Decode a JWT locally and print header/payload with sensitive values masked, plus expiry status. Decode-only, zero network.
Decodes a JWT without trusting it and lints the header and claims: alg none, remote jku/x5u keys, missing or expired exp, nbf/iat clock skew, millisecond timestamps, long lifetimes, iss/aud mismatches, sensitive data in the payload, and HMAC signature checks with a secret from an env var. Use when a login or API call fails with 401, or when reviewing token settings. Includes a stdlib Python inspector with --self-test.
Offline contract risk triage for freelancers: paste an NDA, MSA or SOW and get flagged IP grabs, uncapped liability, non-competes and payment traps. Zero dependencies, zero network - the contract text never leaves your machine. Node 18+.
Protect AI chat and completion endpoints from abuse — detect prompt injection and jailbreak attempts, block PII and sensitive info from leaking in responses, and enforce token budget rate limits to control costs. Use this skill when the user is building or securing any endpoint that processes user prompts with an LLM, even if they describe it as "preventing jailbreaks," "stopping prompt attacks," "blocking sensitive data," or "controlling AI API costs" rather than naming specific protections.
Lints .env and .env.example files for secrets committed by mistake, weak names, duplicate keys, export prefixes, spaces around equals, empty required values, and unsafe interpolation, then suggests a cleaned example file. Use when a user asks "is this .env safe to commit?", "why won't dotenv load?", or "diff my .env.example". Includes a tested stdlib Python linter.
Sorts incoming security reports for your project: spots duplicates and out-of-scope noise, checks each report against your policy, suggests a severity, and drafts polite replies to researchers.
Compares environment variables across local, staging and production, finds missing, unused or mismatched settings before they break a deploy, and keeps your example env file honest.
Reviews suspicious inbox messages with a color-coded 0–100 scam score based on urgency tricks, lookalike domains, payment asks and known alert patterns—read-only unless you approve an action.
Screens email for hidden instructions aimed at AI assistants—white text, zero-width characters, and "ignore previous instructions" lines—and warns you before those messages are fed to any bot.
