Nenad Zivotic

Amazon listing policy screen — scans a product listing's title, bullets and description before publishing for the violations Amazon suppresses or suspends for: promo/pricing/shipping references in cop

RFP-to-compliance-matrix extraction — parses a request-for-proposal/bid document into the matrix a bid manager builds by hand: every shall/must requirement with section, mandatory-vs-desirable priorit

Job posting compliance and bias screen — scans job ads before publishing for language that creates legal exposure or shrinks the applicant pool: explicit discriminatory terms (age, sex, disability, na

GDPR Art. 28 completeness screen for Data Processing Agreements — scans a DPA (or processor contract) for the mandatory clauses every controller/processor agreement needs: documented-instructions proc

AI-search visibility audit: can ChatGPT, Perplexity, Claude and Google AI crawlers reach, parse and cite your site — plus a repeatable 12-prompt x 5-engine citation test suite.

Fair-housing language audit for real-estate listing copy — banned-phrase screen with compliant rewrites.

Weekly PPC search-terms audit: wasted spend, n-gram root causes, safe negative keywords, uncovered winners.

Controller-style month-end close exception report from a trial balance CSV and journal export.

Offline contract risk triage for freelancers — flags IP grabs, uncapped liability, non-competes and payment traps in an NDA/MSA/SOW. The contract text never leaves your machine.

Contract Triage — NDA/MSA risk check before you sign

by Nenad Zivotic

$29

A client sent you a contract. Paste the text, get a clause-by-clause risk report with suggested pushback — fully offline, so the document never leaves your machine.

Eight release-safety skills in one package: credential leak scanning, Dockerfile & CI/CD linting, JWT inspection, env config audit, git history leaks, DNS email security, CORS misconfig checks.

Pick the best short-clip timestamps from a video transcript (SRT/VTT or plain text with timestamps) — scores segments by hook potential and returns ranked clip windows. Local text analysis, no ffmpeg.

Lint a single GitHub Actions workflow file for the top supply-chain risks — unpinned actions, pull_request_target, secrets echoed in run steps, overly broad permissions. Local file only. Use when the

Extract all links from a saved HTML file and classify them — internal/external, anchors, mailto/tel, protocol-relative — plus flag obvious breakage signals (empty href, #, javascript:). Offline, no fe

Analyze pasted CORS response headers for dangerous combos — reflected origin with credentials, wildcard with credentials, null origin accepted, broad exposed headers. Offline, no probing. Use when the

Audit pasted HTTP response headers for missing security headers — HSTS, CSP, X-Frame-Options/frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags. Offline, no fet

Scan a diff or patch for accidentally committed secrets — API keys, tokens, private keys, passwords — in added lines only, values masked. Local text scan, zero network. Use before committing or when r

Compare .env against .env.example — missing keys, extra keys, and empty values on required-looking vars. Local files only, values never printed. Use when the user asks why an app fails on missing env

Turn a DevTools .har capture into an endpoint inventory — API requests grouped by host/method/normalized path with counts and status codes. Local parse only, nothing executed. Use when the user shares

Statically lint a Dockerfile for the most common security mistakes — untagged/latest base image, missing USER, secrets baked into ENV/ARG, curl|sh installs, remote ADD. Local files only, zero network.

Decode a JWT locally and print header/payload with sensitive values masked — plus expiry status. Decode-only, zero network. Use when the user asks to look inside or debug a JWT/bearer token quickly.

Keyword list -> complete deployable Next.js programmatic-SEO calculator site. Emits the whole app as a file map: vertical pages, working calculators, sitemap, FAQ schema. Zero deps.

Generate a minimal 2-touch cold outreach skeleton (opener + polite breakup) from an ICP + pain points input — subject-line options, skeleton copy, CTA, and spam-trigger/subject-length checks. Use when the user asks to write cold outreach or a simple drip email.

Turn a plain-language task description into a minimal prompt template — extracts {{variable}} placeholders, detects output format, assembles a ROLE/TASK/INPUT/CONSTRAINTS/OUTPUT scaffold. Use when the user asks to write or templatize a prompt for an LLM.

