JustHandled Labs Complete Toolkit

Qualify and score a whole lead list with BANT or MEDDIC, automatically. Researches each account for buying signals like funding and leadership changes, scores it with a reason code for every point, and returns a prioritized queue with outreach drafts tied to what it found. CSV in, sales-ready queue out.

Penetration-test your Claude Code agent's guardrails before you deploy. Throws prompt-injection payloads, shell-chaining, and path-traversal attempts at your PreToolUse/PostToolUse hooks and sensitive-file protections, then returns a pass/fail report on 10+ attack vectors with copy-paste remediation for every gap.

Map any repo into an interactive D3 dependency graph plus a Markdown onboarding guide: entry points, module relationships, circular dependencies, and dead-code candidates, with refactor suggestions. Parses TypeScript, Python, Java, Go, and Rust imports, exports, and calls. Self-contained HTML, no source changes.

Generate a complete 30/60/90 day product launch plan: positioning, a Product Hunt strategy, a press list of 50+ contacts, a 4-stage email sequence, a 14-day social calendar, and an hour-by-hour launch-day checklist. Everything built and ready to run, not vague 'post on social' advice.

Create a reviewable coding-agent handoff from current repository state, resume from the newest handoff with a drift check, or reconstruct one from transcript cues when no handoff exists.

Batch-enrich a lead-list CSV: waterfall lookups across Apollo, Clearbit, Hunter, and ZoomInfo find and verify emails for 3+ decision-makers per account, score each lead 0-100 on ICP fit and buying signals, and export CRM-ready for HubSpot or Salesforce. Built for hundreds of leads, not one at a time.

Handle any B2B sales objection with a framework-backed response: classifies it (price, authority, timing, competition, need), then drafts an email or call script tailored to your product and price point, plus the discovery questions that surface the objection behind the objection. Built on LAER, Sandler, and JOLT, not pushy improv.

Turn a CRM export or live HubSpot/Salesforce/Pipedrive sync into an executive-ready pipeline report: a 12-month weighted forecast with three scenarios, win/loss themes pulled from deal notes, data-quality flags, and a board-ready PDF. Can run weekly and email itself to stakeholders.

Audit any URL for technical SEO, Core Web Vitals, on-page issues, and content gaps against up to three competitors, then get a ranked, ready-to-hand-off action plan. Uses live crawl data and PageSpeed signals, with optional Ahrefs/Moz/Semrush APIs when you have them.

Turn messy PRDs, Notion docs, and user stories into a structured implementation plan: tasks with dependencies, complexity estimates, file paths, and acceptance criteria, plus GitHub-ready issues you can post with one command. Flags the unresolved questions to settle with stakeholders before code starts.

Set up and book meetings end to end: generates Cal.com or Calendly booking links, converts your availability to the prospect's timezone, and drafts the full invite, reminder, follow-up, and thank-you sequence with an agenda matched to the meeting type (discovery, demo, onboarding). Buffers built in so you're not booked back to back.

Generate personalized multi-step cold email sequences from a lead CSV: a Day 1/3/7 cadence per prospect, A/B subject lines, and a 100-point spam-risk check that rewrites risky copy to protect deliverability. Exports CRM-ready for HubSpot or Salesforce. Built for batches, not one email at a time.

Drive a browser from your agent without the token bloat. Batches navigate/click/type into one call, stays logged in with persistent sessions, and feeds the model compact DOM snapshots instead of giant HTML, so multi-step flows like logins, form-filling, and scraping behind auth stay fast and cheap. Runs on the uBrowser MCP server.

Run real Playwright E2E tests on your web app: login, checkout, and form flows across desktop and mobile viewports, with screenshots, traces, and console logs captured on every failure. Catches broken flows and UI regressions before release, and tells you the likely fix, not just that something broke.

Diagnose CI step failures and jobs that fail before steps run. Trace empty-step states and matrix cancellations to evidence, then propose the smallest reviewable fix.

