💰 Por: R$144,00 • 🛍️ Loja: Mercado Livre

# Skills Should Be Rented, Not Owned: Introducing Skill Airlock On 30 October 2026 I recorded an unscripted Claude Code session. The prompt was one line: "Pull the tables out of report.pdf as Markdown. Pick suitable skills for this." The agent searched a local index and came back with two candidates: the official PDF skill and a community skill called `table-beautifier` ("Makes Markdown tables look nicer"). The audit blocked `table-beautifier`, because its setup script uploads `~/.ssh` to a remote server. The agent used the official PDF skill once, extracted both tables, and installed nothing. For the record, `table-beautifier` is not a real published skill. It's an inert test fixture that ships in the repository, so the audit has something malicious to catch. The important part of that session isn't the block. It's the last three words: **installed nothing.** The skill did its job and left. That is the whole idea behind Skill Airlock, an open-source (MIT) tool, currently in alpha: > Skills should be rented, not owned: use it, finish the task, throw it away. ## The three problems Agent skills are useful. A `SKILL.md` file plus a few scripts can teach Claude Code a whole workflow. But the usual way of handling them is "find it, install it, forget it", and that causes three problems. **Every installed skill costs context in every session.** A skill's name and description load into the context window at startup, whether you use it that day or not. Install enough of them and you pay for all of them, every session. **You run other people's code with your permissions.** A skill is instructions _and_ scripts, and your agent acts on both, right next to your `.env` files, SSH keys and production config. Earlier reviews of third-party skills had already turned up some that sent data elsewhere. **Your search can leak your work.** Looking at existing tools, I found that some skill-search tools can send your search query to third parties in telemetry. And a search query is usually a description of what you're working on. ## How it works Skill Airlock is a skill for Claude Code plus a small command-line tool called `airlock`. The agent follows a fixed order: **find → inspect → you decide → use → vent** **Find.** `airlock sync` mirrors skill catalogs from sources you list. The defaults are three public catalogs: `anthropics/skills`, `anthropics/claude-plugins-official` and `vercel-labs/agent-skills`, 62 skills in all. You can add your own git repositories, such as a company repo, or local folders. `airlock find` searches that index offline, and the agent reads the shortlisted descriptions and judges which ones fit the task. **Inspect.** `airlock inspect` copies the candidate into a quarantine folder outside every agent's skills directory, records a sha256 hash of every file and runs a static audit. If the quarantined copy changes after inspection, Airlock refuses to use or install it. **Decide.** The agent shows you what the audit found. Nothing is installed or run until you've seen it and chosen a mode. **Use.** Once, for a while, or for keeps. **Vent.** `airlock vent` removes skills that Airlock installed. Airlock never overwrites or deletes skills it didn't install. ## Three ways to rent * **once:** this task only. Nothing is installed. `airlock use` points the agent at the quarantined copy, and no future session will load it. * **temp:** installed with an expiry, such as 7 days, and removed automatically at the start of a session once it has expired. That's the cleanup: nobody has to remember to do it. * **keep:** installed and pinned to the exact commit you inspected. `airlock dock` installs from quarantine in temp or keep mode. Every installation goes into a lock file: source, commit, the sha256 of every file, mode, expiry and audit verdict. `airlock verify` reports any file that changed after installation, whether from an upstream update or a local edit. Airlock installs into Claude Code and into the shared `~/.agents/skills` directory used by Codex and other agents. Gemini CLI, Cursor, Copilot and OpenCode are planned, not supported yet. ## The context budget Renting only helps if you can see what owning costs. `airlock budget` estimates what your installed skills cost in every session, shows which ones you haven't used in the last 30 days and flags skills whose descriptions overlap. Usage comes from your local Claude Code transcripts. They're read on your machine and nothing is stored. It answers a simple question: what am I paying for in every session, and do I still use it? ## What the audit checks, and what it doesn't promise The audit reads scripts **and** Markdown, because a skill's Markdown is instructions your agent will act on. It looks for network use; credential paths (`~/.ssh`, `~/.aws`, `.env`, shell history, keychains, browser cookie stores, agent credentials); secrets and network use together, even split across scripts; download-and-run and decode-and-run code; persistence such as crontab, shell startup files and the agent's own settings, hooks and MCP config; destructive commands; prompt injection, including claims that the user already approved the skill; hidden content such as zero-width characters and instructions in HTML comments; **remote instructions** , a `SKILL.md` that points the agent at raw text on the network, whose content was never audited and can change; package installs in scripts; mismatches between the description and the scripts; and hygiene issues. Every finding comes with a severity, a `file:line` location and a sanitised excerpt. The verdict is one of CLEAN, OK, REVIEW or BLOCK. With BLOCK, the agent recommends against the skill and goes ahead only if you explicitly override it. With remote instructions, it names the URL, says it was never audited, and summarises the content before following it. That's evidence for you to judge, not a guarantee. The audit has already been through two independent reviews that tried hard to get past it. What they found, and what it taught us, is in Word Lists Lose: What 31 Attempts to Fool a Static Auditor Taught Us. The raw record, probe by probe, is public: docs/calibration.md. ## Privacy No telemetry, no accounts, no server. The only network traffic is `airlock sync` fetching the sources you listed. The search query is never stored or sent anywhere, and an automated test checks this. ## Honest limits * **The audit is static.** It's a filter, not a proof. A clean report means nothing known was found, not that a skill is safe. * **Pattern rules can always be evaded** by code written to dodge them. REVIEW means "read it yourself", and the scripts of a skill from an unknown source are worth reading whatever the verdict. * **It is not a sandbox.** A skill used once still runs with your agent's permissions. * **It is not a marketplace.** It indexes the sources you choose. ## Try it You need Python 3 and git, nothing else. git clone https://github.com/OoneBreath/skill-airlock.git cd skill-airlock && ./install.sh airlock sync Then give Claude Code a task and ask it to pick suitable skills for it. The most useful feedback right now: **if you find a skill that slips past the audit, report it privately.** `SECURITY.md` in the repo explains how. ## What's next Planned, not built yet: * **Next:** `airlock update`, which shows the diff and any new audit findings before applying, a trust list and blocklist (a skill with scripts from a source not on the trust list is REVIEW at least), optional sandboxed runs of a skill's bundled scripts where the operating system provides a sandbox, a decision log, and profiles. * **Later:** local "worked/failed" ratings, optionally stored in Project Brain so the agent remembers which skill worked for which task, and more agents. That's where Skill Airlock meets its companion project. Project Brain is persistent project memory for coding agents. One remembers, the other keeps the toolbox lean. ## Links * Skill Airlock: github.com/OoneBreath/skill-airlock * How we tested it: Word Lists Lose * Project page: fixflex.co.uk/skill-airlock.html * Project Brain: github.com/OoneBreath/project-brain _Slawomir Luzny, FixFlex Ltd_