Quick health check on an npm package before installing — latest version, days since last publish, deprecation flag, license, and a stale/deprecated heuristic. One unauthenticated registry request. Use when the user asks if an npm package is maintained or safe to add.

Quick health check on a public GitHub repo before depending on it — stars, days since last push, license, archived flag, and a health heuristic. Single unauthenticated API call. Use when the user asks whether a GitHub repo is maintained, trustworthy, or safe to adopt.

Offline on-page SEO audit of a local HTML file — title and meta description quality, canonical, robots meta, viewport, Open Graph tags, h1 structure, image alt coverage, lang/charset. Zero network access. Use when the user asks to check a page's SEO basics from saved HTML or a template file.

Video Repurpose Engine

by Nenad Zivotic

$29

Long-form transcript -> ranked clip windows, looped-arc scripts, SRT captions, ffmpeg 9:16 cut commands. Zero deps.

47 outdated deps. Which first? Patch, minor, then major — sorted.

Spec Parity Check

by Nenad Zivotic

$9

Your OpenAPI spec and your Express code are lying about each other.

Your README links to a doc that was deleted two releases ago.

Your MIT project is shipping a GPL dep. Find out before legal does.

GitHub Repo Due Diligence

by Nenad Zivotic

$7

Before you npm install, check if the repo's actually alive.

npm Package Health

by Nenad Zivotic

$7

Should I depend on this package? Registry stats answer in one shot.

Your sales data says what to build next. Read it.

That prompt that worked perfectly last Tuesday? You have it saved.

Patch, minor, or major? Reads your commits and decides.

Context Budget Guide

by Nenad Zivotic

$9

Which files should I actually paste into the agent? This ranks them.

Point an agent at ~/repos and it picks the right project, first try.

Your AGENTS.md is 800 lines of contradictions — agents ignore half of it.

Why won't my MCP server connect? Usually a config typo — this finds it.

Catch the reason a marketplace will reject your skill before you submit it.

Will this post fit on X, LinkedIn, and Threads — and what gets cut?

Turn a wall of '- chore: bump deps' into the 3 things users actually care about.

Translate a README without mangling the code blocks and links.

Dump raw notes → get decisions, action items with owners, open questions.

Blog post → numbered X/Twitter thread, split at sentence boundaries under 280 chars.

Overlapping cues and 2-frame durations — lint them and fix them.

Timestamped transcript in — paste-ready YouTube chapters out.

Commits → changelog + a store-length 'What's New' blurb, automatically.

Why is the app 120MB? One command shows which files and categories own the bytes.

Universal links on iOS but missing on Android? Catches deep-link config mismatches.

Declared but unused? Used but undeclared? Cross-check app permissions against the code.

Store listing text that actually fits — iOS/Android field limits + spam-signal lint.

EAS build failed? Paste the error → likely cause and the fix.

Five timestamp formats in one CSV column — normalize them all to ISO 8601, flag the ambiguous ones.

Does this pattern actually match? Matches + groups + replace preview, plus a token explainer — all local.

Your diacritics turned into Äšž — scan for mojibake across files and repair it.

Two spreadsheets, different headers — proposed column mapping with confidence scores.

Config-shaped YAML to JSON and back — zero deps, honest about what it cannot parse.

Heading tree, paste-ready TOC, and structure lint (skipped levels, missing H1) for any markdown file.

What did your nginx log actually say? Status breakdown, top paths, top IPs, error rate — one command.

Dev copies of prod data without real emails/phones — deterministic masking keeps joins valid.

Nested JSON ↔ flat dot-notation, plus a leaf-structure diff between two documents.

CSV in, clean typed JSON out — array, keyed object, or JSONL. Auto type inference for numbers/booleans/nulls.

Two versions of the same export — which rows moved, and did the schema break? Keyed row diff + column-level breaking detection.