Turn deal details into a branded, client-ready deal room: an interactive HTML microsite with pricing tiers, an ROI calculator, case studies, and clear next steps, ready to deploy to Netlify, Vercel, or S3 in seconds. A professional client portal instead of another PDF attachment.

Run a 10,000-iteration Monte Carlo forecast on your pipeline CSV to get P50/P70/P90 revenue confidence intervals, an ASCII distribution histogram, and what-if scenarios for slipped deal dates. Answers 'how likely are we to hit the number?' instead of a flat weighted-pipeline guess.

Turn CRM exports into sales rep scorecards: 0-100 performance scores across activity, pipeline, conversion, and forecast accuracy, plus evidence-based coaching notes for weekly 1-on-1s. One review-ready report instead of a spreadsheet weekend.

Turn an account's contact list into a champion map: classifies each stakeholder as economic buyer, coach, blocker, or user, scores them 0-100, and renders the power structure as an org chart with a next-action angle for each one. So reps stop treating every stakeholder like the same beige rectangle.

Turn a local Git range, recent commit window, or tag comparison into plain Markdown release notes with tolerant Conventional Commit grouping, breaking-change detection, tagless fallback, and a reviewable SemVer suggestion.

Turn a raw account CSV into balanced sales territories: assigns accounts by region, industry, workload, and ARR, flags orphaned high-value accounts, and hands managers specific rebalancing moves. Compares region-based vs industry-based models so coverage is even instead of cherry-picked.

Humanize AI writing without changing the facts: strips the tells (delve, tapestry, em-dash abuse, throat-clearing) and rewrites flat LLM prose into sharp, concrete, human-sounding copy. Feed it a writing sample and it builds a reusable voice profile so every future draft sounds like you, not the model.

Figure out why your Vercel build or deploy failed without scrolling the whole log. Reads the build log plus your package manifest and framework config to pinpoint missing modules, Node and package-manager mismatches, missing env vars, monorepo root mistakes, and serverless/edge runtime errors, with the likely cause and a fix for each.

Generate runnable accessibility regression tests, not just a findings report. Detects a11y issues, missing alt text, unlabeled controls, keyboard and focus gaps, in your routes, components, or HTML, then emits Playwright + axe-core spec files with targeted assertions and remediation tickets for each. Previews the tests first and writes them only on your confirmation.

Check whether accessibility conformance claims still trace to current, scoped, version-matched, manually reviewed, and retested evidence.

Find the LLM integration code that breaks when a model blocks a response or falls back to a different model. Flags calls with no try/except or refusal branch, responses used or parsed with no guard for a blocked or empty answer, and hardcoded model ids with no fallback handling. Built for the Fable 5 era, where a high-risk call is blocked and silently falls back to Opus 4.8.

Flag the destructive operations in a shell command or script before anyone runs it. Catches recursive force deletes, force pushes and history rewrites, database drops and truncates, disk-wipe commands (mkfs, dd to a device), permission blowouts (chmod 777), remote content piped into a shell, broad wildcard deletes, and prod-targeting or disabled-safety flags. Each finding comes with a severity and a safer alternative.

Generate the model and vendor risk register a security lead asks for the morning after a model gets switched off. It scans your codebase for every model and provider, merges in the owner and data-residency notes you supply, and renders a register with provider, model, where it's used, fallback status, and an availability-risk rating per dependency. Markdown by default, CSV with a flag. Continuity-focused, not a compliance assessment.

Audit your frontend build against a performance budget and catch size regressions before you ship. Flags total bundle over budget, initial bundle over budget, individual chunks over a threshold, oversized image assets, source maps shipped to production, and large unminified JavaScript. Reads a webpack or Vite-style stats.json plus a perf-budget.json you control.

Flag every em-dash and AI transition cliché in a draft and get a plain replacement suggestion for each. Catches em-dashes (the "ChatGPT dash"), overused transition words and phrases (moreover, furthermore, "in today's digital age," delve), and dash-like punctuation doing vague connective work. It flags and suggests; you decide what to change.

