Profile My skills Saved Collections Edit profile Submit a skill

← all publishers

guildshelf

@guildshelf source repo

5 published skills

  1. ▌
    Aes Cheatsheet · guildshelf bundle
    One-page reference for the OpenSSL "Salted__" AES-256-CBC password format — byte layout, EVP_BytesToKey key/IV derivation (MD5 and SHA-256 variants), openssl CLI ground-truth one-liners, minimal Python and PHP recipes, a ranked table of cross-language failure modes ("bad decrypt", U2FsdGVkX1 prefix, hex-vs-raw digest bytes, URL-safe base64, PKCS#7 padding), and a KDF discriminator (is it really this format, or PBKDF2?). Use when debugging why ciphertext encrypted in one language fails to decrypt in another, or when identifying whether a base64 blob is this format. Not for designing new encryption (use AES-GCM + PBKDF2/Argon2 for new systems), TLS/HTTPS setup, password hashing (bcrypt/argon2), JWT signing, or file checksums. A drop-in browser/Node JS module (Web Crypto has no MD5) with CLI-verified test vectors is in the full AES Interop Kit.
    0
    installs
  2. ▌
    Config Doctor Lite · guildshelf bundle
    Quick health-check for AI coding agent configuration. Auto-discovers CLAUDE.md files and skill directories, then runs 3 read-only checks: broken path references in CLAUDE.md, skill folders missing SKILL.md, and weak SKILL.md frontmatter (missing name/description). Python stdlib only, prioritized terminal report, never writes anything. Use when the user asks to audit their Claude Code config, check for broken paths or dead references after moving/renaming a project or migrating machines, or find out why a skill is not loading or triggering. Not for auditing code dependencies (npm/pip), scanning for secrets, linting application configs (nginx, Docker, ESLint, Kubernetes), or creating a new CLAUDE.md from scratch. Memory-index, hooks, and MCP-definition checks plus JSON/CI output are in the full Config Doctor.
    0
    installs
  3. ▌
    Learn By Demo Lite · guildshelf bundle
    Capture a real user demonstration of a web workflow (browser DevTools HAR export, or your agent runtime's own network reader) and turn it into a redacted endpoint draft, so automation is built from observed traffic instead of guessed APIs. Use when automating an internal tool, legacy SPA, or vendor portal that has no API docs; when guessed endpoints keep returning 401/403 or HTML instead of JSON; or when the user says "watch me do it once", "let me show you the steps", or "record what I click". Not for: services with documented public APIs (read the docs instead), bypassing CAPTCHAs, bot detection, or logins you are not authorized to use, scraping sites against their terms, generating UI test suites, or mobile-app reverse engineering. The Playwright capture harness, session-preservation (CDP attach), replay scaffold generator, and batch-hardening patterns are in the full Learn-by-Demo.
    0
    installs
  4. ▌
    Silent Runner Lite · guildshelf bundle
    Launch a Windows background process (.bat, node, python, .exe) with no visible console window — no black console flash on login or restart. Provides a generic VBS launch wrapper (window style 0) for the startup folder, the Start-Process -WindowStyle Hidden pattern for child processes inside a .bat, and the pythonw / CREATE_NO_WINDOW patterns for Python. Use when a script, bot, or dev server keeps popping a command window or flashing a console on startup/login and you want it fully silent. Windows only. NOT for macOS or Linux, NOT for hiding malware or evading security software, NOT a scheduler/cron manager, and this Lite edition does not include focus-steal governance, pop-up diagnostics, or batch-hiding of existing Task Scheduler jobs (the full Silent Runner covers those).
    0
    installs
  5. ▌
    Secrets Sweeper Lite · guildshelf bundle
    Quick offline scan of a directory for the 10 most dangerous hardcoded credential types before publishing or sharing — private key blocks, AWS access keys, GitHub tokens, OpenAI / Anthropic / Google API keys, Slack tokens, Stripe live keys, JWTs, and generic key/secret/token assignments (entropy-checked). Prints masked findings straight to the terminal with CI-friendly exit codes; Python stdlib only, zero network calls, writes nothing to disk. Use when the user says "scan for secrets", "check for leaked keys", "did I hardcode a key somewhere", or before open-sourcing or handing off a repo. NOT for rotating or revoking credentials, scanning git history (working tree only), PII / IP-address / tunnel-domain / personal-path detection, custom denylists (names, internal terms), or exportable Markdown/JSON reports — those are in the full Secrets Hygiene Sweeper.
    0
    installs