Most "AI agent skills" I've tried either do too little or want network access for everything. So I built a set of small, zero-dependency Node tools that each do one audit-type job — and packaged them as SKILL.md skills so any compatible agent can use them.
All free: https://github.com/NenadZivotic/lite-agent-skills (17 skills) + https://github.com/NenadZivotic/secret-leak-scan-lite
The security set
| Skill | What it does |
|---|---|
secret-leak-scan-lite | Scans files for leaked credentials — AWS keys, GitHub/Slack tokens, private key blocks |
git-history-leak-check-lite | Same, but for diffs — only added lines are scanned |
docker-security-lint-lite | Top-5 Dockerfile mistakes: root user, baked secrets, :latest, `curl |
{% raw %}ci-cd-security-audit-lite | GitHub Actions risks: unpinned actions, pull_request_target + checkout of PR head, secrets in run: |
http-header-audit-lite | Missing security headers in a pasted response |
cors-misconfig-check-lite | Dangerous CORS combos — wildcard+credentials, null origin, reflected ACAO |
jwt-inspector-lite | Decode a JWT locally, claims masked, expiry status |
env-config-audit-lite | .env vs .env.example parity — values are never printed |
Plus non-security ones: har-to-api-map-lite, broken-link-crawl-lite, seo-quick-audit-lite, geo-audit-lite (AI-search readiness), npm-package-health-lite, github-repo-due-diligence-lite, video-repurpose-engine-lite, contract-triage-lite, cold-email-sequence-lite, meta-prompt-architect-lite.
Why lite?
Every skill is a cut-down but fully working version — not a demo. The lite tools run offline, take files/stdin, and print JSON. If you want the full version (more rules, more file types, report formats), each README links to it — but nothing nags you.
Try them without installing anything
I also ported the paste-in tools to run entirely in the browser — same logic, no upload, you can verify in DevTools that nothing leaves the page:
- JWT decoder
- Secret leak scanner
- Dockerfile security lint
- Security headers checker
- CORS config checker
- GitHub Actions security audit
- .env parity checker
- AI-search readiness audit
Install
npx skills add NenadZivotic/lite-agent-skills --skill secret-leak-scan-lite Each skill folder has SKILL.md + scripts/ + tests. No dependencies beyond Node 18+.
If any of these save you an audit — a star on the repo helps more than you'd think. What would you lint/audit that isn't covered yet?
