---
name: eleven-dz-tools
description: "Opt-in client for the 11DZ Tools API v0.2.0, covering deterministic JSON, encoding, text, integer, byte, chmod, IEEE 754, SHA-2, unverified JWT, and UTC time operations. Use only when the user explicitly invokes $eleven-dz-tools or explicitly asks an AI coding agent to send data to the remote 11DZ Tools API. Do not use for local-only work, general writing or research, signing or JWT verification, password hashing, secret handling, or file and media processing."
---

# 11DZ Tools

Use the public 11DZ Tools REST API for deterministic transformations. Treat the Skill as remote, opt-in processing: do not call it merely because a task resembles one of its operations.

This Skill targets API release `0.2.0`; the stable REST prefix remains `/v1`.

## Select an operation

Read only the reference needed for the request:

- Read `references/json.md` for JSON formatting, validation, minification, key sorting, structural diffing, and string escaping.
- Read `references/encoding.md` for Base64, URL, query parameter, and Unicode escape codecs.
- Read `references/text.md` for cleaning, unique/sorted lines, line diffing, splitting, merging, reversing, counting, and case conversion.
- Read `references/developer.md` for integer bases, byte inspection, chmod, IEEE 754, SHA-2, unverified JWT inspection, and UTC time conversion.
- Read `references/workflows.md` when several operations must be chained.
- Read `references/api-overview.md` for all 30 paths, the response envelope, and failure handling.
- Always apply `references/privacy.md` before sending user content.

Do not use this Skill for general knowledge, research, prose writing, cryptographic signing, signature verification, password hashing, secret storage, or file, image, audio, video, and PDF operations.

## Call the API

Require Node.js 18 or newer. Resolve `SKILL_DIR` to the absolute directory containing this loaded `SKILL.md`; never assume a Codex-, Cursor-, Claude-, user-, or project-specific installation path.

Prefer the bundled client so request bodies enter through stdin or a file instead of a shell argument:

```bash
SKILL_DIR="/absolute/path/to/eleven-dz-tools"
printf '%s\n' '{"input":"{\"name\":\"11DZ\"}","indent":2}' \
  | node "$SKILL_DIR/scripts/call-api.mjs" /v1/json/format
```

For a file:

```bash
node "$SKILL_DIR/scripts/call-api.mjs" \
  /v1/crypto/hash --file request.json --timeout 10000
```

Production calls always target `https://api.tools.11dz.cn`; the API has no API-key option. Set `ELEVEN_DZ_API_BASE_URL` only to an explicit `localhost`, `127.0.0.1`, or `::1` origin for local tests.

## Recover a stale installer lock

If installation reports `INSTALL_LOCKED`, first confirm that no `install.mjs` process or other agent is installing or upgrading the same target. Never bypass the lock with a force option.

Resolve the exact target directory from `--platform`, `--scope`, and `--dir`. Its lock is a sibling directory named `<parent>/.<target-basename>.11dz-install.lock`; for the Codex user target `~/.agents/skills/eleven-dz-tools`, the exact lock is `~/.agents/skills/.eleven-dz-tools.11dz-install.lock`. Continue only when that exact path is a real directory, not a symlink, and contains exactly one regular file named `.11dz-lock-owner`. Remove that owner file, then remove the now-empty lock directory with a non-recursive directory removal. Stop and preserve the path if it has any other content or identity; never recursively delete a lock candidate or the Skill target.

## Enforce the remote-processing boundary

1. Confirm that the user explicitly selected 11DZ remote processing.
2. Prefer synthetic or redacted input. Never send private keys, seed phrases, passwords, cookies, session secrets, active production JWTs, or production credentials.
3. If the client returns `CLIENT_SENSITIVE_INPUT_CONFIRMATION_REQUIRED`, do not retry automatically. Explain the remote transmission, redact where possible, and add `--confirm-sensitive` only after explicit user authorization.
4. JWT inspection always requires `--confirm-sensitive`, even for a synthetic token. It decodes only; always state `verified: false` and make no authentication or authorization conclusion.
5. Keep request JSON in stdin or a protected file. Never print the request body while troubleshooting.
6. Do not claim success for a non-2xx response or a response whose `ok` field is not `true`.
7. Preserve stable `error.code` and useful `meta.requestId` values when reporting failures.

## Validate the result

After each call:

1. Require a zero exit status, an HTTP success represented by the client, and `ok: true`.
2. Check that `data` matches the selected operation.
3. Perform a safe consistency check: parse JSON output, round-trip a codec, confirm a digest algorithm, or compare timestamp representations.
4. For a workflow, pass only the intended `data` value into the next request and stop on the first failure.
5. Return the useful result concisely with relevant warnings.

## Explicit invocation examples

- “用 `$eleven-dz-tools` 格式化并按键排序这段脱敏 JSON。”
- “调用 11DZ Tools API 把这段中文转成 Base64URL。”
- “用 11DZ Tools 对这些文本行去重排序。”
- “用 `$eleven-dz-tools` 检查这个测试 JWT；我确认它会发送到远程 API。”
- “调用 11DZ Tools 校验 JSON、压缩并计算 SHA-256。”

Do not invoke it for requests such as “格式化这段 JSON” unless the user also explicitly selects 11DZ remote processing.