secutils

Create, edit, share, and generate X.509 digital certificates from templates on Secutils.dev. A template captures the key algorithm, signature algorithm, validity window, distinguished name, key usage, extended key usage, basic constraints, and SANs, and produces self signed or CA signed bundles in PEM, PKCS#12 (PFX), or PKCS#8. Also exposes a one shot HTTPS endpoint fetcher that returns the live TLS chain of any remote URL as PEM. Trigger when the user asks to generate a test TLS certificate, build a self signed CA bundle, create a PFX for a Node.js or IIS HTTPS server, produce a JWK from a generated keypair, share a certificate template publicly, or fetch the cert chain that a real HTTPS server presents.

Generate, list, update, delete, and export cryptographic private keys on Secutils.dev. Supports RSA (1024 to 8192 bits), DSA, ECDSA (P-256, P-384, P-521), and Ed25519, with optional passphrase encryption and export to PKCS#8 (DER or PEM) or legacy PEM. Trigger when the user asks to "generate an RSA key", "create an Ed25519 private key", "export a private key as PKCS#8", produce a key for use with a Secutils certificate template, or manage password-protected private keys for testing TLS, JWT, or other asymmetric cryptography. Requires an authenticated Kratos session cookie or a Secutils API key.

Create, list, rename, regenerate, and delete API keys on Secutils.dev. API keys are opaque tokens prefixed `su_ak_` that authenticate programmatic access to every Secutils.dev REST endpoint without a browser session. Trigger when the user asks to "create a Secutils API key", needs to authenticate a script or AI agent against `https://secutils.dev/api/...`, wants to regenerate or rotate an existing key, or needs to manage key expiration. Note that API key management endpoints themselves cannot be invoked with an API key for bootstrap reasons; they require a Kratos session cookie.

Reference for the restricted Deno runtime that hosts Secutils.dev responder scripts and API tracker configurator/extractor scripts. Documents what is and is not available inside the sandbox, the `context` global shape per script kind, the `Deno.core` utility namespace (encode/decode, binary string helpers, base64 building blocks, type checks), the body auto-conversion table, and the `Deno.core.ops.op_proxy_request()` API used to safely forward HTTP requests upstream. Load this skill whenever an agent is writing or debugging JavaScript that will be pasted into a Secutils responder or tracker script field, so it generates code that actually runs inside the sandbox instead of code that relies on `fetch`, `btoa`, `setTimeout`, or other globals that are not exposed.

Export and import the entire workspace contents of a Secutils.dev account as a single `.secutils.json` file. Supports selective export of scripts, secrets, responders (with request history), certificate templates, private keys, content security policies, page trackers, API trackers, and user settings. Secret values can optionally be bundled, AES-256-GCM-encrypted with an Argon2id-derived key. Import runs in `merge` (additive, with per-collision rename/overwrite/skip) or `apply` (desired-state, can delete missing items) mode. Trigger when the user asks to back up their Secutils workspace, migrate between accounts, sync configuration-as-code from a Git repo, or detect drift against a known-good baseline.

Create, update, and delete encrypted user secrets on Secutils.dev. Secrets are write-only key-value pairs (max 10 KB per value, max 100 per user) used to inject API tokens, passwords, private keys, or any other credential into responder scripts, page-tracker and API-tracker scripts, and responder static body/header templates without ever exposing the value to the browser after creation. Trigger when the user asks to store an API key for a Secutils responder, reference a credential from a tracker script, rotate a Secutils secret, or wire `${secrets.X}` template substitution into a static responder body.

Manage workspace tags on Secutils.dev. Tags are user-scoped, coloured labels (max 50 per user, max 20 per item) used to organise and filter responders, page trackers, API trackers, CSP policies, certificate templates, private keys, scripts, and secrets. Every create/update payload on those entities accepts a `tagIds` array of tag UUIDs that comes from this skill. Trigger when the user asks to "tag this responder", "filter by tag", create a new tag colour, rename or delete a tag, or build up a tagged workspace via the API.

Create, list, update, duplicate, and delete reusable JavaScript user scripts on Secutils.dev. A user script is a snippet (max 50 KB) classified by `type` (`responder`, `api_extractor`, `api_configurator`, `page_extractor`, `universal`) that the workspace UI can import into any compatible editor with a single click. Imports inline the script content at import time, so later edits to the source script do not propagate. Trigger when the user asks to save a reusable Secutils snippet, build a shared library of responder logic, share a tracker extractor between multiple trackers, or manage the user-script catalogue from a script or AI agent.

Create, list, update, debug, and run API trackers on Secutils.dev. An API tracker is a scheduled HTTP request (GET, POST, PUT, PATCH, DELETE) against an HTTP or HTTPS endpoint, with optional JavaScript configurator and extractor scripts that run in a Deno sandbox to mutate the request pre flight and transform the response post flight. Stores up to N revisions of the extracted body and notifies on change. Trigger when the user asks to monitor a REST or JSON API for changes, alert on a status change in a public webhook, watch a third party API's response format, build a synthetic check, or test a JSON endpoint and compare runs. Lighter and faster than page trackers because no browser is launched.

Create, list, update, debug, and run page trackers on Secutils.dev. A page tracker is a scheduled headless Playwright job that visits a target URL, executes a user-supplied extractor script in a Chromium browser, stores up to N historical revisions of the extracted value (text, JSON, HTML, or any payload up to 1 MB), and notifies the user when the value changes. Trigger when the user asks to "monitor a web page for changes", "track the top Hacker News post", "alert me when X on a website changes", detect deployment regressions, watch a competitor's marketing page, or monitor JavaScript and CSS resources on a deployed web app. Requires an authenticated Kratos session cookie or a Secutils API key.

Create, edit, share, serialize, and import Content Security Policy templates on Secutils.dev. Policies can be authored as a structured set of directives, imported by URL (fetching the live `Content-Security-Policy` or `Content-Security-Policy-Report-Only` header or `<meta>` tag from any page), or imported from a serialized policy string. Each policy can be serialized back to a header value or an HTML `<meta http-equiv>` tag and publicly shared through a tokenised URL. Trigger when the user asks to build a CSP, generate a `Content-Security-Policy` header or meta tag, copy a site's CSP into Secutils for editing, share a CSP template, or test a CSP against a webhook responder.

Create, list, update, and delete webhook responders on Secutils.dev. A responder is a programmable HTTP endpoint hosted on the caller's dedicated subdomain (`<handle>.webhooks.secutils.dev/<path>`) that returns either a static body or a dynamic response built by a JavaScript script running in a Deno sandbox. Trigger when the user asks to mock an HTTP endpoint, simulate a webhook callback, build a honeypot, proxy or intercept upstream HTTP traffic, capture incoming requests for inspection, generate dynamic responses based on the request query or body, or expose a temporary HTML or JSON endpoint without writing a server. Requires an authenticated Kratos session cookie or an API key created from the Secutils.dev Settings page.