecord = {
-  type?: "secret_ref" | "plain";
   kind: "secret" | "plain";
   requirement: "required" | "optional";
   default?: string | null;
   description?: string | null;
   portability?: "portable" | "system_dependent";
-  secretName?: string | null;
-  secretProvider?: string | null;
 };
 
 const COMPANY_LOGO_CONTENT_TYPE_EXTENSIONS: Record<string, string> = {
@@ -1653,15 +1623,11 @@ function isAbsoluteCommand(value: string) {
   return path.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value);
 }
 
-async function extractPortableEnvInputs(
+function extractPortableEnvInputs(
   agentSlug: string,
   envValue: unknown,
   warnings: string[],
-  secrets: { getById: (id: string) => Promise<{ name: string; provider: string; description: string | null; latestVersion: number } | null>; resolveSecretValue: (companyId: string, secretId: string, version: "latest") => Promise<string> },
-  secretEntries: CompanyPortabilitySecretEntry[],
-  includeSecrets: boolean,
-  companyId: string,
-): Promise<CompanyPortabilityEnvInput[]> {
+): CompanyPortabilityEnvInput[] {
   return extractPortableScopedEnvInputs(
     {
       label: `agent ${agentSlug}`,
@@ -1671,22 +1637,14 @@ async function extractPortableEnvInputs(
     },
     envValue,
     warnings,
-    secrets,
-    secretEntries,
-    includeSecrets,
-    companyId,
   );
 }
 
-async function extractPortableProjectEnvInputs(
+function extractPortableProjectEnvInputs(
   projectSlug: string,
   envValue: unknown,
   warnings: string[],
-  secrets: { getById: (id: string) => Promise<{ name: string; provider: string; description: string | null; latestVersion: number } | null>; resolveSecretValue: (companyId: string, secretId: string, version: "latest") => Promise<string> },
-  secretEntries: CompanyPortabilitySecretEntry[],
-  includeSecrets: boolean,
-  companyId: string,
-): Promise<CompanyPortabilityEnvInput[]> {
+): CompanyPortabilityEnvInput[] {
   return extractPortableScopedEnvInputs(
     {
       label: `project ${projectSlug}`,
@@ -1696,10 +1654,6 @@ async function extractPortableProjectEnvInputs(
     },
     envValue,
     warnings,
-    secrets,
-    secretEntries,
-    includeSecrets,
-    companyId,
   );
 }
 
@@ -2304,13 +2258,6 @@ function buildEnvInputMap(inputs: CompanyPortabilityEnvInput[]) {
     if (input.defaultValue !== null) entry.default = input.defaultValue;
     if (input.description) entry.description = input.description;
     if (input.portability === "system_dependent") entry.portability = "system_dependent";
-    if (input.secretName) {
-      entry.secretName = input.secretName;
-      entry.type = "secret_ref";
-    } else {
-      entry.type = "plain";
-    }
-    if (input.secretProvider) entry.secretProvider = input.secretProvider;
     env[input.key] = entry;
   }
   return env;
@@ -2355,9 +2302,6 @@ function readAgentEnvInputs(
       requirement: record.requirement === "required" ? "required" : "optional",
       defaultValue: typeof record.default === "string" ? record.default : null,
       portability: record.portability === "system_dependent" ? "system_dependent" : "portable",
-      secretName: record.secretName ?? null,
-      secretProvider: record.secretProvider ?? null,
-      type: record.type,
     }];
   });
 }
@@ -2382,9 +2326,6 @@ function readProjectEnvInputs(
       requirement: record.requirement === "required" ? "required" : "optional",
       defaultValue: typeof record.default === "string" ? record.default : null,
       portability: record.portability === "system_dependent" ? "system_dependent" : "portable",
-      secretName: record.secretName ?? null,
-      secretProvider: record.secretProvider ?? null,
-      type: record.type,
     }];
   });
 }
@@ -2431,7 +2372,6 @@ function buildManifestFromPackageFiles(
   const paperclipProjects = isPlainRecord(paperclipExtension.projects) ? paperclipExtension.projects : {};
   const paperclipTasks = isPlainRecord(paperclipExtension.tasks) ? paperclipExtension.tasks : {};
   const paperclipRoutines = isPlainRecord(paperclipExtension.routines) ? paperclipExtension.routines : {};
-  const paperclipSecrets = Array.isArray(paperclipExtension.secrets) ? paperclipExtension.secrets : [];
   const companyName =
     asString(companyFrontmatter.name)
     ?? opts?.sourceLabel?.companyName
@@ -2515,7 +2455,6 @@ function buildManifestFromPackageFiles(
     projects: [],
     issues: [],
     envInputs: [],
-    secrets: paperclipSecrets.length > 0 ? paperclipSecrets : undefined,
   };
 
   const warnings: string[] = [];
@@ -3030,9 +2969,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
     const files: Record<string, CompanyPortabilityFileEntry> = {};
     const warnings: string[] = [];
     const envInputs: CompanyPortabilityManifest["envInputs"] = [];
-    const secretEntries: CompanyPortabilitySecretEntry[] = [];
     const requestedSidebarOrder = normalizePortableSidebarOrder(input.sidebarOrder);
-    const includeSecrets = input.includeSecrets === true;
     const rootPath = normalizeAgentUrlKey(company.name) ?? "company-package";
     let companyLogoPath: string | null = null;
 
@@ -3312,14 +3249,10 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
         warnings.push(...exportedInstructions.warnings);
 
         const envInputsStart = envInputs.length;
-        const exportedEnvInputs = await extractPortableEnvInputs(
+        const exportedEnvInputs = extractPortableEnvInputs(
           slug,
           (agent.adapterConfig as Record<string, unknown>).env,
           warnings,
-          secrets,
-          secretEntries,
-          includeSecrets,
-          companyId,
         );
         envInputs.push(...exportedEnvInputs);
         const adapterDefaultRules = ADAPTER_DEFAULT_RULES_BY_TYPE[agent.adapterType] ?? [];
@@ -3396,7 +3329,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
       const slug = projectSlugById.get(project.id)!;
       const projectPath = `projects/${slug}/PROJECT.md`;
       const envInputsStart = envInputs.length;
-      const exportedEnvInputs = await extractPortableProjectEnvInputs(slug, project.env, warnings, secrets, secretEntries, includeSecrets, companyId);
+      const exportedEnvInputs = extractPortableProjectEnvInputs(slug, project.env, warnings);
       envInputs.push(...exportedEnvInputs);
       const projectEnvInputs = dedupeEnvInputs(
         envInputs
@@ -3601,20 +3534,8 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
       skills: resolved.manifest.skills.length > 0,
     };
     resolved.manifest.envInputs = dedupeEnvInputs(envInputs);
-    if (includeSecrets) {
-      resolved.manifest.secrets = secretEntries.length > 0 ? secretEntries : undefined;
-    }
     resolved.warnings.unshift(...warnings);
 
