Most "AI agent skills" I've tried either do too little or want network access for everything. So I built a set of small, zero-dependency Node tools that each do one audit-type job — and packaged them as SKILL.md skills so any compatible agent can use them.
All free: https://github.com/NenadZivotic/lite-agent-skills (17 skills) + https://github.com/NenadZivotic/secret-leak-scan-lite
The security set
| Skill | What it does |
|---|---|
secret-leak-scan-lite |
Scans files for leaked credentials — AWS keys, GitHub/Slack tokens, private key blocks |
git-history-leak-check-lite |
Same, but for diffs — only added lines are scanned |
docker-security-lint-lite |
Top-5 Dockerfile mistakes: root user, baked secrets, :latest, `curl |
{% raw %}ci-cd-security-audit-lite
|
GitHub Actions risks: unpinned actions, pull_request_target + checkout of PR head, secrets in run:
|
http-header-audit-lite |
Missing security headers in a pasted response |
cors-misconfig-check-lite |
Dangerous CORS combos — wildcard+credentials, null origin, reflected ACAO |
jwt-inspector-lite |
Decode a JWT locally, claims masked, expiry status |
env-config-audit-lite |
.env vs .env.example parity — values are never printed |
Plus non-security ones: har-to-api-map-lite, broken-link-crawl-lite, seo-quick-audit-lite, geo-audit-lite (AI-search readiness), npm-package-health-lite, github-repo-due-diligence-lite, video-repurpose-engine-lite, contract-triage-lite, cold-email-sequence-lite, meta-prompt-architect-lite.
Why lite?
Every skill is a cut-down but fully working version — not a demo. The lite tools run offline, take files/stdin, and print JSON. If you want the full version (more rules, more file types, report formats), each README links to it — but nothing nags you.
Try them without installing anything
I also ported the paste-in tools to run entirely in the browser — same logic, no upload, you can verify in DevTools that nothing leaves the page:
- JWT decoder
- Secret leak scanner
- Dockerfile security lint
- Security headers checker
- CORS config checker
- GitHub Actions security audit
- .env parity checker
- AI-search readiness audit
Install
npx skills add NenadZivotic/lite-agent-skills --skill secret-leak-scan-lite
Each skill folder has SKILL.md + scripts/ + tests. No dependencies beyond Node 18+.
If any of these save you an audit — a star on the repo helps more than you'd think. What would you lint/audit that isn't covered yet?
Top comments (1)
Good list — the browser-runnable, no-upload constraint is the part that matters most, because it removes the exact step where audit tools usually ask for trust they haven't earned yet. One gap I'd add: re-checks over time. A skill that passes today can be updated tomorrow into something that phones home or widens its permissions, and nobody re-runs the audit. A lightweight "what changed since I last installed this" check — SKILL.md diff plus script diff, before re-approving — would close the loop your set opens. What would you lint that isn't covered yet? For me it's that update step, not a 19th first-install check.