Skip to content

Instantly share code, notes, and snippets.

@nguerrera

nguerrera/SamplePR.md

Last active August 24, 2026 15:49
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save nguerrera/b0ae9687b01702ebe1fccde893f2f947 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save nguerrera/b0ae9687b01702ebe1fccde893f2f947 to your computer and use it in GitHub Desktop.
Download ZIP
AI PR description sample
Raw
SamplePR.md

Written by Claude

A UniFi OS console exports its settings only as an encrypted .unifi backup, which until now meant screenshots. This adds a skill that decodes one offline into redacted, diffable config under config/, with no browser, SSH, or API call to the console.

The format is a 16-byte IV, then AES-256-CBC/NoPadding under a key that is the same in every UniFi OS console, then gzip, then tar. The .unf tooling that exists does not touch it, and the one browser tool that claims .unifi support is closed; its key was read out of the JavaScript it ships to the browser and confirmed on a real backup with openssl. The key unlocks the archive framing every console shares and carries nothing private.

.claude/skills/unifi-config/unifi_config.py decrypts a dropped backup in memory, decodes the Network application's MongoDB dump, and writes one JSON file per collection. It redacts four ways: by field name (UniFi's own x_ prefix, plus passphrases, keys, tokens, and SIM identifiers), by opaque-token shape so an unnamed secret in a future field still goes, by dropping an embedded configuration dump whole rather than reaching into it, and past a content-pattern audit that catches a credential written into a value's own text. A field-level pass alone missed a diagnostics_config blob that carried every wireless secret and the admin password hash in one string; that case is what the embedded-dump and content-audit rules exist for. Kept are the readable settings and the record ids that join one collection to another. Output is sorted so a regenerate with no real change produces no diff.

Two kinds of collection are decoded but written to no file: runtime telemetry that churns every backup, and account, identity, and client-tracking records that carry names, an email, and device nicknames the config snapshot has no use for. What lands is network settings alone.

The skill's own review is the half a deterministic tool cannot do: read the decoded output and the audit both ways -- a secret the tool kept, and an opaque value it kept for no reason -- and heal the rules, biased toward redaction. The decoded config is committed so a configuration change that broke something days before it was noticed shows up as a commit.

Changes:

  • .claude/skills/unifi-config/ -- the skill and its tested decoder (38 in-file tests).
  • config/ -- a new top level for redacted device configuration, with config/unifi/ holding the decoded Network settings and a README at each level.
  • .gitignore -- *.unf and *.unifi, so a backup never lands.
  • AGENTS.CUSTOM.md, CLAUDE.CUSTOM.md -- the config/ directory and the skill registered.

Gate green: no dead links, 237 snippet tests pass.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment