diff --git a/plugins/terminal49/skills/container-tracking/SKILL.md b/plugins/terminal49/skills/container-tracking/SKILL.md
index 911f7aa..9b6298a 100644
--- a/plugins/terminal49/skills/container-tracking/SKILL.md
+++ b/plugins/terminal49/skills/container-tracking/SKILL.md
@@ -18,8 +18,8 @@ find it and report current status, location, and anything that needs attention.
 
 1. Confirm that Terminal49 MCP tools are available.
 2. If the client requests authentication, let it start the OAuth browser flow.
-3. Never ask the user to paste an API key, access token, password, or one-time
-   code into chat.
+3. Sign-in happens in the browser, so never ask the user for sign-in details or
+   one-time codes in chat.
 4. If the tools remain unavailable, say that the Terminal49 connection must be
    enabled and authenticated. Do not invent shipment data.
 5. If a lookup returns nothing or an authorization error, call `whoami` to
diff --git a/plugins/terminal49/skills/trade-intelligence/SKILL.md b/plugins/terminal49/skills/trade-intelligence/SKILL.md
index 1140fb7..aa3ffe7 100644
--- a/plugins/terminal49/skills/trade-intelligence/SKILL.md
+++ b/plugins/terminal49/skills/trade-intelligence/SKILL.md
@@ -18,7 +18,8 @@ the answer and the few numbers that support it, not a data dump.
 ## Access
 
 The trade tools use the same OAuth connection as the other Terminal49 tools.
-Never ask the user to paste an API key, access token, or password into chat.
+Sign-in happens in the browser, so never ask the user for sign-in details in
+chat.
 
 Trade intelligence is enabled per account. If a tool says it is not enabled,
 tell the user to contact support@terminal49.com to turn it on. Don't retry, and
@@ -51,7 +52,7 @@ Most answers take two to five calls.
      `get_trade_trends` with a `company` filter for this: it matches every
      company whose name contains the text.
    - History starts in January 2022. `get_trade_trends` defaults to the last 24
-     months; pass `since` for a longer view, and don't describe the default
+     months; set `since` for a longer view, and don't describe the default
      window as the start of the data.
    - Rankings don't say who is a forwarder. When it matters (it usually does in
      "who imports X"), check the top names with `search_importers` and weigh
diff --git a/scripts/validate.mjs b/scripts/validate.mjs
index cc9652e..5ed0693 100644
--- a/scripts/validate.mjs
+++ b/scripts/validate.mjs
@@ -192,8 +192,8 @@ try {
 
 try {
   const skill = await readFile(resolve(root, paths.tradeSkill), "utf8");
-  if (!/never ask the user to paste an API key/i.test(skill)) {
-    errors.push("trade-intelligence skill must forbid pasting API keys into chat");
+  if (!/never ask the user for sign-in details/i.test(skill)) {
+    errors.push("trade-intelligence skill must forbid asking for sign-in details in chat");
   }
   if (!skill.includes("support@terminal49.com")) {
     errors.push("trade-intelligence skill must send accounts without access to support@terminal49.com");