-    // Rebuild the YAML file to include secrets so files stay in sync with manifest
-    // Only include secrets - other fields should come from the original YAML structure
-    if (includeSecrets && resolved.manifest.secrets) {
-      // Parse existing YAML and add secrets to it
-      const existingYaml = parseYamlFile(readPortableTextFile(finalFiles, paperclipExtensionPath) ?? "") ?? {};
-      existingYaml.secrets = resolved.manifest.secrets;
-      finalFiles[paperclipExtensionPath] = buildYamlFile(existingYaml, { preserveEmptyStrings: true });
-    }
-
     return {
       rootPath,
       manifest: resolved.manifest,
@@ -4172,7 +4093,6 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
     const resultAgents: CompanyPortabilityImportResult["agents"] = [];
     const resultProjects: CompanyPortabilityImportResult["projects"] = [];
     const importedSlugToAgentId = new Map<string, string>();
-    const secretNameToId = new Map<string, string>();
     const existingSlugToAgentId = new Map<string, string>();
     const agentStatusById = new Map<string, string | null | undefined>();
     const existingAgents = await agents.list(targetCompany.id);
@@ -4204,35 +4124,6 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
       }
     }
 
-    // Create secrets in target company and build name->id map
-    for (const secretEntry of sourceManifest.secrets ?? []) {
-      if (secretEntry.currentValue.startsWith("<decryption-key-missing:")) {
-        warnings.push(`Secret "${secretEntry.name}" could not be decrypted in source instance. ` +
-          `Placeholder written for key. Create a secret with this name and update manually.`);
-        continue;
-      }
-      try {
-        const created = await secrets.create(targetCompany.id, {
-          name: secretEntry.name,
-          provider: secretEntry.provider,
-          value: secretEntry.currentValue,
-          description: secretEntry.description,
-        });
-        secretNameToId.set(secretEntry.name, created.id);
-      } catch (err) {
-        if (err instanceof HttpError && err.status === 409) {
-          const existing = await secrets.getByName(targetCompany.id, secretEntry.name);
-          if (existing) {
-            secretNameToId.set(secretEntry.name, existing.id);
-          } else {
-            warnings.push(`Secret "${secretEntry.name}" already exists but could not be resolved by name. Re-add env bindings for this secret manually.`);
-          }
-        } else {
-          warnings.push(`Failed to create secret "${secretEntry.name}": ${err instanceof Error ? err.message : String(err)}`);
-        }
-      }
-    }
-
     if (include.agents) {
       for (const planAgent of plan.preview.plan.agentPlans) {
         const manifestAgent = plan.selectedAgents.find((agent) => agent.slug === planAgent.slug);
@@ -4289,30 +4180,6 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
           desiredSkills,
           mode,
         );
-
-        // Reconstruct adapterConfig.env from manifest.envInputs for this agent
-        const agentEnvInputs = (sourceManifest.envInputs ?? []).filter((e) => e.agentSlug === manifestAgent.slug);
-        if (agentEnvInputs.length > 0) {
-          const env: Record<string, unknown> = {};
-          for (const ei of agentEnvInputs) {
-            if (ei.kind === "secret" && ei.secretName) {
-              const newSecretId = secretNameToId.get(ei.secretName);
-              if (newSecretId) {
-                env[ei.key] = { type: "secret_ref", secretId: newSecretId };
-              } else {
-                warnings.push(`Env key "${ei.key}" for agent ${manifestAgent.slug} references secret "${ei.secretName}" which was not included in this package. Re-add manually.`);
-              }
-            } else if (ei.kind === "secret" && !ei.secretName) {
-              warnings.push(`Env key "${ei.key}" for agent ${manifestAgent.slug} could not be reconstructed (sensitive binding without secret reference). Re-add manually.`);
-            } else if (ei.kind === "plain" && ei.defaultValue !== null) {
-              env[ei.key] = { type: "plain", value: ei.defaultValue };
-            }
-          }
-          if (Object.keys(env).length > 0) {
-            normalizedAdapter.adapterConfig.env = await secrets.normalizeEnvBindingsForPersistence(targetCompany.id, env as any, { strictMode: strictSecretsMode });
-          }
-        }
-
         const patch = {
           name: planAgent.plannedName,
           role: manifestAgent.role,
@@ -4363,9 +4230,10 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
           continue;
         }
 