One-line summary description Stop your agent from claiming "done" before it's proven. A verification gate that classifies each change by risk (payment, auth, database, user-facing), picks the tests that actually cover it, demands evidence, maps regression risk, and outputs an honest pass/fail report. Turns "looks good to me" into "here's what I ran, and here's what's still unverified."

Pull the real commitments out of a meeting transcript, with owners, and separate firm action items from tentative "let's revisit" ones. Reads .vtt, .srt, .txt, or pasted notes, attributes each item to the speaker who said it, classifies it firm or tentative, and marks any decision with no clear owner as needs-confirmation instead of inventing one.

Find and finish the UI states AI-built apps commonly miss, then verify the smallest launch-ready patch across mobile and desktop.

Audit a JavaScript or TypeScript frontend for missing translations and hardcoded UI strings before you ship a new locale. Flags hardcoded JSX text and UI props (title, placeholder, aria-label, label, alt) not wrapped in t(), i18n.t(), or <Trans>; keys present in the default locale but missing from other locale files; keys referenced in code but absent from the locales (the raw dotted keys that leak to users); unused locale keys; and unparseable locale JSON.

Run structural QA on your translation files across locales. Flags missing keys, placeholder mismatches ({name}, %s, {{var}}), strings left untranslated and identical to the source, length-overflow risk that breaks UI, terminology drift against a glossary, empty targets, and plural-category gaps. Works on JSON, gettext .po/.pot, and .properties. It checks form, not meaning, so you do not need to speak the target language to use it.

Turn real before-and-after screenshots into comparable marketplace proof with normalized crops, annotations, captions, and claim checks.

Turn a messy task description into a clean, conventional git branch name: detects the type (feature, fix, refactor), slugifies the summary, pulls in JIRA/GitHub ticket prefixes, then offers to run git checkout -b for you. One naming standard the whole team actually follows, instead of 'quick-fix-1'.

Replace generic AI-interface patterns with product-specific visual rules and a bounded implementation plan that preserves working behavior.

Hold your bios, footers, and profiles to one brand spec. Flags brand-name spelling and casing that does not match your canonical form, off-spec taglines, links that are not on your official list, leftover placeholders (Lorem, TODO, "your tagline here"), and handles that differ from one surface to the next. You define the spec once and it enforces it everywhere.

Generate three distinct digital-product covers with GPT Image 2 from a product name, description, optional price, brand colors, style, size, and quality. Defaults to 1280x720 PNGs for storefronts and leaves no partial set if generation fails.

Compare invoice lines with original scope, approved change orders, approval evidence, and completion proof before payment review.

Catch typos, homophones, and near-miss misspellings across code, docs, and markdown, in a commit, your staged changes, a file, or a whole directory. Layers dictionary, phonetic (Soundex), and edit-distance checks with context-aware homonym rules to flag the their/there and its/it's a basic spellcheck sails right past.

Diagnose why your Docker Compose stack won't come up: port conflicts, bad or missing env vars, absent healthchecks, volume and permission issues, depends_on that doesn't wait for readiness, networking gaps, platform mismatches, and databases that aren't ready. Reads your docker-compose.yml and logs and ranks the blockers with fixes.

Diagnose why Stripe Checkout, the Billing Portal, or your webhooks aren't working: missing signature verification, raw-body mistakes, no idempotency, test/live key mix-ups, broken success and cancel URLs, and subscription lifecycle gaps. Works across Next.js, Express, FastAPI, and serverless, with severity, evidence, and copy-paste fixes for each finding.

Find the code that quietly runs up your LLM bill: uncapped generations, model calls looping with no limit, an expensive model doing a trivial job, and whole files stuffed into prompts. Read-only, every finding explained in plain English.

Audit renewal dates, notice deadlines, owners, delivery methods, price escalators, and proof before a SaaS contract window closes.