Find the commit that broke it in ~7 tests instead of 100 — bisect range planner, automated `git bisect run` wrapper, state decoder.

Legacy .eslintrc → flat config skeleton — packages to install, directive mappings, to-do list for edge cases.

a imports b, b imports a — the silent killer of Node ESM and bundler tree-shaking. Finds every cycle in your import graph.

Find the 50MB blob you committed two years ago — working tree scan plus git history so deleted-but-still-in-.git files show up.

Which of your 47 branches can go? Merged + stale branches split into safe-to-delete and probably-stale. Never deletes.

New repo or old mess? Checks README/LICENSE/.gitignore/CI/lockfile — and flags a committed .env before it leaks.

Is your README missing the install section? The license? Balanced code fences? One command finds out.

The tsconfig footguns everyone hits — strict off, module/moduleResolution mismatched, paths without baseUrl. Audits + fixes.

Paste sample data, get a JSON Schema — array items merged, required = fields present everywhere, format hints.

Old spec vs new spec → is it a breaking change? Classifies every endpoint/param/field change as breaking or additive.

Which modules does nothing import? Static import-graph scan → unreferenced module candidates, entry points excluded.

All TODO/FIXME/HACK comments in one sorted list — with git-blame age, so you see which 'temporary' fixes are years old.

Git history already knows who owns what — generates per-directory CODEOWNERS rules from commit dominance.

Which source files have no test? Convention-matched scan, barrels filtered out, JSON + CI exit code.

Conventional-commit lint without commitizen — --msg, --file hook, or --log history. JSON output, exit code for CI.

git diff → structured PR skeleton — grouped changes, commits, test plan flagging missing tests, smart checklist.

One command installs a git pre-commit hook that blocks commits containing AWS/GitHub/Slack/Stripe keys — prints file:line, never the secret.

Local webhook receiver — JSON-lines dump of every request plus optional sha256 HMAC signature verification.

RSS Generator

by Nenad Zivotic

$9

Turn your site's index page into a valid RSS 2.0 feed — link discovery, title/date/description per post, sorted output.

Static a11y lint for a page you own — lang, alt, labels, heading order, tabindex, keyboard traps, autoplay. JSON + CI exit code.

Favicon + PWA manifest audit — icon links, apple-touch-icon, manifest JSON validity, required 192/512 icons, theme colors. Three requests.

See what your link preview will look like — missing og:image, weak titles, relative URLs — before you share the link.

Find the http:// scripts and images browsers are silently blocking on your HTTPS pages — active vs passive split, JSON report.

A 5-second answer to 'is this page heavy?' — TTFB, payload weight, compression, slowest assets. JSON + CI exit code, no Lighthouse needed.

Diff two sitemaps — added/removed URLs with migration detection, and a CI gate for accidentally dropped pages.

Point it at your site, get a sitemap.xml — bounded same-origin crawl, deduped URLs, one command.

Three handshakes show whether your WS endpoint accepts foreign origins (CSWSH risk) and whether you're on unencrypted ws://.

Three probes reveal whether your API answers foreign origins — reflected origins, wildcard+credentials, dangerous preflights. JSON + CI gate.

One GET audits HSTS, CSP, clickjacking protection, MIME sniffing, referrer & permissions policy — JSON findings with the exact header to add.

cold email sequence

by Nenad Zivotic

$6

Generate a 4-touch cold outreach sequence skeleton from an ICP + pain points input — per-touch send day, goal, subject-line options, skeleton copy, and CTA — with deliverability checks (subject length, spam-trigger words, missing personalization). Use when the user asks to write cold emails or a dri

Probe ~40 well-known admin, debug and backup paths on your own site; JSON report of what's publicly reachable, with fixes.

Bounded same-origin crawler: finds internal 404s and dead outbound links, with the pages that link to each. JSON + CI exit code.

