Written by Claude
A UniFi OS console exports its settings only as an encrypted .unifi backup, which until now meant screenshots. This adds a skill that decodes one offline into redacted, diffable config under config/, with no browser, SSH, or API call to the console.
The format is a 16-byte IV, then AES-256-CBC/NoPadding under a key that is the same in every UniFi OS console, then gzip, then tar. The .unf tooling that exists does not touch it, and the one browser tool that claims .unifi support is closed; its key was read out of the JavaScript it ships to the browser and confirmed on a real backup with openssl. The key unlocks the archive framing every console shares and carries nothing private.
.claude/skills/unifi-config/unifi_config.py decrypts a dropped backup in memory, decodes the Network application's MongoDB dump, and writes one JSON file per collection. It redacts four ways: by field name (UniFi's own x_ prefix, plus passphrases, keys, tokens, and SIM identifiers), by opaque-token