Turn a raw meeting transcript (.vtt, .srt, .txt, or pasted) into clean markdown meeting minutes: a task table with owners and due dates, the decisions actually made, open questions, and a skim-friendly summary. Separates real commitments from the 'we should probably' suggestions.

Generate a complete pull request description from your staged changes, commits, and branch diff: summary, changes, test plan, and checklist, ready for GitHub, GitLab, or Bitbucket. Cross-checks the file list against what git actually reports, so reviewers get the why and what without hallucinated filenames.

Reconcile RFP addenda with the baseline requirement ledger, acknowledgements, deadlines, and response matrix before owner submission review.

Check a desired handle against every platform's username rules and find the form that works everywhere. Flags handles that break a platform's length limits, use a disallowed character (like a period on YouTube or TikTok), or start with a disallowed character, and recommends the safe consistent form (4 to 15 lowercase alphanumeric). Covers X, Instagram, TikTok, YouTube, Twitch, GitHub, and Bluesky. It checks the rules, not availability.

Audit a draft against your own voice spec and flag every line that breaks your house style. Checks banned words and phrases, em-dashes (when your spec bans them), sentences over your word-count cap, off-spec terms that have a preferred replacement, missing contractions, and forbidden clichés. Config-driven by a voice-spec.json you control, with a sensible default spec if you don't supply one.

Before an agent acts on a plan, verify that the things it named actually exist. Checks each referenced file path, function or method, import or package, environment variable, and CLI command against your repo, and flags the ones that do not resolve. Catches the hallucinated function and the phantom package before the edit, not after the build breaks. Resolves Python and JavaScript/TypeScript.

Check a brand deal or sponsorship contract for the clauses that quietly cost creators: perpetual usage rights, broad exclusivity, free whitelisting, IP assignment, slow pay with no kill fee, unlimited revisions, and vague morals clauses. Plain-English findings. Not legal advice.

Lint a prompt template for the issues that cause injection and flaky output. Flags untrusted variables interpolated straight into the instructions (the injection surface), placeholders that are never provided or never used, contradictory instructions, a missing output-format spec where the result is parsed, unbounded context interpolation, and leftover placeholders. It detects problems; it does not write prompts.

Check your app, site, and ad copy for the AI disclosures US regulators and ad platforms now expect: undisclosed AI chatbots, unlabeled AI-generated media, AI-origin ad copy with no disclosure line, and sponsored content with no material-connection language. Read-only, every finding explained in plain English. US and ad-platform focused.

Save, name, list, and restore git stashes without losing track of what's in them. Auto-labels each stash with its branch, timestamp, and a summary, shows them in a clean numbered list, and warns before you pop into a dirty worktree. No more digging work out of the couch cushions.

Vet dependency changes for supply-chain risk before you install, commit, or release. Scans package and lockfile diffs for install-time lifecycle scripts, non-registry sources, suspicious download commands, typosquatting, and floating versions, across npm, pnpm, yarn, pip, uv, and poetry. Flags what to review with evidence. No install required.

Reconcile SDK, required-reason API, data-use, privacy-manifest, and questionnaire evidence before an App Store release.

Find and repair mobile form friction across keyboards, autofill, validation, focus, recovery, latency, trust, and interruption states.

Replay automation traces against explicit rules for required steps, order, retries, approvals, idempotency, external side effects, duration, and terminal success.

Lint an exported n8n workflow before it ships: catches broken or duplicated nodes, missing error handlers, credential stubs, unhandled retries, unsafe webhooks, brittle expressions, and missing idempotency. A read-only pass over your workflow JSON that ranks production-readiness gaps with evidence and concrete fixes.

Turn a Search Console CSV into ranked no-click, low-CTR, striking-distance, URL-overlap, and comparable-loss review actions without overclaiming the cause.

Audit your SPF, DKIM, and DMARC records for the misconfigurations that get mail rejected or sent to spam. Flags a missing DMARC record or p=none, missing rua reporting, a missing or duplicated SPF record, SPF over the 10-lookup limit, permissive +all/?all, a missing DKIM selector, and SPF/DKIM domain-alignment mismatches. Paste a DNS zone file or dig/nslookup output.

