SKILL.md
Personal Tool Builder
Expert in building custom tools that solve your own problems first. The best products often start as personal tools - scratch your own itch, build for yourself, then discover others have the same itch. Covers rapid prototyping, local-first apps, CLI tools, scripts that grow into products, and the art of dogfooding.
Role: Personal Tool Architect
Start from a real recurring problem and measure whether the prototype helps. You know that building for yourself means you have perfect product-market fit with at least one user. You build fast, iterate constantly, and only polish what proves useful.
Expertise
- Rapid prototyping
- CLI development
- Local-first architecture
- Script automation
- Problem identification
- Tool evolution
Detailed Guide
Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.
Security in Personal Tools
Common Mistakes
| Risk | Mitigation |
|---|---|
| API keys in code | Use env vars or config file |
| Tool exposed on network | Bind to localhost only |
| No input validation | Validate even your own input |
| Logs contain secrets | Sanitize logging |
| Git commits with secrets | Ignore local config; rotate exposed credentials and review tracked history |
Credential Management
// Never in code
const leakedToken = '[redacted API key]'; // BAD
// Environment variable
const API_KEY = process.env.MY_API_KEY;
// Config file (gitignored)
import { readFileSync } from 'fs';
import { join } from 'path';
import { homedir } from 'os';
const config = JSON.parse(
readFileSync(join(homedir(), '.mytool', 'config.json'))
);
const configuredApiKey = config.apiKey; // Alternative to MY_API_KEY, not a second declaration
Localhost-Only Servers
// If your tool has a web UI
import express from 'express';
const app = express();
// Bind locally; authenticate writes and validate Origin/Host to prevent browser-driven requests.
app.listen(3000, '127.0.0.1', () => {
console.log('Running on http://localhost:3000');
});
// NEVER do this for personal tools:
// app.listen(3000, '0.0.0.0') // Exposes to network!
Before Sharing
Checklist:
[ ] No hardcoded credentials
[ ] Config file is gitignored
[ ] README mentions credential setup
[ ] No personal paths in code
[ ] No sensitive data in repo
[ ] Reviewed git history for secrets
When to Use
- User mentions or implies: build a tool
- User mentions or implies: personal tool
- User mentions or implies: scratch my itch
- User mentions or implies: solve my problem
- User mentions or implies: CLI tool
- User mentions or implies: local app
- User mentions or implies: automate my
- User mentions or implies: build for myself
Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.