Trace a URL's redirect chain hop-by-hop — loop detection, HTTPS downgrade alerts, long chains, bad final statuses. JSON + CI exit code.

meta prompt architect

by Nenad Zivotic

$9

Turn a plain-language task description into a production prompt template — extracts {{variable}} placeholders, detects output format/tone/audience, assembles a ROLE/TASK/INPUT/CONSTRAINTS/OUTPUT/EDGE-CASES scaffold with injection-resistance rules, and emits test-case stubs. Use when the user asks to

Offline audit of an Etsy listing — title length and keyword front-loading, all-13 tag slots usage, tag format rules (20-char limit, multi-word, no duplicates), description opening and structure, photo/video coverage, focus-keyword coverage across title+tags. Emits a 0-100 score and JSON findings. Us

Paste raw email headers or an .eml — get SPF/DKIM/DMARC verdicts, the Received hop chain, and spoofing signals as JSON. Fully offline.

TLS certificate health check for a hostname you own — days-to-expiry, issuer, SANs, chain trust, protocol. JSON + CI exit code.

Audit Set-Cookie security flags (Secure, HttpOnly, SameSite, Domain, expiry) on a URL you own — JSON findings with fixes.

Generate a Keep-a-Changelog section from conventional-commit git history — groups commits into Added/Fixed/Changed/etc., surfaces BREAKING CHANGES, supports version and tag ranges, and inserts into an existing CHANGELOG.md without duplicating sections. Use when the user asks to write a changelog or

seo quick audit

by Nenad Zivotic

$12

On-page SEO audit for a single user-supplied URL — title and meta description quality, canonical, robots meta, viewport, Open Graph/Twitter cards, h1 structure, image alt coverage, lang/charset, plus robots.txt and sitemap.xml status. Use when the user asks to check a page's SEO or why a page isn't

dependency drift audit

by Nenad Zivotic

$15

Offline audit of a Node project's dependencies — flags git/URL (unpinned) dependencies, install scripts, typosquat-similar names, duplicate locked versions, and stale lockfile entries. Reads only package.json and lockfiles; no network calls, no CVE database. Use when the user asks to review, audit,

Audit GitHub Actions workflows for the classic supply-chain and privilege-escalation mistakes: unpinned uses: refs, pull_request_target abuse, script injection via ${{ github.event.* }}, missing or over-broad permissions, PR-head checkouts, and secrets echoed in run lines.

Scan a repo's full git history for credentials committed at any point — masked findings grouped by revision, plus a rotate-first purge workflow (filter-repo/BFG, force-push fallout, collaborator notification).

Statically lint Dockerfiles and docker-compose files for common security mistakes — mutable or untagged base images, missing USER directive, secrets baked into ENV/ARG/environment, curl|sh installs, remote ADD, privileged containers, host networking, 0.0.0.0 port bindings, docker.sock mounts, and da

Decode and statically inspect JWTs for alg=none, algorithm-confusion risk, hostile kid headers, expiry problems, and sensitive claims — decode-only, masked JSON report.

Audit a project directory for dotenv configuration hygiene — .env files not covered by .gitignore rules, placeholder or weak values, duplicate keys, .env.example/.env parity drift, and env files sitting in src/ or public/ folders. Reports key names only — env values are never emitted. Use when the u

Free static scanner for leaked credentials in your project — AWS keys, GitHub PATs, Slack tokens, private-key blocks. Masked fingerprints only.

Lockfile Diff + SBOM

by Nenad Zivotic

$19

Diff lockfiles and generate CycloneDX-lite SBOMs to identify major bumps, install scripts, and git dependency risks.

HAR to API Map

by Nenad Zivotic

$19

Convert browser .har captures into structured API maps, JSON schemas, and integration docs without leaking credentials.

Sourcemap & Env Leak Check

by Nenad Zivotic

$15

Audit websites for exposed source maps, .env files, Git metadata, and missing security headers.

DNS Email Security Check

by Nenad Zivotic

$15

Audit SPF, DMARC, and DKIM records to fix email deliverability and prevent domain spoofing.

Secret Leak Scan

by Nenad Zivotic

$12

Statically scan directories and .asar archives for leaked API keys, tokens, and private keys before deployment.