docs: use placeholders for example values that trip content scanners - #3201
Conversation
A customer content-inspection gate blocked the published package on 21 findings. All were false positives on documentation examples — no credential, live PII, or cardholder data exists in the repo — but a shape-based gate cannot tell the difference, and a blocked artifact blocks the rollout either way. Replace the literal example values we control with the repo's existing <UPPER_SNAKE_CASE> placeholder convention, which identity-commands.md and the audit guides already use: - uipath-admin: literal --expiration dates and audit export date ranges become <EXPIRATION_DATE> / <FROM_DATE> / <TO_DATE>; generated folder names become audit_<from>_<to>_<generatedAt>. Both audit references are now free of literal calendar dates, so the scoping question does not come back on the next scan. - uipath-rpa: mail-merge sample data becomes <COMPANY_NAME> / <STREET_ADDRESS> / <CONTACT_NAME> / <PHONE_NUMBER>; the placeholder GUID drops its digit runs; the regex reference table masks digit positions as N with a note; the "number too long" test row describes its length. Left verbatim on purpose: Orchestrator error code 170002, two support-forum thread IDs inside URLs, and a Databricks documentation URL. Those are product data the playbooks exist to convey, not examples, so they need an allowlist on the scanning side rather than an edit here. Document the rule in CONTRIBUTING.md and .claude/rules/content-quality.md so new examples do not reintroduce the problem. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Claude finished @RaduAna-Maria's task in 5m 8s —— View job PR Review: docs: use placeholders for example values that trip content scanners
SummaryReplaces literal dates, addresses, phone numbers, and identifier-shaped digit runs in 10 documentation files with the repo's existing Change-by-Change Review1.
|
| Area | Status | Notes |
|---|---|---|
| Frontmatter | N/A | No SKILL.md frontmatter changed |
| E2E Tests | N/A | Documentation-only change, no new capabilities |
| Skill Body | N/A | No SKILL.md body changed |
| References & Assets | OK | All 8 reference file edits are clean, internally consistent, and preserve semantic meaning |
| Repo Hygiene | OK | No secrets, no cross-skill references, all relative links valid, changes scoped to affected files |
Issues for Manual Review
- Remaining literal dates in
testing-guide.mdlines 333–337. A DataTable test fixture uses"2024-01-15","2024-02-20","2024-03-10","2024-12-31"as sample data. These weren't part of the customer's 21 findings and the PR's re-scan confirmed 0 matches, but they do carry the date shape. Worth confirming the scanner's detection threshold if the scan configuration changes. CDate("01/02/2025")indata-manipulation-guide.mdline 389. Used to illustrate a locale-dependent parsing trap — the specific digits are the point (is it Jan 2 or Feb 1?). Replacing it would harm the example. This correctly falls under the "product identifiers the reader needs verbatim" exception.- The PR description notes four intentionally unchanged findings (error code
170002, forum thread IDs in URLs, a Databricks documentation URL) that need an allowlist on the scanning side. This is the right call — editing those would break the playbooks.
Conclusion
Clean PR. All 10 file edits correctly replace scanner-triggering shapes with the repo's existing placeholder convention without losing semantic clarity. The two new rule additions (CONTRIBUTING.md subsection and content-quality.md bullets) are well-placed and cover both the prescription and its exceptions. No issues found — approve.
<FROM_DATE>T00:00:00Z glued a placeholder to a literal time fragment. It kept the literal in the file, and read worse than either form alone — every sibling flag in those same blocks (<USER_GUID>, <ORCHESTRATOR_SOURCE_GUID>) already uses one placeholder per value. Use <FROM_TIMESTAMP> / <TO_TIMESTAMP> for the seven affected examples in audit-commands.md and audit-workflow-guide.md, and reword the events-date gotcha so it explains the midnight expansion instead of spelling it out against a placeholder. The literal T23:59:59Z on the login-history examples carried the end-of-day rule; state it in prose there so the guidance survives. Add the rule to both guideline files: give each value one placeholder covering the whole value, and state the expected precision in prose. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Mihaiii
left a comment
Mihaiii
left a comment
There was a problem hiding this comment.