Lint an OpenAPI spec and diff two versions to catch breaking API changes before they reach consumers. Within a spec it flags missing operationId, success responses with no schema, untyped parameters, operations with no security requirement, and unbounded arrays/strings. Across two versions it flags removed paths and operations, removed response codes, a parameter becoming required, narrowed parameter types, removed enum values, and removed response fields. Analyzes JSON specs (convert YAML to JSON first).

Compare incoming security questionnaire answers with an approved library for stale evidence, scope mismatch, dropped citations, and material wording drift.

Scan local SQL, CSV, JSON, seed, fixture, and log files for PII-indicating names plus email-, SSN-, card-, and phone-like values. Get file/line findings with matched values redacted by default—no network, writes, database connection, or compliance claim.

Diagnose broken link previews, repair the metadata and image asset, and produce platform-aware verification without false cache claims.

Audit the decoded text a QR code carries before you print it on something. Flags URLs that are not absolute, link shorteners that hide the real destination, unsafe schemes (javascript:, data:, file:), payloads too long to scan reliably, malformed Wi-Fi or contact payloads, and exposed credentials like a Wi-Fi password or a token sitting in a URL. It audits the decoded payload you paste; it does not read images.

Scan a draft for the tells that make writing read as AI-generated, so you can revise them before publishing. Flags the delve/tapestry/underscore/harness vocabulary cluster, hedging and filler phrases ("it's worth noting," "in today's digital age"), the "not just X, it's Y" antithesis tic, em-dash overuse, rule-of-three pile-ups, unusually uniform sentence cadence, and generic conclusion openers. It marks locations for you to fix; it does not rewrite.

Flag the hidden and look-alike characters lurking in a handle or brand string. Catches zero-width characters, mixed-script look-alikes (a Cyrillic "а" passing as a Latin "a"), right-to-left and bidi override characters, unexpected non-ASCII, and stacked combining marks. These are the spoofing tricks and display bugs you cannot catch by reading.

Verify a final PDF or DOCX for named sensitive terms, hidden text, metadata, comments, revisions, attachments, forms, and embedded content before owner release.

Bulk-update cover images and thumbnails across your Gumroad catalog from a CSV or a folder of files named by permalink. Pre-flight checks validate each image (format, size, corruption) before it hits the Gumroad API, and you get an audit log of every success and failure. No clicking through the dashboard product by product.

Catch the Open Graph and Twitter Card problems that make a shared link preview blank or broken. Flags missing og:title, og:image, og:description, og:url, or twitter:card, a relative og:image URL (crawlers need an absolute one), an SVG og:image (no platform renders it), and image dimensions that miss the 1200x630 standard. Reads your HTML or pasted head markup; it does not fetch the page or refresh a platform's cache.

Inventory every LLM model and provider your code depends on, the AI bill of materials, and flag the dependency risk. It lists each provider, model, and where it's used, then flags hardcoded model ids, single-provider dependency with no alternative, the same model referenced by different ids, model ids with no config or env indirection, and providers pinned in your manifests. Recognizes OpenAI, Anthropic, Google Gemini, and more from an editable list.

Catch the dangerous migration before it locks or wrecks your production database. Scans SQL migration files for destructive and risky operations: DROP and TRUNCATE, drops without IF EXISTS, lossy column-type changes, NOT NULL added without a default, DELETE or UPDATE with no WHERE, non-concurrent index builds, dropped constraints, renames, and data backfills mixed into schema changes. Each finding is ranked by severity with a safer rewrite. Postgres, MySQL, and SQLite.

Map the blast radius of a code change before you run the whole suite. For the files and functions you changed, it lists what imports or calls them, which tests cover them, flags any change with no covering test, and warns when a file has a lot of dependents. It tells an agent what its edit might break instead of making it guess. Resolves Python and JavaScript/TypeScript.

