make-pdf
“Turn any markdown file into a publication-quality PDF. (gstack)”
src
test
e2e
fixtures
aipkg.jsonLICENSE.txtREADME.mdSKILL.mdSKILL.md.tmplsrc/browseClient.tssrc/cli.tssrc/commands.tssrc/orchestrator.tssrc/pdftotext.tssrc/print-css.tssrc/render.tssrc/setup.tssrc/smartypants.tssrc/types.tstest/browseClient.test.tstest/e2e/combined-gate.test.tstest/fixtures/combined-gate.expected.txttest/fixtures/combined-gate.mdtest/pdftotext.test.tstest/render.test.ts- 01SDI-275%MEDIUM
SKILL.md:33
detailhide
The preamble implements telemetry and analytics collection (writing to ~/.gstack/analytics/skill-usage.jsonl) that goes significantly beyond the stated purpose of 'turn markdown into PDF.' The skill sends data about skill invocation, repository name, and session IDs to local analytics files. While gated behind a telemetry setting, this scope creep introduces unexpected data collection that users calling this skill may not anticipate.
3132```bash33_UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true)34[ -n "$_UPD" ] && echo "$_UPD" || true35mkdir -p ~/.gstack/sessionsfix 1. Remove or move non-PDF-related analytics collection out of the preamble into a separate, documented telemetry skill. 2. For PDF generation telemetry only, add an explicit opt-in prompt at the start of the skill if telemetry is enabled. 3. Document in the skill description that telemetry collection occurs. 4. Ensure all collected data is limited to PDF-generation-specific metrics (file size, duration, success/failure).
- 02SDI-272%MEDIUM
SKILL.md:159
detailhide
The preamble includes extensive feature discovery workflows, configuration management prompts, routing injection, and upgrade checks. These operations are unrelated to PDF generation and significantly expand the skill's scope. A user invoking /make-pdf expects to generate a PDF, not to be prompted about feature toggles, telemetry opt-in, and project configuration changes. This violates the principle of least surprise.
157- Exit 0 success / 1 bad args / 2 render error / 3 Paged.js timeout / 4 browse unavailable.158159## Plan Mode Safe Operations160161In plan mode, allowed because they inform the plan: `$B`, `$D`, `codex exec`/`codex review`, writes to `~/.gstack/`, writes to the plan file, and `open` for generated artifacts.fix 1. Extract all feature discovery, configuration prompts, and upgrade logic into a separate 'gstack-setup' or 'gstack-config' skill. 2. The make-pdf skill preamble should only: verify the PDF binary is available, check for required dependencies, and confirm input file exists. 3. Add a conditional: only run setup workflows if explicitly invoked via a /setup-gstack command, not on every PDF generation.
- 03SDI-270%LOW
SKILL.md:32
detailhide
The skill reads and writes extensive configuration state across ~/.gstack/, including state markers (.proactive-prompted, .telemetry-prompted, .feature-prompted-*), session files, and learning records. While some state management is necessary, the volume and variety of state files accessed is disproportionate to PDF generation and creates persistent side effects. A user calling the skill multiple times will accumulate state that modifies future behavior in non-obvious ways.
30## Preamble (run first)3132```bash33_UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true)34[ -n "$_UPD" ] && echo "$_UPD" || truefix 1. Limit state files to PDF-generation-specific caches (e.g., font cache, compiled PDF binary version). 2. Move configuration discovery and state markers into a dedicated configuration skill. 3. Document all state files created/modified in the skill's README. 4. Provide a 'reset' command to clear all gstack state if needed.
- 04SDI-378%MEDIUM
SKILL.md:11
detailhide
The manifest declares allowed-tools as [Bash, Read, AskUserQuestion], but the preamble script executes external binaries (~/.claude/skills/gstack/bin/gstack-*), modifies git state, creates/deletes files, and reads/writes configuration. The gap between declared and actual permissions creates a false sense of safety. Bash permissions are powerful but the scope of what the skill actually does is not clearly bounded by the manifest.
09 - make pdf10 - export pdf11allowed-tools:12 - Bash13 - Readfix 1. Expand the manifest to explicitly list filesystem operations: 'Creates/modifies: ~/.gstack/, ~/.gstack/analytics/, .gitignore, CLAUDE.md. Creates/deletes: ~/.gstack/sessions/*. Reads: ~/.claude.json, CLAUDE.md, .gbrain-source.' 2. Add a new allowed-tools entry: 'ExternalBinaries: gstack-* from ~/.claude/skills/gstack/bin/'. 3. Document which operations are required for PDF generation vs. framework setup.
- 05SDI-168%LOW
SKILL.md:5
detailhide
The skill description promises 'publication-quality PDF generation from markdown' but the actual preamble may delay or prevent execution due to configuration checks, feature discovery prompts, telemetry gate questions, and routing injection. A user expecting a quick 'make-pdf' call could wait for multiple AskUserQuestion prompts about feature toggles and telemetry before any PDF is generated. This breaks the expected behavior contract.
3preamble-tier: 14version: 1.0.05description: Turn any markdown file into a publication-quality PDF. (gstack)6triggers:7 - markdown to pdffix 1. Restructure the preamble to separate mandatory (PDF binary check) from optional (feature discovery) operations. 2. Move all non-critical setup into a conditional: `if [ "$GSTACK_FIRST_RUN" = "true" ]; then ... fi`. 3. For first-run detection, check for ~/.gstack/.setup-complete marker instead of running discovery on every invocation. 4. Document in the skill that first invocation may prompt for feature opt-in, but subsequent calls generate PDFs immediately.