Skill: spalgorithm/lesecurelocal (version 1.0.3)

--- name: LESecureLocal description: LESecure Local/On-Prem — encrypt and decrypt data, files, and folders using the LE desktop tool with layered locks (pin, password, MFA, time lock, geo-location). triggers: - LESecure Local - LESecure Desktop - LESecure On-Prem - LE local - LE desktop - encrypt file - decrypt file - encrypt folder - decrypt folder - what's my current location - what is my current location - whereami - where am i - current location --- # LESecureLocal — LESecure Local / On-Prem Skills Encrypt and decrypt **plain text, files, and folders** using the LE desktop binary. No API key is needed — everything runs locally. No data leaves your machine. ## Project Links | Resource | URL | |---|---| | Source code & documentation | <https://github.com/SPAlgorithm/LE> | | Cloud alternative | LESecureCl skill (uses the LESecure API) | ## ROUTING RULES (MANDATORY) - **Files and folders MUST always use LESecure Local.** Never use LESecure Cloud for file/folder encryption. If the user asks to encrypt files/folders via cloud, inform them: "File/folder encryption is only supported via LESecure Local (desktop)." and use this skill. - **Safe-by-default flags for files/folders.** Always pass `-z` (force overwrite) and — when the target is a directory — `-n` (recursive). **Never pass `-c` (clean/delete source) or `-j` (trio = `-z -c -n`) without explicit user confirmation**, because both delete the original file after encrypting. See the "Destructive Flags" rules below. - **For plain text**, ask the user: "Would you like to use **LESecure Cloud** (API) or **LESecure Local** (desktop)?" and proceed accordingly. - **Current location queries** — when the user asks "what's my current location", "whereami", "where am I", or any equivalent, run `LE -7` and share the output. No other flags are needed. **Note:** `LE -7` accesses device GPS — this is a privacy-sensitive operation. On first use in a session, inform the user: "This will query your device's GPS location via LE." Proceed only after acknowledgment. ## Destructive Flags — `-c` and `-j` (MANDATORY) - `-c` (clean) **deletes the source file after encryption or decryption**. It is irreversible in-place data loss. - `-j` is a trio that **includes `-c`**, so it is also destructive. - Never silently add `-c` or `-j`. Before using either, ask the user explicitly, e.g.: "This will delete the source `<file>` after the operation. Confirm with 'yes, delete source' to proceed." - If the user does not confirm, use only `-z` (and `-n` for folders). The source stays on disk. - When the user explicitly asks for `-j` or "clean/delete source after", use `-j` and state in the response that the source was removed. ## Binary Location (configuration) The skill looks for the `LE` binary in this order: 1. The `LE_BIN` environment variable, if set (e.g., `export LE_BIN=/opt/le/LE`). 2. `LE` on `PATH` (via `command -v LE`). 3. A user-supplied path if neither of the above resolves. In that case, **ask the user** for the binary path — do not guess or hardcode. In examples below, `LE` is used as a shorthand for whichever path resolves. When actually invoking, expand it to the full resolved path so the command is reproducible. ```bash # Resolve once, then reuse LE_BIN="${LE_BIN:-$(command -v LE)}" "$LE_BIN" --help ``` ## Date & Time Rules (MANDATORY) All date/time handling for this skill follows these rules — no exceptions: 1. **Always use EST/EDT (America/New_York)** to calculate and send dates. The LE tool interprets `-l` and `-r` in EST/EDT. 2. **Start time (`-l`) = current EST + 2 minutes** by default. This buffer prevents the "date must be in future" error. 3. **End time (`-r`) = start time + the user's requested duration**. 4. **Cross-platform time computation.