
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
docupuncture
Advanced tools
Targeted, reviewable Apps Script edits in an existing Google Doc, Sheet, or Slides file.
Treat the document you already have.
DocuPuncture prepares an Apps Script that makes targeted changes to a Google Doc, Sheet, or Slides file you already have. You review the script and run it yourself. The first run is a dry run that only logs. The script is designed to preserve surrounding structure for supported edit types.
DRY_RUN = true.Full host routes: docupuncture.dev/install.
| Skill | Surface | Fit |
|---|---|---|
docupuncture-docs | Google Docs | Comments, tabs, lists, partial styling. |
docupuncture-sheets | Google Sheets | Grid and ranges. Notes and validation stay on cells you do not rewrite. |
docupuncture-slides | Google Slides | Text and content. Layout surgery is higher risk. |
The skill does not grant Google access. Chat returns the script. The live file changes only when you paste it into Extensions → Apps Script and run it.
pnpm add docupuncture
Copy one folder from node_modules/docupuncture/skills/ into the agent's skills directory.
git clone https://github.com/Catalyst-Forge-LLC/docupuncture.git
# then copy skills/docupuncture-docs/ (or -sheets / -slides)
Site: docupuncture.dev · Posts
applyEdits.DRY_RUN = true). Read the log, flip the flag, then run again.The script runs as you. Missing or ambiguous anchors are logged. It never invents a location. For the showcased insert and update operations, a repeat run skips work that is already there.
The other tools in the shop strike, press, or contain. A needle is still metal from the same fire, but you don't swing it. You place it.
Acupuncture treats a living body in place: insert at a point, leave the rest alone. DocuPuncture does that to a document you already care about.
Closest cousin on the shelf is TemperPass: a rule set you point an agent at.
MIT. Built by Catalyst Forge LLC.
FAQs
Targeted, reviewable Apps Script edits in an existing Google Doc, Sheet, or Slides file.
The npm package docupuncture receives a total of 41 weekly downloads. As such, docupuncture popularity was classified as not popular.
We found that docupuncture demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.