Developer Tooling
CLIs, linters, generators, test helpers and build plugins. The things you would otherwise spend a weekend writing before starting the actual work.
Every package here was unpacked and its source analysed for malware, prompt-injection payloads, build failures and copied work before it could be listed.
Git Secret Guard: Pre-commit Credential Scanner
A zero-dependency git pre-commit hook and Node CLI that refuses commits containing credentials. It recognises 20 key formats by their provider prefix, including Stripe, GitHub, AWS, Supabase, Vercel, OpenAI, Anthropic, Slack, npm, Shopify, SendGrid and PEM private keys, and decodes JWTs so a Supabase service_role key blocks while the browser-safe anon key does not. It also blocks .env files, SSH keys, key stores and recovery-code dumps by file name. Beyond the hook, --all scans every tracked file, --history scans every file version reachable from any ref and names the commit that introduced each finding, and --dir scans build output, optionally failing when a server-only value from your .env file was inlined into the bundle. A JSON config adds custom patterns, allow-lists files or single lines, downgrades rules and blocks known leaked values by SHA-256. The installer never overwrites a hook it did not write. Matching is by shape, so passwords, connection strings and other prefix-less secrets are not detected, and git commit --no-verify bypasses it; the README lists every limit. 65 tests pass on Windows 11 with Node 24 and Git 2.55. macOS, Linux and older Node versions have not been run.
Fake Flash Drive Tester: CLI and Claude Code Skill
A Windows tool that proves whether a USB flash drive or SD card really holds its advertised capacity, packaged both as a standalone command-line script and as a Claude Code skill. The capacity test writes self-identifying data in doubling stages with unbuffered, write-through I/O and re-reads the entire written range after every stage, so a small fake is caught in an early stage and a wrap-around fake cannot hide. Failures are classified as discarded (zeros), wrap-around (with the real capacity worked out from the wrap distance) or garbage, and reported with claimed size, real size, multiplier and a region map. It refuses the system drive, network and optical drives, and non-empty drives unless told otherwise. Read-only commands identify the drive and list red flags, and check it for malware: autorun and shortcut-worm heuristics, a report-only Microsoft Defender scan, and a BadUSB check that flags keyboard or network functions hiding behind the storage. One standard-library Python file, no installs. 63 tests pass on Python 3.11 and 3.14 on Windows 11; no physical removable drive was tested for this release.
WCAG 2.2 Audit Suite for Headless Chrome
A zero-dependency Node.js command-line tool that renders pages in headless Chrome over the DevTools protocol and measures WCAG 2.2 problems rather than guessing from markup. Ten checks: text contrast against the background actually painted behind the text (translucent layers composited, opacity applied), clipping under the 1.4.12 text-spacing overrides and at 200% default text size, reflow at 320px with target size including both 2.5.8 exceptions, controls that lose their edge in forced colours, invisible or obscured focus, a keyboard walk that catches traps, missing focus indicators and scripts that throw focus away, unnamed controls and images from the accessibility tree, broken id references, and motion that ignores reduced-motion. One command gives a console report with a CSS selector per finding, a JSON report and CI exit codes, including a separate code when a page failed to load or a built-in canary was missed, so a broken run is never reported as clean. Tested only on Windows 11 with Node 24.19 and Chrome 154. It is not a conformance audit: warnings need human review.