bulk-password-update

Bulk Password Update

Apply or rotate passwords across multiple NFC tags from a CSV file. The skill presents each tag, verifies the UID matches the CSV row, authenticates with the old password, applies the new password, and tracks progress in a resumable sidecar file.

When to use

• You have 10+ tags that need password rotation or initial password protection.
• CSV source lists tag UIDs with corresponding old and new passwords.
• You want resumable progress tracking if the batch is interrupted.

Inputs to gather

• CSV file path — full path to the CSV (e.g., ~/Documents/nfc-batches/passwords-2026-04.csv). If not provided, prompt user; store the selected path in ${CLAUDE_USER_DATA:-${XDG_DATA_HOME:-$HOME/.local/share}/claude-plugins}/nfc-ops/config.json for future runs.
• CSV columns required: uid, old_password, new_password.
• Optional: label column (human name for the tag, for UI clarity).

Procedure

1. Verify nfc-list is available.
2. Load the CSV file. If a sidecar <csv>.progress.json exists, load the completed-row list and skip to the first incomplete row.
3. For each row (starting from the first incomplete):
   • Display row number, UID, and label (if present): "Row 3 of 10 — UID: 04A12B3C — Label: 'Server Room Badge'"
   • Prompt: "Present the tag and press Enter to update, or type 'skip' to skip or 'abort' to stop."
   • Run nfc-list to detect the tag. Capture its UID.
   • Verify the detected UID matches the CSV row. If mismatch, warn: "UID mismatch! CSV expects 04A12B3C, but detected 08C54F9D. Please present the correct tag or type 'skip' to skip." Repeat until match or skip.
   • Authenticate with the old password:
     • For NTAG21x: Read page 43–44 to confirm the tag is password-protected; attempt read with old password via nfc-mfultralight read with auth.
     • For MIFARE Classic: Authenticate the target sector with the old key via nfc-mfclassic read or similar.
     • If authentication fails, prompt: "Authentication with old password failed. The tag may already be unprotected, or the password may be incorrect. Retry, skip, or abort?"
   • Apply the new password (using password-protect logic):
     • Write the new password to the tag.
     • Read back to verify.
   • If update succeeds, mark the row as completed in <csv>.progress.json and log to state/write-log.jsonl (no plaintext password; log only UID, timestamp, action="password_rotate", status="success").
   • If update fails, offer retry (up to 3 times) or skip.
   • Display progress: "Row 3 of 10 completed. Time elapsed: 2m 15s. Est. time remaining: 4m 30s."
4. After the final row, summarize: "Batch complete. 10 of 10 tags updated successfully. Total time: 6m 45s."

Output / side effects

• All tags now use their new passwords.
• <csv>.progress.json is updated (and can be deleted after successful completion, or kept for auditing).
• state/write-log.jsonl is appended with entries for each successful password update (no plaintext passwords).
• Terminal shows real-time progress and summary.

Safety / constraints

• Resumability: Do not delete the <csv>.progress.json sidecar during a run.
• No auto-confirmation: Every tag must be confirmed by the user before update — this is human-in-the-loop by design.
• CSV validation: Reject CSVs with missing uid, old_password, or new_password columns.
• UID verification: If the presented tag's UID does not match the CSV, halt that row and require re-presentation or skip. This prevents accidental password changes on the wrong tag.
• No plaintext logging: Old and new passwords are never written to logs or displayed. Only the fact that a password update occurred is logged.
• IRREVERSIBLE: Warn the user once at the start: "You are about to rotate passwords on multiple tags. This action is irreversible if you forget a password. Ensure your CSV is accurate. Continue? (yes/no)".