fix(skills): don't call unauthenticated endpoints a "public API" (#51)

0f765d10e8caef508e3ac7f32f0ecdcfc97b59eb · 2026-03-29 12:18:59 -0700 · Matt Van Horn

ESPN doesn't have a public API — it has undocumented internal endpoints.
The API key gate now says "No authentication required" instead of
"is a public API" and explicitly warns against mischaracterizing
unauthenticated endpoints as official public APIs.

Co-authored-by: Matt Van Horn <mvanhorn@MacBook-Pro.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Files touched

M skills/printing-press/SKILL.md

Diff

commit 0f765d10e8caef508e3ac7f32f0ecdcfc97b59eb
Author: Matt Van Horn <mvanhorn@users.noreply.github.com>
Date:   Sun Mar 29 12:18:59 2026 -0700

    fix(skills): don't call unauthenticated endpoints a "public API" (#51)
    
    ESPN doesn't have a public API — it has undocumented internal endpoints.
    The API key gate now says "No authentication required" instead of
    "is a public API" and explicitly warns against mischaracterizing
    unauthenticated endpoints as official public APIs.
    
    Co-authored-by: Matt Van Horn <mvanhorn@MacBook-Pro.local>
    Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 skills/printing-press/SKILL.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/skills/printing-press/SKILL.md b/skills/printing-press/SKILL.md
index 63f61280..714947f9 100644
--- a/skills/printing-press/SKILL.md
+++ b/skills/printing-press/SKILL.md
@@ -210,11 +210,11 @@ Before new research:
 
 **First, determine if the API needs auth.** Use these signals:
 - The spec has no `security` or `securityDefinitions` section → likely no auth needed
-- The API is known to be public/unauthenticated (e.g., ESPN, weather APIs, public data APIs)
+- The API's endpoints are accessible without authentication (e.g., ESPN's undocumented endpoints, weather APIs, public data feeds) — note: "no auth required" does NOT mean the service has an official public API
 - No env var matching the API name exists AND no known token pattern applies
 - Community docs or npm/PyPI wrappers describe the API as "no auth required"
 
-**If the API does NOT require auth** (public/unauthenticated), skip the key gate entirely. Proceed silently — do not ask the user about API keys for a public API. Live smoke testing in Phase 5 will work without a key.
+**If no auth is required**, skip the key gate entirely. Proceed with: "No authentication required for `<API>` — skipping API key gate." Do NOT call it "a public API" unless the service officially publishes one. Many services (ESPN, etc.) have unauthenticated endpoints without having an official API. Live smoke testing in Phase 5 will work without a key.
 
 **If the API DOES require auth**, run the key gate:

← a350f419 feat(skills): auto-suggest novel CLI features before absorb · back to Cli Printing Press · fix(skills): recommend installing both capture tools in snif cd61dd88 →