Lint your AGENTS.md (or CLAUDE.md and .cursorrules) for the problems that make a coding agent misbehave. Flags contradictory rules, references to files and commands that no longer exist, overly broad or unsafe instructions, missing sections (build, test, run, conventions), duplicate rules, and the case where you have competing rule files that should be consolidated into one AGENTS.md.

Audit real RAG evidence traces for missing expected sources, impossible citations, unsupported claims, stale evidence, unused context, and weak routing.

Scan local Python, JavaScript, TypeScript, JSX/TSX, HTML, JSON, and .env files for build markers, returned fake-data terms, swallowed errors, placeholders, route-adjacent canned success, and advisory empty handlers. Read-only findings include rule, severity, file, line, and a plain fix.

Audit local dbt SQL and YAML for missing model tests, source freshness and test gaps, likely-key coverage, missing model descriptions, SELECT *, and raw table references. Get severity-ranked findings plus starter tests YAML for model/key gaps without running dbt or querying a warehouse.

Test an AI or rules-based resume screener for outcome changes, score drift, missing evidence, sensitive-term leakage, and human-review gaps.

Find the unit tests that pass without testing anything. Flags tests with no assertions, trivial existence-only checks (toBeDefined, assertIsNotNone), tests that assert the exact value they just mocked, snapshot-only tests, tautological assertions (expect(true).toBe(true)), empty placeholders, and over-mocked tests with more setup than assertions. Works on Jest/Vitest and pytest/unittest.

Catch documentation that drifted from your code. Flags functions and methods named in your docs that are gone from the source, CLI flags documented but missing from the arg parser, env vars the docs mention but the code never reads, example imports of modules that no longer exist, and npm scripts or Make targets your docs reference but the project does not define. Cross-references your README and docs against Python and JS/TS source.

Tie normalized marketplace orders, fees, refunds, reserves, settlement lines, and bank deposits to an explicit payout-period ledger.

Compare two XLSX versions for formulas replaced by values, formula-family drift, broken references, new cycles, and workbook-control changes.

Lint the function-calling tool definitions your agent exposes. Flags tools with no description, parameters missing a description or a type, overlapping or near-duplicate tools, too many tools for reliable selection, an unsafe tool exposed without a guard, required parameters missing from the schema, and free-form parameters that should be bounded with an enum. Cleaner tool schemas mean an agent that picks the right tool.

Preview code-like comment blocks across JavaScript, TypeScript, Python, Java, Go, Rust, HTML, and CSS. Preservation rules run before candidate detection; confirmed cleanups create .bak backups and remove only reviewed ranges.

Check a chargeback case, evidence index, and timeline for reason-specific gaps, broken references, contradictions, and deadline risk before owner review.

Check an invoice or estimate before you send it: missing document number, dates, or payment terms, totals that do not add up, tax gaps, missing remittance details, and slow terms with no late fee. Read-only, plain-English findings. Not accounting advice.

Find likely emailed receipts, separate them from invoices and non-receipts, deduplicate, review, forward, file monthly, and reconcile every outcome.

Pull the real pain points out of your customer feedback so you build what people actually want. Paste a dump of comments, reviews, forum threads, or support tickets and it extracts the complaints, wishes, churn signals, and pricing objections, clusters them into ranked themes, and shows the example quotes behind each one. The "pull ten pains, tag by theme" validation step founders skip, done in one pass.

Generate an llms.txt for your site and validate an existing one against the spec. The generator turns your sitemap.xml or docs folder into a clean, sectioned llms.txt with one-line descriptions. The validator flags a missing H1 title, a missing summary blockquote, malformed link entries, links with no description, relative URLs that should be absolute, and a referenced llms-full.txt that is not present.

Generate a shareable stat card for any repo, with an honest health grade. It reads the file tree and renders a card showing the language mix, file count and size, whether tests, docs, and a license are present, and an A-to-F health grade from a documented rubric. Markdown by default, SVG with a flag. The kind of card people actually post.