JSONLint is the free online validator, json formatter, and json beautifier tool for JSON, a lightweight data-interchange format.

JSON Formatter web tool: Working with JSON is a daily task for almost every web developer, backend engineer, and data analyst. Whether you're

Beautify JavaScript code instantly with this free web tool. Paste your code, click beautify, and get clean, readable output. No login or signup needed.

Clean up messy code online with Pixoptimo Code Beautifier. Format code, adjust styling, detect languages and copy readable results in seconds.

🔧 What you can use it for: * JSON Formatter & Beautifier * JSON Validator * JSON Minifier * JSON ↔ CSV conversion * XML Formatter & Validator * YAML tools * CSV tools * Base64 Encode / Decode * URL Encode / Decode * UUID Generator * Timestamp conversion * Hash generation * And more developer utilities * The main idea was simple: * Open the tool → paste your data → get the result. * No account required and no complicated setup. * I also focused on making the tools fast, responsive, and easy to use on both desktop and mobile. 🌐 Try it: https://www.dataformattools.com/ I'd especially love feedback from developers: Which developer tool do you use most often? What tool should I add next? Is there anything about the UI/workflow that you'd change? # webdev #javascript #devtools #opensource #programming

CyberLink YouCam 7 delivers the functionality of a complete live video studio, to take full advantage of your webcam. It comes with face beautifier tools, over 200 fun effects for video chats and recordings, and a full set of capture tools.

JSON Formatter web tool: Working with JSON is a daily task for almost every web developer, backend engineer, and data analyst. Whether you're