Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a coherent firewall-rule audit guide, but it is labeled read-only while documenting commands that reset live device counters.
Review before installing. Use it only with accounts restricted to true read-only show/export operations, do not run the documented clear-counter commands unless separately approved through change control, and treat any unused-rule recommendation as invalid if counters were recently reset.
references/cli-reference.md:13State-Changing Counter Reset Commands Violate the Declared Read-Only Permission Boundary
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
| Function | CLI Command |
|----------|-------------|
| Running security policy | `show running security-policy` |
| Rule hit counts | `show rule-hit-count vsys vsys1 security rules all` |
| Specific rule hit count | `show rule-hit-count vsys vsys1 security rules rule-name [name]` |
| Test policy match | `test security-policy-match source [IP] destination [IP] protocol [num] application [app] destination-port [port] from [zone] to [zone]` |
| NAT policy | `show running nat-policy` |
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
| Function | CLI Command |
|----------|-------------|
| Running security policy | `show running security-policy` |
| Rule hit counts | `show rule-hit-count vsys vsys1 security rules all` |
| Specific rule hit count | `show rule-hit-count vsys vsys1 security rules rule-name [name]` |
| Test policy match | `test security-policy-match source [IP] destination [IP] protocol [num] application [app] destination-port [port] from [zone] to [zone]` |
| NAT policy | `show running nat-policy` |
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
| Function | CLI Command |
|----------|-------------|
| Running security policy | `show running security-policy` |
| Rule hit counts | `show rule-hit-count vsys vsys1 security rules all` |
| Specific rule hit count | `show rule-hit-count vsys vsys1 security rules rule-name [name]` |
| Test policy match | `test security-policy-match source [IP] destination [IP] protocol [num] application [app] destination-port [port] from [zone] to [zone]` |
| NAT policy | `show running nat-policy` |
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
| Function | CLI Command |
|----------|-------------|
| Running security policy | `show running security-policy` |
| Rule hit counts | `show rule-hit-count vsys vsys1 security rules all` |
| Specific rule hit count | `show rule-hit-count vsys vsys1 security rules rule-name [name]` |
| Test policy match | `test security-policy-match source [IP] destination [IP] protocol [num] application [app] destination-port [port] from [zone] to [zone]` |
| NAT policy | `show running nat-policy` |
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
| Function | CLI Command |
|----------|-------------|
| Running security policy | `show running security-policy` |
| Rule hit counts | `show rule-hit-count vsys vsys1 security rules all` |
| Specific rule hit count | `show rule-hit-count vsys vsys1 security rules rule-name [name]` |
| Test policy match | `test security-policy-match source [IP] destination [IP] protocol [num] application [app] destination-port [port] from [zone] to [zone]` |
| NAT policy | `show running nat-policy` |
The document explicitly states that all listed commands are non-modifying, but it includes counter-clearing commands later in the reference. That mismatch can mislead an operator or downstream agent into executing state-changing commands under the false assumption they are safe read-only audit steps, altering forensic or operational data.
The Cisco IOS table presents clear access-list counters as a normal audit function even though it changes device state by resetting counters. In an automation context, this can erase evidence needed for unused-rule analysis, incident review, or change validation, and may trigger unauthorized configuration-adjacent actions on production devices.
The Cisco ASA section includes clear access-list [name] counters despite the document's earlier non-modifying claim. This can lead users or agents to reset usage telemetry unintentionally, undermining audit accuracy and potentially interfering with operational troubleshooting or investigations.
The manifest describes a vendor-agnostic ACL/firewall rule analysis skill and its metadata declares only the ssh binary with no MCP dependencies or egress endpoints. In troubleshooting, the document expands capability to using PAN-OS XML API, FortiGate REST API, and CheckPoint Management API for programmatic export, which is not clearly justified by the declared operational surface of the skill.