Privacy-first, read-only inspection for Windows UKey, USB token, and bank token certificate associations.
UKey Detector helps troubleshoot certificate middleware and connected USB devices without exporting certificates, private keys, PINs, or signed payloads. Sensitive identifiers are masked by default.
Requirements:
- Windows
- Python 3.10+
- Windows PowerShell and
certutil
Run from the Skill directory:
cd .\skills\ukey-detector
python .\scripts\ukey_detector.py certificates
python .\scripts\ukey_detector.py topologyUse JSON when another tool needs structured output:
python .\scripts\ukey_detector.py all --format json| Area | Information |
|---|---|
| Certificate associations | CN, Provider, and KeyContainer metadata from Windows certificate stores |
| USB topology | Present PnP devices, VID/PID pairs, serial-like values, and topology metadata |
| Classic CSP accessibility | Optional silent KeyContainer check with CryptAcquireContextW and CRYPT_SILENT |
Sensitive values remain masked unless --reveal-sensitive-values is provided explicitly:
[certificates]
#1
store: current-user
cn: <masked:40100bfb21>
provider: Example UKey CSP
key_container: <masked:dfed8c267d>
Full certificate subjects, KeyContainers, USB instance IDs, serial-like values, topology paths, and Windows Container IDs can identify people, tokens, computers, or port layouts. Do not publish raw reports.
Read PRIVACY.md before revealing sensitive values or sharing output.
| Goal | Command |
|---|---|
| Inspect current-user certificate associations | python .\scripts\ukey_detector.py certificates |
| Inspect local-machine certificate associations | python .\scripts\ukey_detector.py certificates --store local-machine |
| Inspect USB topology | python .\scripts\ukey_detector.py topology |
| Inspect certificates and topology as JSON | python .\scripts\ukey_detector.py all --format json |
| Silently test classic CSP container accessibility | python .\scripts\ukey_detector.py certificates --test-container-access |
The repository includes a reusable Codex Skill under skills/ukey-detector.
Copy that directory into your Codex skills directory, then invoke:
Use $ukey-detector to inspect connected UKey certificate associations.
The Skill keeps troubleshooting read-only and privacy-safe by default.
UKey Detector does not:
- export certificates or private keys
- request a PIN
- sign data
- modify the certificate store
- modify drivers, services, registry values, or USB power state
- Windows only.
- Some devices require vendor middleware before certificate metadata becomes visible.
- Some devices use CNG/KSP or vendor APIs instead of classic CSP containers.
- Some USB tokens do not expose a stable serial number.
- Certificate association metadata is not guaranteed to be a universal hardware identifier.