html-throwaway-editor

HTML Throwaway Editor

When describing what you want to do is harder than just doing it, build a one-off editor. Not a product. Not a reusable tool. A single HTML file purpose-built for this one piece of data, with one Submit button at the end that sends the result back to the agent.

Pre-flight — run BEFORE writing the artifact

Invoke html-skills:html-skills-listen (Skill tool) first; it is idempotent. If it returns a URL, inject it verbatim as window.__CLAUDE_SUBMIT_URL__ in the HTML you are about to write, ?t= query string included (a local, single-session loopback handshake — not a credential). If it reported web/sandbox mode, leave that line out; submitToClaude then falls back to clipboard mode.

When to use this skill

• "I need to reprioritize / reorder / triage these N things"
• "Help me edit / curate / annotate / tag this dataset"
• "I want to tune / pick / configure these values" (where the values aren't simple text)
• "Build me a quick editor for X"
• Any time the user describes a manipulation that would be painful to do in chat but easy with a UI

Output requirements

Pre-populate with the actual data the user provided (after the secrets pass below) — never make them paste it again. End with one Submit button that sends the edited structure back in the standard envelope.

The Submit button is non-negotiable. An editor without it is a dead-end; "throwaway" means the result lives outside the artifact, not inside it.

Secrets are never embedded

Before pre-populating, scan the input for secret-shaped values. Mask anything that matches:

• Key names matching /(key|secret|token|passw|credential|private|auth|dsn|connection[_-]?string)/i.
• Known prefixes: AKIA, ghp_/gho_, sk-, xox, AIza, eyJ-prefixed JWTs, PEM PRIVATE KEY blocks.
• URLs with userinfo — scheme://user:pass@host connection strings.
• Secret-bearing sources: if the source file is secret-bearing by convention (.env, *credentials*, *secret*, .npmrc, key/PEM files), treat every value in it as secret by default — don't rely on the regexes alone.
• High-entropy strings ≥ 20 chars — in config/env-shaped inputs (Pattern B) only; treat a bare entropy hit as "mask unless the user confirms it's not a secret". Don't apply this heuristic to dataset or annotation rows (Patterns D/E), where hashes, UUIDs, and base64 are legitimate payload.