+        const createdStatus = "idle";
         let created = await agents.create(targetCompany.id, {
           ...patch,
-          status: "idle",
+          status: createdStatus,
         });
         await access.ensureMembership(targetCompany.id, "agent", created.id, "member", "active");
         await access.setPrincipalPermission(
@@ -4385,7 +4253,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
         } catch (err) {
           warnings.push(`Failed to materialize instructions bundle for ${manifestAgent.slug}: ${err instanceof Error ? err.message : String(err)}`);
         }
-        agentStatusById.set(created.id, created.status ?? "idle");
+        agentStatusById.set(created.id, created.status ?? createdStatus);
         importedSlugToAgentId.set(planAgent.slug, created.id);
         existingSlugToAgentId.set(normalizeAgentUrlKey(created.name) ?? created.id, created.id);
         resultAgents.push({
@@ -4434,26 +4302,6 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
             ?? null
           : null;
         const projectWorkspaceIdByKey = new Map<string, string>();
-        // Build project env from manifest.envInputs filtered by this project
-        const projectEnvInputs = (sourceManifest.envInputs ?? []).filter((e) => e.projectSlug === planProject.slug);
-        const reconstructedProjectEnv: Record<string, unknown> = {};
-        for (const ei of projectEnvInputs) {
-          if (ei.kind === "secret" && ei.secretName) {
-            const newSecretId = secretNameToId.get(ei.secretName);
-            if (newSecretId) {
-              reconstructedProjectEnv[ei.key] = { type: "secret_ref", secretId: newSecretId };
-            } else {
-              warnings.push(`Env key "${ei.key}" for project ${planProject.slug} references secret "${ei.secretName}" which was not included in this package. Re-add manually.`);
-            }
-          } else if (ei.kind === "secret" && !ei.secretName) {
-            warnings.push(`Env key "${ei.key}" for project ${planProject.slug} could not be reconstructed (sensitive binding without secret reference). Re-add manually.`);
-          } else if (ei.kind === "plain" && ei.defaultValue !== null) {
-            reconstructedProjectEnv[ei.key] = { type: "plain", value: ei.defaultValue };
-          }
-        }
-        const projectEnvConfig = Object.keys(reconstructedProjectEnv).length > 0
-          ? await secrets.normalizeEnvBindingsForPersistence(targetCompany.id, reconstructedProjectEnv as any, { strictMode: strictSecretsMode })
-          : null;
         const projectPatch = {
           name: planProject.plannedName,
           description: manifestProject.description,
@@ -4463,7 +4311,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
           status: manifestProject.status && PROJECT_STATUSES.includes(manifestProject.status as any)
             ? manifestProject.status as typeof PROJECT_STATUSES[number]
             : "backlog",
-          env: projectEnvConfig ?? undefined,
+          env: manifestProject.env,
           executionWorkspacePolicy: stripPortableProjectExecutionWorkspaceRefs(manifestProject.executionWorkspacePolicy),
         };
 
@@ -4542,91 +4390,6 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
       }
     }
 
-    // Remap secret_ref bindings in imported agent/project records to target company secret IDs
-    for (const envInput of sourceManifest.envInputs ?? []) {
-      if (envInput.kind !== "secret" || !envInput.secretName) continue;
-      const newSecretId = secretNameToId.get(envInput.secretName);
-      if (!newSecretId) {
-        // secret wasn't created (decryption failure or error) — it's already a placeholder in the env
-        continue;
-      }
-      if (envInput.agentSlug) {
-        const agentId = importedSlugToAgentId.get(envInput.agentSlug);
-        if (agentId) {
-          const agent = await agents.getById(agentId);
-          if (agent) {
-            const adapterConfig = agent.adapterConfig as Record<string, unknown>;
-            const env = adapterConfig.env as Record<string, unknown> | undefined;
-            let mutated = false;
-            if (env && typeof env[envInput.key] === "object" && env[envInput.key] !== null) {
-              const binding = env[envInput.key] as Record<string, unknown>;
-              if (binding.type === "secret_ref" && binding.secretId !== newSecretId) {
-                binding.secretId = newSecretId;
-                mutated = true;
-              }
-            }
-            if (mutated) await agents.update(agentId, { adapterConfig });
-          }
-        }
-      } else if (envInput.projectSlug) {
-        const projectId = importedSlugToProjectId.get(envInput.projectSlug);
-        if (projectId) {
-          const project = await projects.getById(projectId);
-          if (project && project.env && typeof project.env === "object") {
-            const env = project.env as Record<string, unknown>;
-            let mutated = false;
-            if (typeof env[envInput.key] === "object" && env[envInput.key] !== null) {
-              const binding = env[envInput.key] as Record<string, unknown>;
-              if (binding.type === "secret_ref" && binding.secretId !== newSecretId) {
-                binding.secretId = newSecretId;
-                mutated = true;
-              }
-            }
-            if (mutated) await projects.update(projectId, { env: env as import("@paperclipai/shared").AgentEnvConfig });
-          }
-        }
-      }
-    }
-
-    // Note: the legacy secret remapping below is kept as a safety net for
-    // agents/projects that were created/updated before this code existed.
-    // It can be removed once the inline reconstruction above is stable.
-    // Reconstruct plain env bindings and fill in missing env keys on imported agents/projects
-    for (const envInput of sourceManifest.envInputs ?? []) {
-      if (envInput.kind !== "plain" && !(envInput.kind === "secret" && !envInput.secretName)) continue;
-      if (!envInput.defaultValue && envInput.kind === "plain") continue;
-
-      if (envInput.agentSlug) {
-        const agentId = importedSlugToAgentId.get(envInput.agentSlug);
-        if (!agentId) continue;
-        const agent = await agents.getById(agentId);
-        if (!agent) continue;
-        const adapterConfig = agent.adapterConfig as Record<string, unknown>;
-        const env = (adapterConfig.env as Record<string, unknown>) ?? {};
-        let mutated = false;
-        if (!env[envInput.key] && envInput.kind === "plain") {
-          env[envInput.key] = { type: "plain", value: envInput.defaultValue ?? "" };
-          mutated = true;
-        }
-        if (mutated) {
-          adapterConfig.env = env;
-          await agents.update(agentId, { adapterConfig });
-        }
-      } else if (envInput.projectSlug) {
-        const projectId = importedSlugToProjectId.get(envInput.projectSlug);
-        if (!projectId) continue;
-        const project = await projects.getById(projectId);
-        if (!project) continue;
-        const env = (project.env as Record<string, unknown>) ?? {};
-        let mutated = false;
-        if (!env[envInput.key] && envInput.kind === "plain") {
-          env[envInput.key] = { type: "plain", value: envInput.defaultValue ?? "" };
-          mutated = true;
-        }
-        if (mutated) await projects.update(projectId, { env: env as import("@paperclipai/shared").AgentEnvConfig });
-      }
-    }
-
     if (include.issues) {
       const routines = routineService(db);
       for (const manifestIssue of sourceManifest.issues) {

server/src/services/company-skills.ts

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { and, asc, eq } from "drizzle-orm";
+import { and, asc, eq, sql } from "drizzle-orm";
 import type { Db } from "@paperclipai/db";
 import { companies, companySkills } from "@paperclipai/db";
 import { readPaperclipSkillSyncPreference } from "@paperclipai/adapter-utils/server-utils";
@@ -32,6 +32,7 @@ import { notFound, unprocessable } from "../errors.js";
 import { ghFetch, gitHubApiBase, resolveRawGitHubUrl } from "./github-fetch.js";
 import { agentService } from "./agents.js";
 import { projectService } from "./projects.js";
+import { secretService } from "./secrets.js";
 
 type CompanySkillRow = typeof companySkills.$inferSelect;
 type CompanySkillListDbRow = Pick<
@@ -540,20 +541,20 @@ function parseFrontmatterMarkdown(raw: string): { frontmatter: Record<string, un
   };
 }
 
