Nenad 開發並公開 18 款免費 Agent 技能，部分工具可在瀏覽器執行
I built 18 free agent skills (and the tools behind them run in your browser)
Nenad 開發並公開 18 款免費 Agent 技能，將零依賴的 Node 工具包裝成 SKILL.md，供相容的 Agent 使用。
Most "AI agent skills" I've tried either do too little or want network access for everything. So I built a set of small, zero-dependency Node tools that each do one audit-type job — and packaged them as SKILL.md skills so any compatible agent can use them.
All free: https://github.com/NenadZivotic/lite-agent-skills (17 skills) + https://github.com/NenadZivotic/secret-leak-scan-lite
The security set
| Skill | What it does |
|---|---|
secret-leak-scan-lite |
Scans files for leaked credentials — AWS keys, GitHub/Slack tokens, private key blocks |
git-history-leak-check-lite |
Same, but for diffs — only added lines are scanned |
docker-security-lint-lite |
Top-5 Dockerfile mistakes: root user, baked secrets, :latest, `curl |
{% raw %}ci-cd-security-audit-lite
|
GitHub Actions risks: unpinned actions, pull_request_target + checkout of PR head, secrets in run:
|
http-header-audit-lite |
Missing security headers in a pasted response |
cors-misconfig-check-lite |
Dangerous CORS combos — wildcard+credentials, null origin, reflected ACAO |
jwt-inspector-lite |
Decode a JWT locally, claims masked, expiry status |
env-config-audit-lite |
.env vs .env.example parity — values are never printed |
Plus non-security ones: har-to-api-map-lite, broken-link-crawl-lite, seo-quick-audit-lite, geo-audit-lite (AI-search readiness), npm-package-health-lite, github-repo-due-diligence-lite, video-repurpose-engine-lite, contract-triage-lite, cold-email-sequence-lite, meta-prompt-architect-lite.
Why lite?
Every skill is a cut-down but fully working version — not a demo. The lite tools run offline, take files/stdin, and print JSON. If you want the full version (more rules, more file types, report formats), each README links to it — but nothing nags you.
Try them without installing anything
I also ported the paste-in tools to run entirely in the browser — same logic, no upload, you can verify in DevTools that nothing leaves the page:
- JWT decoder
- Secret leak scanner
- Dockerfile security lint
- Security headers checker
- CORS config checker
- GitHub Actions security audit
- .env parity checker
- AI-search readiness audit
Install
npx skills add NenadZivotic/lite-agent-skills --skill secret-leak-scan-lite
Each skill folder has SKILL.md + scripts/ + tests. No dependencies beyond Node 18+.
If any of these save you an audit — a star on the repo helps more than you'd think. What would you lint/audit that isn't covered yet?
來源：DEV Community · dev.to