Approved based on what a client requested, although imo there wasn't any PII concern and the new format is less useful than the old one for the model.
|
/cherry-pick release/v1.202 |
|
A cherry pick from this PR targeting |
|
✅ Cherry-pick to |
…3201) (#3203) * docs: use placeholders for example values that trip content scanners A customer content-inspection gate blocked the published package on 21 findings. All were false positives on documentation examples — no credential, live PII, or cardholder data exists in the repo — but a shape-based gate cannot tell the difference, and a blocked artifact blocks the rollout either way. Replace the literal example values we control with the repo's existing <UPPER_SNAKE_CASE> placeholder convention, which identity-commands.md and the audit guides already use: - uipath-admin: literal --expiration dates and audit export date ranges become <EXPIRATION_DATE> / <FROM_DATE> / <TO_DATE>; generated folder names become audit_<from>_<to>_<generatedAt>. Both audit references are now free of literal calendar dates, so the scoping question does not come back on the next scan. - uipath-rpa: mail-merge sample data becomes <COMPANY_NAME> / <STREET_ADDRESS> / <CONTACT_NAME> / <PHONE_NUMBER>; the placeholder GUID drops its digit runs; the regex reference table masks digit positions as N with a note; the "number too long" test row describes its length. Left verbatim on purpose: Orchestrator error code 170002, two support-forum thread IDs inside URLs, and a Databricks documentation URL. Those are product data the playbooks exist to convey, not examples, so they need an allowlist on the scanning side rather than an edit here. Document the rule in CONTRIBUTING.md and .claude/rules/content-quality.md so new examples do not reintroduce the problem. * docs: use one placeholder per value in audit date examples <FROM_DATE>T00:00:00Z glued a placeholder to a literal time fragment. It kept the literal in the file, and read worse than either form alone — every sibling flag in those same blocks (<USER_GUID>, <ORCHESTRATOR_SOURCE_GUID>) already uses one placeholder per value. Use <FROM_TIMESTAMP> / <TO_TIMESTAMP> for the seven affected examples in audit-commands.md and audit-workflow-guide.md, and reword the events-date gotcha so it explains the midnight expansion instead of spelling it out against a placeholder. The literal T23:59:59Z on the login-history examples carried the end-of-day rule; state it in prose there so the guidance survives. Add the rule to both guideline files: give each value one placeholder covering the whole value, and state the expected precision in prose. --------- Co-authored-by: RaduAna-Maria <80031810+RaduAna-Maria@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…links [PILOT-7612] (#3373) * docs: clear the remaining content-scan findings without dropping the links A customer content-inspection scan reported six findings across four skills. All six are false positives on example text and product identifiers -- no secret, live PII, or cardholder data is involved -- but the gate matches on shape alone and blocks the whole package. PR #3201 fixed this class of finding in ten files and deliberately left three of these behind, arguing the forum thread IDs and the Databricks docs URL are content rather than examples and need a scanner-side allowlist. The allowlist never landed and the scan fired again. Each of those three can drop its matching shape while keeping the reader's link intact, so they are fixed here rather than deferred again: - Forum links use Discourse's short `/t/<id>` form. The topic ID is preserved, the long slug that put a 10-digit run in front of it is gone, and both URLs still resolve (verified HTTP 200). - The Databricks docsUrl drops `/query`, landing on the same API group page. The full path was exactly 40 `[A-Za-z0-9/+=]` characters -- the AWS secret-key shape, and the only such run in the file. The other three are example values, replaced per the placeholder rule in .claude/rules/content-quality.md: - IXP: a 15-digit float literal illustrating float rounding becomes `<SCORE>` described as 15 decimal places. - Terminal x2: `3000-5000 ms` reads as an 8-digit local phone number; written out as `between 3000 and 5000 ms`. That exact string occurs nowhere else in the repo, which is what pins it as the trigger. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: point the Databricks docsUrl at the query API, not endpoint management The previous commit broke the 40-character AWS-secret shape by dropping /query from the URL, but /api/workspace/servingendpoints and /api/workspace/servingendpoints/query are two different pages: they redirect to the serving-endpoint *management* API and the *query* API respectively. The registry exists to ground an agent on the exact endpoint before it authors a request, and this entry's own notes describe the invocations POST -- the query API. Pointing it at CRUD operations was a regression. Use the canonical target the original URL already redirected to: https://docs.databricks.com/api/model-serving-query/v1/query Same page as the original, resolves 200 with no redirect hop, and the hyphens in "model-serving-query" break the base64-alphabet run down to 14 characters, so the shape is gone for a different reason than truncation. No exactly-40 run remains anywhere in the file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…opping the links [PILOT-7612] (#3408) * docs: clear the remaining content-scan findings without dropping the links [PILOT-7612] (#3373) * docs: clear the remaining content-scan findings without dropping the links A customer content-inspection scan reported six findings across four skills. All six are false positives