-async function fetchText(url: string) {
-  const response = await ghFetch(url);
+async function fetchText(url: string, authToken?: string) {
+  const response = await ghFetch(url, undefined, authToken);
   if (!response.ok) {
     throw unprocessable(`Failed to fetch ${url}: ${response.status}`);
   }
   return response.text();
 }
 
-async function fetchJson<T>(url: string): Promise<T> {
+async function fetchJson<T>(url: string, authToken?: string): Promise<T> {
   const response = await ghFetch(url, {
     headers: {
       accept: "application/vnd.github+json",
     },
-  });
+  }, authToken);
   if (!response.ok) {
     throw unprocessable(`Failed to fetch ${url}: ${response.status}`);
   }
@@ -561,16 +562,18 @@ async function fetchJson<T>(url: string): Promise<T> {
 }
 
 
-async function resolveGitHubDefaultBranch(owner: string, repo: string, apiBase: string) {
+async function resolveGitHubDefaultBranch(owner: string, repo: string, apiBase: string, authToken?: string) {
   const response = await fetchJson<{ default_branch?: string }>(
     `${apiBase}/repos/${owner}/${repo}`,
+    authToken,
   );
   return asString(response.default_branch) ?? "main";
 }
 
-async function resolveGitHubCommitSha(owner: string, repo: string, ref: string, apiBase: string) {
+async function resolveGitHubCommitSha(owner: string, repo: string, ref: string, apiBase: string, authToken?: string) {
   const response = await fetchJson<{ sha?: string }>(
     `${apiBase}/repos/${owner}/${repo}/commits/${encodeURIComponent(ref)}`,
+    authToken,
   );
   const sha = asString(response.sha);
   if (!sha) {
@@ -607,7 +610,7 @@ function parseGitHubSourceUrl(rawUrl: string) {
   return { hostname: url.hostname, owner, repo, ref, basePath, filePath, explicitRef };
 }
 
-async function resolveGitHubPinnedRef(parsed: ReturnType<typeof parseGitHubSourceUrl>) {
+async function resolveGitHubPinnedRef(parsed: ReturnType<typeof parseGitHubSourceUrl>, authToken?: string) {
   const apiBase = gitHubApiBase(parsed.hostname);
   if (/^[0-9a-f]{40}$/i.test(parsed.ref.trim())) {
     return {
@@ -618,8 +621,8 @@ async function resolveGitHubPinnedRef(parsed: ReturnType<typeof parseGitHubSourc
 
   const trackingRef = parsed.explicitRef
     ? parsed.ref
-    : await resolveGitHubDefaultBranch(parsed.owner, parsed.repo, apiBase);
-  const pinnedRef = await resolveGitHubCommitSha(parsed.owner, parsed.repo, trackingRef, apiBase);
+    : await resolveGitHubDefaultBranch(parsed.owner, parsed.repo, apiBase, authToken);
+  const pinnedRef = await resolveGitHubCommitSha(parsed.owner, parsed.repo, trackingRef, apiBase, authToken);
   return { pinnedRef, trackingRef };
 }
 
@@ -1050,6 +1053,7 @@ async function readUrlSkillImports(
   companyId: string,
   sourceUrl: string,
   requestedSkillSlug: string | null = null,
+  authToken?: string,
 ): Promise<{ skills: ImportedSkill[]; warnings: string[] }> {
   const url = sourceUrl.trim();
   const warnings: string[] = [];
@@ -1064,10 +1068,11 @@ async function readUrlSkillImports(
   if (looksLikeRepoUrl) {
     const parsed = parseGitHubSourceUrl(url);
     const apiBase = gitHubApiBase(parsed.hostname);
-    const { pinnedRef, trackingRef } = await resolveGitHubPinnedRef(parsed);
+    const { pinnedRef, trackingRef } = await resolveGitHubPinnedRef(parsed, authToken);
     let ref = pinnedRef;
     const tree = await fetchJson<{ tree?: Array<{ path: string; type: string }> }>(
       `${apiBase}/repos/${parsed.owner}/${parsed.repo}/git/trees/${ref}?recursive=1`,
+      authToken,
     ).catch(() => {
       throw unprocessable(`Failed to read GitHub tree for ${url}`);
     });
@@ -1094,7 +1099,7 @@ async function readUrlSkillImports(
     const skills: ImportedSkill[] = [];
     for (const relativeSkillPath of skillPaths) {
       const repoSkillPath = basePrefix ? `${basePrefix}${relativeSkillPath}` : relativeSkillPath;
-      const markdown = await fetchText(resolveRawGitHubUrl(parsed.hostname, parsed.owner, parsed.repo, ref, repoSkillPath));
+      const markdown = await fetchText(resolveRawGitHubUrl(parsed.hostname, parsed.owner, parsed.repo, ref, repoSkillPath), authToken);
       const parsedMarkdown = parseFrontmatterMarkdown(markdown);
       const skillDir = path.posix.dirname(relativeSkillPath);
       const slug = deriveImportedSkillSlug(parsedMarkdown.frontmatter, path.posix.basename(skillDir));
@@ -1156,7 +1161,7 @@ async function readUrlSkillImports(
   }
 
   if (url.startsWith("http://") || url.startsWith("https://")) {
-    const markdown = await fetchText(url);
+    const markdown = await fetchText(url, authToken);
     const parsedMarkdown = parseFrontmatterMarkdown(markdown);
     const urlObj = new URL(url);
     const fileName = path.posix.basename(urlObj.pathname);
@@ -1548,6 +1553,22 @@ function toCompanySkillListItem(skill: CompanySkillListRow, attachedAgentCount:
 export function companySkillService(db: Db) {
   const agents = agentService(db);
   const projects = projectService(db);
+  const secretsSvc = secretService(db);
+
+  async function resolveSkillAuthToken(
+    companyId: string,
+    skill: { metadata: Record<string, unknown> | null },
+  ): Promise<string | undefined> {
+    const meta = skill.metadata;
+    if (!meta) return undefined;
+    const secretId = typeof meta.sourceAuthSecretId === "string" ? meta.sourceAuthSecretId.trim() : "";
+    if (!secretId) return undefined;
+    try {
+      return await secretsSvc.resolveSecretValue(companyId, secretId, "latest");
+    } catch {
+      return undefined;
+    }
+  }
 
