printing-press-amend
Amend a published CLI from one of two input sources: (1) dogfood mode mines the active Claude Code session transcript for friction (missing flags, hand- rolled API payloads, silent-null returns); (2) direct-input mode accepts user-supplied asks (rename a command, add commands or feeds, fix a named bug, optionally sniff the source site for new endpoints). Confirms scope with the user, plans + executes the fix autonomously, scrubs PII, and opens a PR against mvanhorn/printing-press-library. Two user-in-loop checkpoints: scope after capture, PR draft before open. Trigger phrases: "amend the CLI", "submit a patch", "fix what I just dogfooded", "open a PR for this CLI", "patch this CLI", "add features to my CLI", "rename this command", "add these feeds to <cli>", "sniff for new APIs in <cli>", "amend with these ideas", "use printing-press-amend", "run printing-press-amend".
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill explicitly records and displays verbatim "evidence" from session transcripts (including hand-rolled API payloads / Authorization/Cookie/X-API-Key headers) during Phase 1/Phase 3 before the Phase 5 PII scrub, which requires the LLM to output secret values verbatim and thus poses an exfiltration risk.
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
In `SKILL.md` Phase 1a “Dogfood mode”, the skill reads Claude Code session JSONL lines from `~/.claude/projects/<slug>/*.jsonl` and extracts verbatim transcript `evidence`/error text to build findings.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill bootstraps a managed clone at runtime via git clone from GitHub (git@github.com:mvanhorn/printing-press-library.git and https://github.com/mvanhorn/printing-press-library.git) and then runs a verifier Python script from that checkout (python3 .github/scripts/verify-skill/verify_skill.py), which amounts to fetching remote repository content and executing code from it.
- Repository
- mvanhorn/cli-printing-press
- Commit
6dc0cee
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.