on example text and product identifiers -- no secret, live PII, or cardholder data is involved -- but the gate matches on shape alone and blocks the whole package. PR #3201 fixed this class of finding in ten files and deliberately left three of these behind, arguing the forum thread IDs and the Databricks docs URL are content rather than examples and need a scanner-side allowlist. The allowlist never landed and the scan fired again. Each of those three can drop its matching shape while keeping the reader's link intact, so they are fixed here rather than deferred again: - Forum links use Discourse's short `/t/<id>` form. The topic ID is preserved, the long slug that put a 10-digit run in front of it is gone, and both URLs still resolve (verified HTTP 200). - The Databricks docsUrl drops `/query`, landing on the same API group page. The full path was exactly 40 `[A-Za-z0-9/+=]` characters -- the AWS secret-key shape, and the only such run in the file. The other three are example values, replaced per the placeholder rule in .claude/rules/content-quality.md: - IXP: a 15-digit float literal illustrating float rounding becomes `<SCORE>` described as 15 decimal places. - Terminal x2: `3000-5000 ms` reads as an 8-digit local phone number; written out as `between 3000 and 5000 ms`. That exact string occurs nowhere else in the repo, which is what pins it as the trigger. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: point the Databricks docsUrl at the query API, not endpoint management The previous commit broke the 40-character AWS-secret shape by dropping /query from the URL, but /api/workspace/servingendpoints and /api/workspace/servingendpoints/query are two different pages: they redirect to the serving-endpoint *management* API and the *query* API respectively. The registry exists to ground an agent on the exact endpoint before it authors a request, and this entry's own notes describe the invocations POST -- the query API. Pointing it at CRUD operations was a regression. Use the canonical target the original URL already redirected to: https://docs.databricks.com/api/model-serving-query/v1/query Same page as the original, resolves 200 with no redirect hop, and the hyphens in "model-serving-query" break the base64-alphabet run down to 14 characters, so the shape is gone for a different reason than truncation. No exactly-40 run remains anywhere in the file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: resolve cherry-pick conflict in IXP cli-reference The cherry-pick of #3373 conflicted on the get-metrics row because release/v1.202 carries different prose there than main does (the `Name`-resolution and "any version the backend ever scored" wording, and Critical Rule 21 rather than 20). Keep the release branch's text and apply only the change #3373 actually made to this file: the 15-digit float literal illustrating long-tail rounding becomes `<SCORE>` described as 15 decimal places, per .claude/rules/content-quality.md. No other line differs from release/v1.202. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: RaduAna-Maria <80031810+RaduAna-Maria@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2 participants
Summary
<UPPER_SNAKE_CASE>placeholder conventionCONTRIBUTING.md§ CLI Commands and.claude/rules/content-quality.mdso new examples don't reintroduce itNo credential, live PII, or cardholder data exists in the repo. An independent sweep over all tracked files (AWS key IDs, private keys,
gh*_/xox*/sk_livetokens, JWTs, npm/PyPI tokens, Luhn-valid PANs) returned zero hits. This PR removes shapes, not secrets.Changes
uipath-adminpat-management.md,external-app-management.md—--expiration "2027-01-15"→--expiration "<EXPIRATION_DATE>"audit-commands.md,audit-workflow-guide.md— export windows →<FROM_DATE>/<TO_DATE>; generated names →audit_<from>_<to>_<generatedAt>, the placeholder both files already used in proseuipath-rpaUiPath.Word.Activities/…/examples.md— mail-merge sample data →<COMPANY_NAME>/<STREET_ADDRESS>/<CONTACT_NAME>/<PHONE_NUMBER>UiPath.AzureWVD.Activities/…/examples.md— placeholder GUID loses its digit runs:ffffffff-1111-2222-3333-444444444444→ffffffff-aaaa-bbbb-cccc-dddddddddddd, matching the letter-based GUID on the line above itlegacy/data-manipulation-guide.md— regex table masks digit positions (NNN-NN-NNNN,MM/DD/YYYY) with a note explainingN;ParseExacttakes adateTextvariable instead of a literallegacy/testing-guide.md— the "number too long" row describes its length instead of spelling out 11 digitsLeft unchanged, deliberately
Four findings are product data the playbooks exist to convey, not examples. Editing them would break the page:
170002(uipath-troubleshoot) — the identifier being diagnosedforum.uipath.comthread IDs inside URLs — the ID is the linkvendor-docs-registry.json— matched a 40-char AWS-secret shape ruleThese need an allowlist on the scanning side. The cleanest ask is excluding documentation-only artifacts from cardholder-data scanning: the package is Markdown and JSON reference material with no runtime data path.
Testing
npm run skills:validate— OK, default 27 skills / 1765 files; studioweb 27 / 1765 / 264 replacementsnpm run skills:check-links— 6723 relative links, all resolvenpm run skills:build— both trees build cleanpython scripts/check-skill-status.py— OK, 27 skills, manifest validpython scripts/check-skills-sh.py— OK, 27 skills across 4 sectionsNo skill folder added, renamed, or removed, so
assets/skill-status.jsonandskills.sh.jsonneed no edit. No flavor overrides orskill-flavormarkers touch any edited file.Reviewer notes
Worth considering as a follow-up: none of the 22 workflows scans content today, so nothing stops the next literal date from landing.
🤖 Generated with Claude Code