   async function ensureBundledSkills(companyId: string) {
     for (const skillsRoot of resolveBundledSkillsRoot()) {
@@ -1766,7 +1787,8 @@ export function companySkillService(db: Db) {
 
     const hostname = asString(metadata.hostname) || "github.com";
     const apiBase = gitHubApiBase(hostname);
-    const latestRef = await resolveGitHubCommitSha(owner, repo, trackingRef, apiBase);
+    const authToken = await resolveSkillAuthToken(companyId, skill);
+    const latestRef = await resolveGitHubCommitSha(owner, repo, trackingRef, apiBase, authToken);
     return {
       supported: true,
       reason: null,
@@ -1810,8 +1832,9 @@ export function companySkillService(db: Db) {
       if (!owner || !repo) {
         throw unprocessable("Skill source metadata is incomplete.");
       }
+      const authToken = await resolveSkillAuthToken(companyId, skill);
       const repoPath = normalizePortablePath(path.posix.join(repoSkillDir, normalizedPath));
-      content = await fetchText(resolveRawGitHubUrl(hostname, owner, repo, ref, repoPath));
+      content = await fetchText(resolveRawGitHubUrl(hostname, owner, repo, ref, repoPath), authToken);
     } else if (skill.sourceType === "url") {
       if (normalizedPath !== "SKILL.md") {
         throw notFound("This skill source only exposes SKILL.md");
@@ -1928,7 +1951,8 @@ export function companySkillService(db: Db) {
       throw unprocessable("Skill source locator is missing.");
     }
 
-    const result = await readUrlSkillImports(companyId, skill.sourceLocator, skill.slug);
+    const authToken = await resolveSkillAuthToken(companyId, skill);
+    const result = await readUrlSkillImports(companyId, skill.sourceLocator, skill.slug, authToken);
     const matching = result.skills.find((entry) => entry.key === skill.key) ?? result.skills[0] ?? null;
     if (!matching) {
       throw unprocessable(`Skill ${skill.key} could not be re-imported from its source.`);
@@ -2103,6 +2127,28 @@ export function companySkillService(db: Db) {
       }
     }
 
+    const sourceLocators = new Set<string>();
+    for (const skill of acceptedSkills) {
+      if (skill.sourceType !== "github" && skill.sourceType !== "skills_sh") continue;
+      const locator = skill.sourceLocator ?? "";
+      if (locator) sourceLocators.add(locator);
+    }
+    for (const sourceLocator of sourceLocators) {
+      try {
+        const result = await readUrlSkillImports(companyId, sourceLocator, null);
+        for (const nextSkill of result.skills) {
+          if (acceptedSkills.some((s) => s.slug === nextSkill.slug)) continue;
+          const persisted = (await upsertImportedSkills(companyId, [nextSkill]))[0];
+          if (persisted) {
+            imported.push(persisted);
+            upsertAcceptedSkill(persisted);
+          }
+        }
+      } catch {
+        warnings.push(`Could not re-scan source ${sourceLocator} — skipping.`);
+      }
+    }
+
     return {
       scannedProjects: scannedProjectIds.size,
       scannedWorkspaces: scanTargets.length,
@@ -2326,20 +2372,29 @@ export function companySkillService(db: Db) {
       const incomingOwner = asString(incomingMeta.owner);
       const incomingRepo = asString(incomingMeta.repo);
       const incomingKind = asString(incomingMeta.sourceKind);
+      // Bundled skills are sourced from the server image and re-upserted by
+      // ensureBundledSkills only. Never let a non-bundled import overwrite a
+      // bundled row, regardless of which org/repo it claims to be from.
       if (
         existing
         && existingMeta.sourceKind === "paperclip_bundled"
-        && incomingKind === "github"
-        && incomingOwner === "paperclipai"
-        && incomingRepo === "paperclip"
+        && incomingKind !== "paperclip_bundled"
       ) {
         out.push(existing);
         continue;
       }
 
+      // Preserve sourceAuthSecretId across re-imports of the same skill. Skip
+      // bundled rows: they should never carry a PAT reference, and preserving
+      // one across a bundled re-upsert would re-attach stale data.
       const metadata = {
         ...(skill.metadata ?? {}),
         skillKey: skill.key,
+        ...(existing?.metadata
+          && existingMeta.sourceKind !== "paperclip_bundled"
+          && typeof (existing.metadata as Record<string, unknown>).sourceAuthSecretId === "string"
+          ? { sourceAuthSecretId: (existing.metadata as Record<string, unknown>).sourceAuthSecretId }
+          : {}),
       };
       const values = {
         companyId,
@@ -2375,7 +2430,7 @@ export function companySkillService(db: Db) {
     return out;
   }
 
-  async function importFromSource(companyId: string, source: string): Promise<CompanySkillImportResult> {
+  async function importFromSource(companyId: string, source: string, authToken?: string): Promise<CompanySkillImportResult> {
     await ensureSkillInventoryCurrent(companyId);
     const parsed = parseSkillImportSourceInput(source);
     const local = !/^https?:\/\//i.test(parsed.resolvedSource);
@@ -2385,7 +2440,7 @@ export function companySkillService(db: Db) {
           .filter((skill) => !parsed.requestedSkillSlug || skill.slug === parsed.requestedSkillSlug),
         warnings: parsed.warnings,
       }
-      : await readUrlSkillImports(companyId, parsed.resolvedSource, parsed.requestedSkillSlug)
+      : await readUrlSkillImports(companyId, parsed.resolvedSource, parsed.requestedSkillSlug, authToken)
         .then((result) => ({
           skills: result.skills,
           warnings: [...parsed.warnings, ...result.warnings],
@@ -2412,6 +2467,35 @@ export function companySkillService(db: Db) {
       }
     }
     const imported = await upsertImportedSkills(companyId, filteredSkills);
+
+    if (authToken && imported.length > 0) {
+      for (const skill of imported) {
+        const skillMeta = skill.metadata as Record<string, unknown> | null;
+        if (skillMeta?.sourceKind === "paperclip_bundled") continue;
+        const secretName = `skill-pat:${skill.id}`;
+        let secretId: string;
+        const existing = await secretsSvc.getByName(companyId, secretName);
+        if (existing) {
+          await secretsSvc.rotate(existing.id, { value: authToken });
+          secretId = existing.id;
+        } else {
+          const created = await secretsSvc.create(companyId, {
+            name: secretName,
+            provider: "local_encrypted",
+            value: authToken,
+            description: `GitHub PAT for skill ${skill.slug}`,
+          });
+          secretId = created.id;
+        }
+        const meta = (skill.metadata ?? {}) as Record<string, unknown>;
+        meta.sourceAuthSecretId = secretId;
+        await db
+          .update(companySkills)
+          .set({ metadata: meta, updatedAt: new Date() })
+          .where(and(eq(companySkills.id, skill.id), eq(companySkills.companyId, companyId)));
+      }
+    }
+
     return { imported, warnings };
   }
 
