Secutils.dev skill
Free browser utilities for JWT, SAML, certificates and CSP, each with a SKILL.md so an agent can drive it from a link
- 100 ★ on the repository
- Last commit
- AGPL-3.0
Extended access
Why this level
- The agent reaches an external website and builds links whose address carries the utility state, such as a token or certificate
- Production secrets should not go into such links, even though decoding happens in the browser
Install
- Works in
Manual install
Read https://tools.secutils.dev/llms.txt, pick the utility you need and load its SKILL.md with WebFetch, for example https://tools.secutils.dev/jwt.md
There is no installation: the agent reads the index and skill files by URL. The needed `SKILL.md` can be copied into the skills folder.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The agent reaches an external website and builds links whose address carries the utility state, such as a token or certificate
- Production secrets should not go into such links, even though decoding happens in the browser
This is third-party code. Review the repository files before installing.
What it does
Secutils.dev bundles small utilities for security engineers and developers: a JWT debugger, SAML and PEM certificate decoders, PDF text extraction, Markdown preview, an HTTP response mock, a webhook inspector and numeric series forecasting. They all run in the browser with no signup, and state lives in the page address. Each utility has a `SKILL.md` file at `tools.secutils.dev/<name>.md`, and a shared index is published as `tools.secutils.dev/llms.txt`. An agent reads it through `WebFetch`, learns the state encoding format and builds a ready link, for example to a decoded token or a CSP policy draft. The `components/secutils-docs/static/guides` folder holds subskills for the full version of the service: certificate and private key templates, CSP policies, page and resource tracking, webhook responders, API keys, secrets and Deno scripts.
Who it is for. Developers and security engineers who inspect tokens, certificates and headers and want to hand the routine to an agent.
Good fit when
- An agent decodes a JWT or a SAML response and must hand back a link with the result for a ticket
- A PEM certificate chain needs its subject, issuer, SAN and validity
- A Content-Security-Policy must be built, imported from a live page or turned into a header
- To test an integration, an agent needs a temporary webhook address with live request inspection
Not a fit when
- The data must not be passed to a third-party web page, even though decoding happens in the browser
- An offline command-line tool is needed: the skills work through the website
- Pentesting and scanning of other people's systems is required: the set is not built for it
Example request
Decode this JWT, show the header and payload and give me a Secutils debugger link with the same tokenLimitations
The skills describe a website and contain no local program, so without access to `tools.secutils.dev` and a `WebFetch` call the agent can do nothing. The JWT debugger signs and verifies HMAC only (HS256, HS384, HS512). The subskills in the `guides` folder belong to the full service with an account and have no link to the free single-page utilities. The repository is AGPL-3.0 licensed. The skill files describe the utilities in English.
How to disable. Delete the copied `SKILL.md` files from the agent's skills folder. There is no server component on your side, so there is nothing more to disable.
FAQ
How do I connect the Secutils skills to an agent?
There is no separate installation: the agent reads `https://tools.secutils.dev/llms.txt` and the needed `<name>.md` file through `WebFetch`. The files can also be copied into the Claude Code or Cursor skills folder.
Which utilities does the free set include?
The JWT debugger, SAML and PEM decoders, PDF Extractor, Markdown Preview, MARS, HTTP Echo, Webhook Inspector and Forecast. The full list is in `llms.txt`.
Is signup required?
Not for the single-page utilities: they run in the browser with no login. The full service with templates, API keys and secrets requires an account.
Where does a utility keep its state?
In the page address after the hash sign, compressed and encoded. The format and a Node.js code sample are given in each `SKILL.md`.
Does the project have a license?
Yes, the repository is released under AGPL-3.0. Read the license terms in advance before embedding it in a closed product.
Discussion
No questions or reviews yet.
Related
SkillsThe SecKnowledge skill loads a web-vulnerability and AI-app risk knowledge base into an agent for security testing of a target.
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
A practical security skills base for agents: web, API, privilege escalation, Active Directory, mobile, binaries and crypto
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A plugin with 88 Microsoft security skills: Defender, Sentinel, Entra, Purview and Intune for Copilot, Claude Code and Cursor.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Secutils.dev (this card) | no | 100 | ||
| Webhook Skills | no | 101 | skills for receiving webhooks in application code, whereas here the utilities run in the browser with a temporary address and request inspection | |
| pdf-mcp | no | not required | 171 | an MCP server for PDF work, whereas Secutils extracts PDF text in the browser as part of a set with JWT, SAML and CSP |
README in short
The README presents Secutils.dev as an open security toolbox with certificate templates, CSP management, webhook responders and page tracking. A separate section describes the free single-page utilities, their links and AI-agent skills, as well as the llms.txt convention and the layout of the `dev/tools` folder.
README badge
Original SKILL.md
--- name: secutils-csp description: >- Create, edit, share, serialize, and import Content Security Policy templates on Secutils.dev. Policies can be authored as a structured set of directives, imported by URL (fetching the live `Content-Security-Policy` or `Content-Security-Policy-Report-Only` header or `<meta>` tag from any page), or imported from a serialized policy string. Each policy can be serialized back to a header value or an HTML `<meta http-equiv>` tag and publicly shared through a tokenised URL. Trigger when the user asks to build a CSP, generate a `Content-Security-Policy` header or meta tag, copy a site's CSP into Secutils for editing, share a CSP template, or test a CSP against a webhook responder. --- # Secutils.dev: Content Security Policies The CSP utility stores reusable Content Security Policy templates. Each template owns a set of directives keyed by directive name (e.g. `default-src`, `script-src`, `style-src`, `frame-ancestors`, `upgrade-insecure-requests`) and a list of source expressions. A template can be serialized into either an HTTP header value or an inline `<meta http-equiv="Content-Security-Policy">` tag, and can be shared read-only through a tokenised URL.