I built 18 free agent skills (and the tools behind them run in your browser)

Nenad — Tue, 27 Oct 2026 20:47:40 +0000

Most "AI agent skills" I've tried either do too little or want network access for everything. So I built a set of small, zero-dependency Node tools that each do one audit-type job — and packaged them as SKILL.md skills so any compatible agent can use them.

All free: https://github.com/NenadZivotic/lite-agent-skills (17 skills) + https://github.com/NenadZivotic/secret-leak-scan-lite

The security set

Skill	What it does
`secret-leak-scan-lite`	Scans files for leaked credentials — AWS keys, GitHub/Slack tokens, private key blocks
`git-history-leak-check-lite`	Same, but for diffs — only added lines are scanned
`docker-security-lint-lite`	Top-5 Dockerfile mistakes: root user, baked secrets, `:latest`, `curl
{% raw %}`ci-cd-security-audit-lite`	GitHub Actions risks: unpinned actions, `pull_request_target` + checkout of PR head, secrets in `run:`
`http-header-audit-lite`	Missing security headers in a pasted response
`cors-misconfig-check-lite`	Dangerous CORS combos — wildcard+credentials, null origin, reflected ACAO
`jwt-inspector-lite`	Decode a JWT locally, claims masked, expiry status
`env-config-audit-lite`	`.env` vs `.env.example` parity — values are never printed

Plus non-security ones: har-to-api-map-lite, broken-link-crawl-lite, seo-quick-audit-lite, geo-audit-lite (AI-search readiness), npm-package-health-lite, github-repo-due-diligence-lite, video-repurpose-engine-lite, contract-triage-lite, cold-email-sequence-lite, meta-prompt-architect-lite.

Why lite?

Every skill is a cut-down but fully working version — not a demo. The lite tools run offline, take files/stdin, and print JSON. If you want the full version (more rules, more file types, report formats), each README links to it — but nothing nags you.

Try them without installing anything

I also ported the paste-in tools to run entirely in the browser — same logic, no upload, you can verify in DevTools that nothing leaves the page:

Install

npx skills add NenadZivotic/lite-agent-skills --skill secret-leak-scan-lite

Each skill folder has SKILL.md + scripts/ + tests. No dependencies beyond Node 18+.

If any of these save you an audit — a star on the repo helps more than you'd think. What would you lint/audit that isn't covered yet?

DEV Community: Nenad

I built 18 free agent skills (and the tools behind them run in your browser)

The security set

Why lite?

Try them without installing anything

Install