@@ -2451,9 +2535,85 @@ export function companySkillService(db: Db) {
     // Clean up materialized runtime files
     await fs.rm(resolveRuntimeSkillMaterializedPath(companyId, skill), { recursive: true, force: true });
 
+    const meta = skill.metadata as Record<string, unknown> | null;
+    const secretId = typeof meta?.sourceAuthSecretId === "string" ? meta.sourceAuthSecretId : null;
+    if (secretId) {
+      // Skip cleanup if another skill in the same company still references this
+      // secret. The deleted row is already gone from the table, so any result
+      // here is a sibling skill we shouldn't orphan.
+      const otherSkillRefs = await db
+        .select({ id: companySkills.id })
+        .from(companySkills)
+        .where(and(
+          eq(companySkills.companyId, companyId),
+          sql`${companySkills.metadata} ->> 'sourceAuthSecretId' = ${secretId}`,
+        ))
+        .limit(1);
+      if (otherSkillRefs.length === 0) {
+        try {
+          await secretsSvc.remove(secretId);
+        } catch {
+          // Best-effort: don't fail the skill deletion if secret cleanup fails
+          // (typically blocked by an agent env binding still referencing it).
+        }
+      }
+    }
+
     return skill;
   }
 
+  async function updateSkillAuth(
+    companyId: string,
+    skillId: string,
+    authToken: string | null,
+  ): Promise<CompanySkill | null> {
+    const skill = await getById(companyId, skillId);
+    if (!skill) return null;
+
+    const meta = (skill.metadata ?? {}) as Record<string, unknown>;
+    if (meta.sourceKind === "paperclip_bundled") {
+      throw unprocessable("Cannot configure auth for bundled paperclip skills");
+    }
+    const existingSecretId = typeof meta.sourceAuthSecretId === "string" ? meta.sourceAuthSecretId : null;
+
+    if (authToken) {
+      const secretName = `skill-pat:${skill.id}`;
+      let secretId: string;
+      const existingSecret = existingSecretId
+        ? await secretsSvc.getById(existingSecretId)
+        : await secretsSvc.getByName(companyId, secretName);
+      if (existingSecret) {
+        await secretsSvc.rotate(existingSecret.id, { value: authToken });
+        secretId = existingSecret.id;
+      } else {
+        const created = await secretsSvc.create(companyId, {
+          name: secretName,
+          provider: "local_encrypted",
+          value: authToken,
+          description: `GitHub PAT for skill ${skill.slug}`,
+        });
+        secretId = created.id;
+      }
+      meta.sourceAuthSecretId = secretId;
+    } else {
+      if (existingSecretId) {
+        try {
+          await secretsSvc.remove(existingSecretId);
+        } catch {
+          // Best-effort: don't fail the metadata update if secret deletion fails
+        }
+      }
+      delete meta.sourceAuthSecretId;
+    }
+
+    const [updated] = await db
+      .update(companySkills)
+      .set({ metadata: meta, updatedAt: new Date() })
+      .where(and(eq(companySkills.id, skillId), eq(companySkills.companyId, companyId)))
+      .returning();
+    return updated ? toCompanySkill(updated) : null;
+  }
+
   return {
     list,
     listFull,
@@ -2470,6 +2630,7 @@ export function companySkillService(db: Db) {
     createLocalSkill,
     deleteSkill,
     importFromSource,
+    updateSkillAuth,
     scanProjectWorkspaces,
     importPackageFiles,
     installUpdate,

server/src/services/github-fetch.ts

@@ -16,9 +16,13 @@ export function resolveRawGitHubUrl(hostname: string, owner: string, repo: strin
     : `https://${hostname}/raw/${owner}/${repo}/${ref}/${p}`;
 }
 
-export async function ghFetch(url: string, init?: RequestInit): Promise<Response> {
+export async function ghFetch(url: string, init?: RequestInit, authToken?: string): Promise<Response> {
+  const headers = new Headers(init?.headers);
+  if (authToken) {
+    headers.set("Authorization", `Bearer ${authToken}`);
+  }
   try {
-    return await fetch(url, init);
+    return await fetch(url, { ...init, headers, redirect: authToken ? "manual" : "follow" });
   } catch {
     throw unprocessable(`Could not connect to ${new URL(url).hostname} — ensure the URL points to a GitHub or GitHub Enterprise instance`);
   }

ui/src/api/companySkills.ts

@@ -36,10 +36,15 @@ export const companySkillsApi = {
       `/companies/${encodeURIComponent(companyId)}/skills`,
       payload,
     ),
-  importFromSource: (companyId: string, source: string) =>
+  importFromSource: (companyId: string, source: string, authToken?: string) =>
     api.post<CompanySkillImportResult>(
       `/companies/${encodeURIComponent(companyId)}/skills/import`,
-      { source },
+      { source, ...(authToken ? { authToken } : {}) },
+    ),
+  updateAuth: (companyId: string, skillId: string, authToken: string | null) =>
+    api.patch<CompanySkill>(
+      `/companies/${encodeURIComponent(companyId)}/skills/${encodeURIComponent(skillId)}/auth`,
+      { authToken },
     ),
   scanProjects: (companyId: string, payload: CompanySkillProjectScanRequest = {}) =>
     api.post<CompanySkillProjectScanResult>(