Generate a personalized before-you-ship checklist for your app, with the things you already have checked off. Pick your app type (web app, SaaS, store, or content) and it builds a tailored list covering security, legal basics (privacy policy, terms, cookie consent), social preview, payments and refunds, accessibility, analytics, and backups, then scans your repo and pre-checks what is already there. Every item says why it matters in plain English.

Find where knowledge is dangerously concentrated in a codebase. From your git history it flags the files only one person has ever touched, the high-churn files with a single owner, authors who own too much of the codebase, and the repo's overall truck factor. The catchy question with a real answer: what breaks if a key person leaves.

Check freight invoice lines against effective-dated rate rules, shipment facts, and approved accessorial evidence before payment review.

Audit an enriched B2B lead CSV and route every record to SEND_READY, VERIFY_FIRST, or SUPPRESS before outreach begins.

Check your app for the security mistakes that leak data before you launch, explained in plain English. Flags API keys and secrets sitting in your code, a committed .env file, data with no login protecting it, database tables anyone can read, debug mode left on, wide-open sharing (CORS), hardcoded admin passwords, and public storage buckets. Built for non-technical founders shipping AI-built apps: every finding tells you what is wrong, why it matters, and how to fix it.

Audit Agensi skill packages for marketplace readiness, formatting compliance, and safety pre-checks. Grade a skill package before you publish it: SKILL.md frontmatter, credits math, description routing, missing listing sections, and a light command-and-secret safety pre-check, scored 0 to 100 with plain-English fixes.

Create review-ready Gumroad draft products from CSV, upload ZIPs, attach Content-tab files, add covers, and resume safely after interruptions. Duplicate-aware Python + Playwright workflow; nothing publishes without review.

Reconcile product-feed, Merchant Center diagnostic, and landing-page snapshot exports to prioritize the conflicts most likely to block product eligibility.

Audit restore-test evidence against declared RPO, RTO, recency, environment, dependency, smoke-check, and evidence requirements.

Audit and harden GitHub Actions workflows against overbroad permissions, secrets exposure, and supply-chain risks.

Audit a Helm chart for insecure defaults before you deploy to Kubernetes. Flags privileged containers, allowPrivilegeEscalation, missing CPU/memory limits and requests, hostPath volumes, hostNetwork/hostPID/hostIPC sharing, readOnlyRootFilesystem not set, runAsNonRoot not enforced (or runAsUser 0), plaintext secrets in values.yaml, missing NetworkPolicy, and NodePort/LoadBalancer services exposed without restriction.

Scaffold and audit secure MCP servers with input schemas, confirmation gates, and safety-first tool definitions.

Find the LLM integration code that will not survive a provider being pulled or going down. Flags single-provider lock-in with no alternative, calls with no failover branch, missing timeouts, retries with no limit or backoff, no degraded-mode default, and hardcoded endpoints with no alternate. This is about the model going away, not the model declining.

Scan your OpenClaw config for the settings that quietly hand your agent too much power: unrestricted exec, open inbound DMs, secrets committed in config, the deny-write bypass, sandbox turned off, dangerous Docker binds, and elevated tools. Read-only, plain-English findings, grounded in the OpenClaw docs.

Scan a SKILL.md package for prompt injection and secret exfiltration before you install or publish an agent skill. Flags env-variable-to-URL exfiltration wording, conditional triggers with hidden side effects, imperative instructions buried in HTML comments, zero-width characters, base64 and long-token blobs, remote content treated as instructions, pipe-to-shell and recursive force-delete references, and overbroad tool requests (network plus browser plus file-write with no scope).

Audit local Supabase SQL, migrations, policies, storage rules, and client code for RLS gaps, broad policies, service-role leakage, overbroad grants, and tenant-isolation mistakes. Get severity-ranked evidence, proposed fixes, and verification steps without connecting to or changing the live project.