password policy checker

Grade a password policy against NIST SP 800-63B-4 and rewrite it from handbook text, Linux PAM or Windows net accounts.

Grade a password policy against NIST SP 800-63B-4 and rewrite it. Reads a written policy (handbook text), Linux pwquality.conf / login.defs, Windows "net accounts" output or a JSON settings file, flags SHALL/SHOULD violations (length, composition rules, forced expiry, blocklist, hints, security questions, lockout, password managers) and drafts compliant policy text. Use when someone asks "is our password policy good?", "do we still need 90-day password changes?" or "what does NIST say about passwords?".

What it does

• Runs entirely offline in standard-library Python (no network, no credentials, writes only inside the working folder).
• Ships with examples, unit tests (run on Python 3.8 / 3.9 / 3.13) and a references/sources.md citing the official specs used.
• Exit codes: 0 = clean / aligned, 1 = findings, 2 = bad input — ready for CI and agent loops.

Who it's for

Security-minded developers, MSPs, small-business IT, compliance leads and IR analysts who want a repeatable offline check their agent can run.

Not legal advice / limits

See the skill's references/sources.md and Known Limitations below. Compliance-flavored output is a draft for counsel, not a certification.