** Prefer Python because `date` flag syntax differs between BSD (macOS) and GNU (Linux). Python 3 is available on both. **Input safety:** The `<N>` duration value is passed as `sys.argv[1]` and cast via `int()` inside the Python script — any non-integer input raises `ValueError` and the script exits without executing. **Never concatenate or interpolate user input directly into the `python3 -c` string.** Always pass values as positional arguments (`sys.argv`). ```bash # Start time (now + 2 minutes, EDT/EST) — no user input needed python3 -c "from datetime import datetime,timedelta; from zoneinfo import ZoneInfo; print((datetime.now(ZoneInfo('America/New_York'))+timedelta(minutes=2)).strftime('%Y/%m/%d %H:%M'))" # End time (now + 2 min + N minutes) — N is passed as argv[1], cast to int() python3 -c "import sys; from datetime import datetime,timedelta; from zoneinfo import ZoneInfo; N=int(sys.argv[1]); print((datetime.now(ZoneInfo('America/New_York'))+timedelta(minutes=2+N)).strftime('%Y/%m/%d %H:%M'))" <N> # End time (now + 2 min + N hours) — N is passed as argv[1], cast to int() python3 -c "import sys; from datetime import datetime,timedelta; from zoneinfo import ZoneInfo; N=int(sys.argv[1]); print((datetime.now(ZoneInfo('America/New_York'))+timedelta(minutes=2,hours=N)).strftime('%Y/%m/%d %H:%M'))" <N> ``` Fallback (`date`) — only if Python is unavailable: - macOS/BSD: `TZ=America/New_York date -v+2M "+%Y/%m/%d %H:%M"` - Linux/GNU: `TZ=America/New_York date -d '+2 minutes' "+%Y/%m/%d %H:%M"` 5. **Always display the window back to the user in EDT/EST**. ## Two Modes ### 1. PlainText Mode (`--PlainText` / `-p`) Encrypt/decrypt inline strings. The LE binary expects the data wrapped in triple single quotes (`'''...'''`). #### Input Sanitization (MANDATORY) **Never interpolate raw user input directly into the shell command.** The `'''...'''` quoting breaks if the data contains single quotes, enabling shell injection. Before building the command: 1. **Validate:** reject or escape any single quotes (`'`) in the user's plaintext. Replace each `'` with `'\''` (end quote, escaped literal quote, reopen quote). 2. **Alternatively, use a shell variable** to isolate user data from the command string: ```bash # Store user data in a variable — shell expansion is safe inside triple quotes LEDATA='user provided text here' LE -e "'''${LEDATA}'''" <LOCK_FLAGS> --PlainText ``` 3. **Never use `eval`** or backtick interpolation with user-supplied text. ```bash # Encrypt (with sanitized data) LE -e '''<SANITIZED_DATA>''' <LOCK_FLAGS> --PlainText # Decrypt (encrypted output is safe — no special chars) LE -d '''<ENCRYPTED_DATA>''' <LOCK_FLAGS> --PlainText ``` ### 2. File / Folder Mode Default flags (safe): - **File:** `-z` - **Folder:** `-z -n` Destructive extras (only with explicit user confirmation, see rules above): add `-c` to also delete the source, or use `-j` (= `-z -c -n`). ```bash # Safe file encrypt / decrypt (source file preserved) LE -e <FILE> <LOCK_FLAGS> -z LE -d <FILE.letxt> <LOCK_FLAGS> -z # Safe folder encrypt / decrypt (source folder preserved) LE -e <FOLDER> <LOCK_FLAGS> -z -n LE -d <FOLDER> <LOCK_FLAGS> -z -n # Destructive — only after explicit user confirmation LE -e <FILE_OR_FOLDER> <LOCK_FLAGS> -j ``` **Naming notes:** - Encrypted files get a `.le` prefix on the extension (e.g., `example.txt` becomes `example.letxt`); use the `.letxt` filename when decrypting. - For folders, the individual files inside get the `.le` prefix on their extensions. The folder name itself stays the same. ## Available Locks | Flag | Lock Type | Value | Example | |------|-----------|-------|---------| | `-1` | Pin/Code | Numeric string | `"1122"` | | `-w` | Password | Password file (`.letxt`) or passphrase | `pass.letxt` | | `-2` | MFA | Phone number (E.164) | `"+19199870623"` | | `-3` | OTP | OTP code for decryption | `"123456"` | | `-l` | Time lock start | `YYYY/MM/DD HH:MM` | `"2026/04/12 17:41"` | | `-r` | Time lock end | `YYYY/MM/DD HH:MM` | `"2027/04/12 17:36"` | | `-b` | Location lock — use existing `.lecsv` key file (**encrypt only**; omit on decrypt) | Path to `.lecsv` file | `location.lecsv` | | `-v` | Location lock — create a new `.lecsv` key file from a GPS CSV (switch, no value) | (no value) | `-v` | ### Additional Flags | Flag | Purpose | Safety | |------|---------|--------| | `-z` | Force — overwrite existing encrypted file | Safe | | `-n` | Recursive — process folders recursively | Safe | | `-c` | Clean — **delete source after encrypt/decrypt** | DESTRUCTIVE — opt-in with confirmation | | `-j` | Trio = `-z -c -n` — **includes delete-source** | DESTRUCTIVE — opt-in with confirmation | | `-i` | Get info on an encrypted file | Safe (read only) | | `-o` | Specify output file name | Safe | | `-7` | Print the device's current GPS location (no other flags needed) | PRIVACY-SENSITIVE — requires user consent on first use | ## MFA Workflow 1. **Encrypt with MFA**: Use `-2 "+1XXXXXXXXXX"` to register the phone number. 2. **Decrypt with MFA**: First run decrypt with `-4 <encrypted_file>` to trigger OTP delivery, then run again with `-3 <OTP_CODE>`. ## Examples ### PlainText — Pin only ```bash LE -e '''hello world''' -1 "1234" --PlainText LE -d '''<ENCRYPTED>''' -1 "1234" --PlainText ``` ### PlainText — All locks ```bash LE -e '''secret data''' -w pass.letxt -1 "1122" -2 "+19199870623" -l "2026/04/12 17:41" -r "2027/04/12 17:36" --PlainText ``` ### File — Pin only (safe, source preserved) ```bash LE -e /path/to/myfile.txt -1 "1234" -z LE -d /path/to/myfile.letxt -1 "1234" -z ``` ### Folder — Pin + Password (safe, sources preserved) ```bash LE -e /path/to/my_folder -w pass.letxt -1 "1234" -z -n LE -d /path/to/my_folder -w pass.letxt -1 "1234" -z -n ``` ### File — destructive (user asked to delete source) ```bash # Only after explicit user confirmation LE -e /path/to/myfile.txt -1 "1234" -j ``` ### Get info on encrypted file ```bash LE -i /path/to/myfile.letxt ``` ### Get current device location Requires user consent on first use in a session (privacy-sensitive — accesses device GPS). ```bash LE -7 ``` ## Workflow 1. **Determine the mode:** PlainText (`--PlainText`) for inline strings, or File/Folder for files and directories. 2. **Resolve the binary** via `$LE_BIN`, `command -v LE`, or ask the user. 3. **Gather lock inputs:** Which locks to apply and their values. 4. **Pick safe defaults:** `-z` for files; `-z -n` for folders. Do not add `-c` or `-j` unless the user explicitly confirmed source deletion. 5. **Build the command** with the appropriate flags. 6. **Execute via Bash** and return the result. 7. **For decryption**, remind the user they need the same lock values used during encryption. ## Important Notes - No API key is needed — LE runs entirely locally. - Phone numbers for MFA (`-2`) must be in E.164 format. - Time lock dates use `YYYY/MM/DD HH:MM` format. Follow the Date & Time Rules above. - Time locks require both `-l` (start) and `-r` (end). - The password file (`.letxt`) should be an encrypted password file created with `LE -e pass.txt -q`. - Geo-location locks work in two stages: **create a key file once**, then **reuse it** to lock as many files/folders as you want. **Stage 1 — Create the `.lecsv` key file from a GPS CSV (`-v`):** - Input: a plain CSV of GPS locations with distance (e.g., `location.csv`). - `-v` is a switch (no value); LE produces `location.lecsv` alongside the input. - MUST be paired with `-1` (pin) or `-2` (MFA) — otherwise LE errors with "Either Pin or MFA should be enabled for Password/Location file". ```bash LE -e location.csv -v -1 1122 -z LE -e location.csv -v -2 "+1YourPhoneNumber" -z ``` **Stage 2 — Use the `.lecsv` key file to lock files/folders (`-b`):** - `-b <path.lecsv>` is used **only on encryption**. - **On decryption, do NOT pass `-b`** — LE reads the embedded location reference from the encrypted file itself. Just run `LE -d <file> -z`. - No pin/MFA pairing required — the key file is self-contained. ```bash # Encrypt (pass -b with the key file) LE -e example.txt -b location.lecsv -z # Decrypt (do NOT pass -b) LE -d example.letxt -z ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)