ui/src/pages/CompanyExport.tsx

@@ -17,15 +17,6 @@ import { authApi } from "../api/auth";
 import { companiesApi } from "../api/companies";
 import { projectsApi } from "../api/projects";
 import { Button } from "@/components/ui/button";
-import { ToggleSwitch } from "@/components/ui/toggle-switch";
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from "@/components/ui/dialog";
 import { EmptyState } from "../components/EmptyState";
 import { PageSkeleton } from "../components/PageSkeleton";
 import { MarkdownBody } from "../components/MarkdownBody";
@@ -612,8 +603,6 @@ export function CompanyExport() {
   const [expandedDirs, setExpandedDirs] = useState<Set<string>>(new Set());
   const [checkedFiles, setCheckedFiles] = useState<Set<string>>(new Set());
   const [treeSearch, setTreeSearch] = useState("");
-  const [includeSecrets, setIncludeSecrets] = useState(false);
-  const [secretsConfirmOpen, setSecretsConfirmOpen] = useState(false);
   const [taskLimit, setTaskLimit] = useState(TASKS_PAGE_SIZE);
   const savedExpandedRef = useRef<Set<string> | null>(null);
   const initialFileFromUrl = useRef(filePathFromLocation(location.pathname));
@@ -742,7 +731,6 @@ export function CompanyExport() {
         include: { company: true, agents: true, projects: true, issues: true },
         selectedFiles: Array.from(checkedFiles).sort(),
         sidebarOrder,
-        includeSecrets,
       }),
     onSuccess: (result) => {
       const resultCheckedFiles = new Set(Object.keys(result.files));
@@ -957,11 +945,6 @@ export function CompanyExport() {
                 {warnings.length} warning{warnings.length === 1 ? "" : "s"}
               </span>
             )}
-            {includeSecrets && (
-              <span className="rounded-md border border-amber-500/30 bg-amber-500/5 px-2 py-0.5 text-xs text-amber-500">
-                Secrets included
-              </span>
-            )}
           </div>
           <Button
             size="sm"
@@ -991,29 +974,6 @@ export function CompanyExport() {
           <div className="border-b border-border px-4 py-3 shrink-0">
             <h2 className="text-base font-semibold">Package files</h2>
           </div>
-          <div className="border-b border-border px-4 py-2.5 shrink-0">
-            <div className="flex items-center gap-2 text-sm">
-              <ToggleSwitch
-                checked={includeSecrets}
-                onCheckedChange={(checked) => {
-                  if (checked) {
-                    setSecretsConfirmOpen(true);
-                  } else {
-                    setIncludeSecrets(false);
-                  }
-                }}
-              />
-              <span className="cursor-pointer text-muted-foreground hover:text-foreground transition-colors" onClick={() => {
-                if (includeSecrets) {
-                  setIncludeSecrets(false);
-                } else {
-                  setSecretsConfirmOpen(true);
-                }
-              }}>
-                Include secrets
-              </span>
-            </div>
-          </div>
           <div className="border-b border-border px-3 py-2 shrink-0">
             <div className="flex items-center gap-2 rounded-md border border-border px-2 py-1">
               <Search className="h-3.5 w-3.5 text-muted-foreground shrink-0" />
@@ -1054,26 +1014,6 @@ export function CompanyExport() {
           <ExportPreviewPane selectedFile={selectedFile} content={previewContent} allFiles={effectiveFiles} onSkillClick={handleSkillClick} />
         </div>
       </div>
-
-      {/* Secrets confirmation dialog */}
-      <Dialog open={secretsConfirmOpen} onOpenChange={setSecretsConfirmOpen}>
-        <DialogContent className="sm:max-w-md">
-          <DialogHeader>
-            <DialogTitle>Include secrets?</DialogTitle>
-            <DialogDescription>
-              Secrets will be exported as plaintext in the package file. Handle the exported package with care.
-            </DialogDescription>
-          </DialogHeader>
-          <DialogFooter>
-            <Button variant="ghost" onClick={() => setSecretsConfirmOpen(false)}>
-              Cancel
-            </Button>
-            <Button variant="destructive" onClick={() => { setIncludeSecrets(true); setSecretsConfirmOpen(false); }}>
-              Include secrets
-            </Button>
-          </DialogFooter>
-        </DialogContent>
-      </Dialog>
     </div>
   );
 }

ui/src/pages/CompanyImport.tsx

@@ -866,13 +866,6 @@ export function CompanyImport() {
         title: "Import complete",
         body: `${result.company.name}: ${result.agents.length} agent${result.agents.length === 1 ? "" : "s"} processed.`,
       });
-      if (result.warnings.some((w) => w.includes("could not be decrypted") || w.toLowerCase().includes("failed to create secret"))) {
-        pushToast({
-          tone: "warn",
-          title: "Secrets import warning",
-          body: "Some secrets could not be decrypted. Review warnings and recreate manually.",
-        });
-      }
       // Force a fresh dashboard load so newly imported agents are immediately visible.
       window.location.assign(`/${importedCompany.issuePrefix}/dashboard`);
     },
@@ -1316,18 +1309,6 @@ export function CompanyImport() {
             </div>
           )}
 
-          {/* Secrets info */}
-          {importPreview.manifest.secrets && importPreview.manifest.secrets.length > 0 && (
-            <div className="mx-5 mt-3 rounded-md border border-amber-500/30 bg-amber-500/5 px-4 py-3">
-              <div className="text-xs font-medium text-amber-500 mb-1">Secrets to import</div>
-              {importPreview.manifest.secrets.map((s) => (
-                <div key={s.name} className="text-xs text-amber-500">
-                  {s.name}{s.provider !== "local_encrypted" ? ` (${s.provider})` : ""}
-                </div>
-              ))}
-            </div>
-          )}
-
           {/* Errors */}
           {importPreview.errors.length > 0 && (
             <div className="mx-5 mt-3 rounded-md border border-destructive/30 bg-destructive/5 px-4 py-3">

ui/src/pages/CompanySkills.tsx

@@ -52,6 +52,7 @@ import {
   RefreshCw,
   Save,
   Search,
+  ShieldCheck,
   Trash2,
 } from "lucide-react";
 
