tenk-connect

Connect your TenK account to your AI assistant. Log practice sessions, check progress, and manage your 10,000-hour journey from chat.

Security Scan

The skill's code and instructions are coherent with its stated purpose (a TenK CLI wrapper that uses the TenK API and stores a short-lived token locally); nothing requested or installed appears disproportionate or unrelated.

Purpose & Capability

The skill claims to manage a TenK account and the included bash script exclusively calls tenk.oventlabs.com API endpoints and implements OAuth device flow — this matches the description. Minor mismatch: the registry metadata lists no required binaries, but SKILL.md and the script require curl and python3.

Instruction Scope

Runtime instructions are limited to running the provided script (<SKILL_DIR>/scripts/tenk.sh) to authenticate, list skills, log sessions, and query stats. The script only reads/writes its own config token file (~/.config/tenk-connect/token) and communicates with the documented TenK API endpoints; it does not access other system files or unrelated environment variables.

Install Mechanism

No install spec; this is an instruction-only skill with a bundled script. No network-based installer or third-party package downloads are used, so there is no elevated install risk.

Credentials

The skill requests no environment variables or external credentials in the registry. It does persist an OAuth bearer token to ~/.config/tenk-connect/token (chmod 600). This is appropriate for its purpose, but users should be aware the token grants API access for its lifetime (noted as 7 days) and is stored on disk.

Persistence & Privilege

always is false and the skill does not modify other skills or system-wide settings. Its only persistent effect is saving a token under the user's config directory, which is expected behavior for a CLI client.

Assessment

This skill appears to do exactly what it says: it runs a local CLI script that uses the TenK API and stores a bearer token in ~/.config/tenk-connect/token (file permission 600). Before installing, verify you trust the TenK service (tenk.oventlabs.com) and the skill author (SKILL.md/README point to a GitHub repo). Ensure curl and python3 are available, and remember that the stored token grants access to your TenK account for its lifetime — revoke it from your TenK account if you uninstall or suspect misuse. The registry metadata omitted required binaries; that mismatch is not malicious but worth double-checking. If you want stronger isolation, inspect the script yourself before running and consider running auth steps in a controlled environment.

Manage your TenK account (tenk.oventlabs.com) from your AI assistant. Log sessions, view skill progress, check stats, and track your path to 10,000 hours.

Setup

On first use, run:

bash <SKILL_DIR>/scripts/tenk.sh auth

Opens a browser URL. User logs in with TenK credentials. CLI polls until approved. Token saved to ~/.config/tenk-connect/token (chmod 600).

Commands

• tenk.sh auth Authenticate via OAuth Device Flow
• tenk.sh whoami Show logged-in user
• tenk.sh skills List all skills with accumulated hours
• tenk.sh stats Total hours and % progress toward 10,000h
• tenk.sh log <skill> <minutes> [note] Log a practice session
• tenk.sh streak Last activity per skill
• tenk.sh logout Clear saved token

Usage

Use <SKILL_DIR>/scripts/tenk.sh <command> for all operations.

Auth check

Before any command, verify authentication:

bash <SKILL_DIR>/scripts/tenk.sh whoami

If it fails, run auth first and show the user the link and code.

Logging sessions

When the user says something like "log 45 minutes of guitar":

1. Run tenk.sh skills to find the matching skill (fuzzy match on name)
2. Run tenk.sh log <partial_name> <minutes> [optional note]
3. Confirm with the returned result

Showing progress

When asked about progress, hours, or stats:

• Run tenk.sh stats for totals
• Run tenk.sh skills for per-skill breakdown

Notes

• Tokens are valid for 7 days. Re-run auth if expired.
• Skill matching is case-insensitive and fuzzy on skill name.
• Authorize URL: https://tenk.oventlabs.com/#/authorize/<code>
• API base: https://tenk.oventlabs.com/api
• Requires: curl and python3 (standard on macOS/Linux)