fix(cli): quote paths in emboss stderr output to prevent shell injection (#256)

1645e962836b331da44734973016177fbdae3ba4 · 2026-04-24 14:04:00 -0700 · Dinakar Sarbada

Co-authored-by: Dinakar Sarbada <dinakars777@users.noreply.github.com>

Files touched

M internal/cli/emboss.go

Diff

commit 1645e962836b331da44734973016177fbdae3ba4
Author: Dinakar Sarbada <sarbadadinu@gmail.com>
Date:   Fri Apr 24 14:04:00 2026 -0700

    fix(cli): quote paths in emboss stderr output to prevent shell injection (#256)
    
    Co-authored-by: Dinakar Sarbada <dinakars777@users.noreply.github.com>
---
 internal/cli/emboss.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/internal/cli/emboss.go b/internal/cli/emboss.go
index 890cb5ff..351e42ec 100644
--- a/internal/cli/emboss.go
+++ b/internal/cli/emboss.go
@@ -157,9 +157,9 @@ The improvement steps (2-4) are driven by the /printing-press emboss skill.`,
 			}
 
 			fmt.Fprintln(os.Stderr, "\nBaseline saved. Now run the skill for improvements:")
-			fmt.Fprintf(os.Stderr, "  /printing-press emboss %s\n\n", workingDir)
+			fmt.Fprintf(os.Stderr, "  /printing-press emboss %q\n\n", workingDir)
 			fmt.Fprintln(os.Stderr, "When done, re-run this command to compute the delta:")
-			fmt.Fprintf(os.Stderr, "  printing-press emboss --dir %s --spec %s\n", workingDir, specPath)
+			fmt.Fprintf(os.Stderr, "  printing-press emboss --dir %q --spec %q\n", workingDir, specPath)
 			return nil
 		},
 	}

← 5353fb38 chore(main): release 2.3.0 (#250) · back to Cli Printing Press · fix(openapi): collect paths to delete before mutation in str 28ba1e01 →