@@ -487,6 +488,103 @@ function SkillList({
   );
 }
 
+function SkillAuthSection({
+  companyId,
+  skillId,
+  hasAuth,
+}: {
+  companyId: string;
+  skillId: string;
+  hasAuth: boolean;
+}) {
+  const queryClient = useQueryClient();
+  const { pushToast } = useToastActions();
+  const [editing, setEditing] = useState(false);
+  const [token, setToken] = useState("");
+
+  const updateAuth = useMutation({
+    mutationFn: (authToken: string | null) =>
+      companySkillsApi.updateAuth(companyId, skillId, authToken),
+    onSuccess: async () => {
+      await queryClient.invalidateQueries({ queryKey: queryKeys.companySkills.detail(companyId, skillId) });
+      setEditing(false);
+      setToken("");
+      pushToast({ tone: "success", title: "Auth updated" });
+    },
+    onError: (error) => {
+      pushToast({
+        tone: "error",
+        title: "Failed to update auth",
+        body: error instanceof Error ? error.message : "Unknown error",
+      });
+    },
+  });
+
+  return (
+    <div className="flex flex-wrap items-center gap-2">
+      <span className="text-[11px] uppercase tracking-[0.18em] text-muted-foreground">Auth</span>
+      {!editing ? (
+        <>
+          {hasAuth ? (
+            <>
+              <Button
+                variant="ghost"
+                size="sm"
+                onClick={() => setEditing(true)}
+              >
+                <ShieldCheck className="mr-1.5 h-3.5 w-3.5" />
+                PAT configured
+              </Button>
+              <button
+                className="inline-flex items-center text-muted-foreground/50 hover:text-destructive transition-colors"
+                onClick={() => updateAuth.mutate(null)}
+                disabled={updateAuth.isPending}
+                title="Remove PAT"
+              >
+                <Trash2 className="h-3.5 w-3.5" />
+              </button>
+            </>
+          ) : (
+            <Button
+              variant="ghost"
+              size="sm"
+              onClick={() => setEditing(true)}
+            >
+              Add PAT
+            </Button>
+          )}
+        </>
+      ) : (
+        <>
+          <input
+            type="password"
+            value={token}
+            onChange={(e) => setToken(e.target.value)}
+            placeholder="GitHub Personal Access Token"
+            className="flex-1 min-w-[200px] rounded-md border border-border px-2 py-1 bg-transparent text-xs outline-none placeholder:text-muted-foreground/50"
+            autoComplete="off"
+            autoFocus
+          />
+          <Button
+            size="sm"
+            onClick={() => updateAuth.mutate(token.trim())}
+            disabled={!token.trim() || updateAuth.isPending}
+          >
+            {updateAuth.isPending ? "Saving..." : "Save"}
+          </Button>
+          <Button
+            variant="ghost"
+            size="sm"
+            onClick={() => { setEditing(false); setToken(""); }}
+          >
+            Cancel
+          </Button>
+        </>
+      )}
+    </div>
+  );
+}
+
 function SkillPane({
   loading,
   detail,
@@ -614,6 +712,13 @@ function SkillPane({
                 )}
               </span>
             </div>
+            {(detail.sourceType === "github" || detail.sourceType === "skills_sh") && (
+              <SkillAuthSection
+                companyId={detail.companyId}
+                skillId={detail.id}
+                hasAuth={Boolean((detail.metadata as Record<string, unknown> | null)?.sourceAuthSecretId)}
+              />
+            )}
             {detail.sourceType === "github" && (
               <div className="flex flex-wrap items-center gap-2">
                 <span className="text-[11px] uppercase tracking-[0.18em] text-muted-foreground">Pin</span>
@@ -762,6 +867,7 @@ export function CompanySkills() {
   const { pushToast } = useToastActions();
   const [skillFilter, setSkillFilter] = useState("");
   const [source, setSource] = useState("");
+  const [importAuthToken, setImportAuthToken] = useState("");
   const [createOpen, setCreateOpen] = useState(false);
   const [emptySourceHelpOpen, setEmptySourceHelpOpen] = useState(false);
   const [expandedSkillId, setExpandedSkillId] = useState<string | null>(null);
@@ -887,7 +993,8 @@ export function CompanySkills() {
   }
 
   const importSkill = useMutation({
-    mutationFn: (importSource: string) => companySkillsApi.importFromSource(selectedCompanyId!, importSource),
+    mutationFn: ({ importSource, authToken }: { importSource: string; authToken?: string }) =>
+      companySkillsApi.importFromSource(selectedCompanyId!, importSource, authToken),
     onSuccess: async (result) => {
       await queryClient.invalidateQueries({ queryKey: queryKeys.companySkills.list(selectedCompanyId!) });
       if (result.imported[0]) navigate(skillRoute(result.imported[0].id));
@@ -900,6 +1007,7 @@ export function CompanySkills() {
         pushToast({ tone: "warn", title: "Import warnings", body: result.warnings[0] });
       }
       setSource("");
+      setImportAuthToken("");
     },
     onError: (error) => {
       pushToast({
@@ -1073,7 +1181,8 @@ export function CompanySkills() {
       setEmptySourceHelpOpen(true);
       return;
     }
-    importSkill.mutate(trimmedSource);
+    const token = importAuthToken.trim() || undefined;
+    importSkill.mutate({ importSource: trimmedSource, authToken: token });
   }
 
   return (
@@ -1220,6 +1329,18 @@ export function CompanySkills() {
                 {importSkill.isPending ? <RefreshCw className="h-4 w-4 animate-spin" /> : "Add"}
               </Button>
             </div>
+            {source.trim().length > 0 && /github\.com|^[a-zA-Z0-9_-]+\/[a-zA-Z0-9_.-]+/.test(source.trim()) && (
+              <div className="mt-1 flex items-center gap-2 border-b border-border pb-2">
+                <input
+                  type="password"
+                  value={importAuthToken}
+                  onChange={(event) => setImportAuthToken(event.target.value)}
+                  placeholder="GitHub PAT (optional, for private repos)"
+                  className="w-full bg-transparent text-sm outline-none placeholder:text-muted-foreground"
+                  autoComplete="off"
+                />
+              </div>
+            )}
             {scanStatusMessage && (
               <p className="mt-3 text-xs text-muted-foreground">
                 {scanStatusMessage}