fwskillsshare

fwskillsshare is a community collection of 29 agent skills for firewall and network-security work, written as plain Markdown and aimed at coding agents such as Claude Code, Codex and Hermes. Skills are model-invoked — the agent picks them up from vendor keywords, SRX operational topics, deployment requests or compliance language — and can also be called explicitly by name. The skills are grouped into five families: - Config parsers (five): Cisco ASA/FTD running-config, Cisco Secure Firewall / Firepower FMC and FDM JSON exports, FortiGate/FortiOS show full-configuration, Palo Alto PAN-OS and Panorama (XML or set format), and Juniper SRX/Junos (display set or curly-brace). They normalize each vendor into one shared, vendor-neutral intermediate JSON schema covering zones, objects, policies, NAT, routing, VPN and HA, with a canonical L7 application map and confidence scores. - SRX operational playbooks: policy and AppID/AppFW, source/destination/static NAT and NAT64/CGN, Multi-Node High Availability, ADVPN, static hub-and-spoke IPsec, chassis cluster on Proxmox VE guests, MPLS L3VPN in flow mode, dynamic IP feed objects, licence and signature maintenance, first-time bring-up, and external syslog/SIEM delivery. - Cross-vendor tooling built on the parsed schema: a firewall best-practices audit (any-any, shadowed/orphaned rules, missing deny and logging, exposed plaintext services, weak crypto, device-plane hardening), config conversion with a per-section fidelity report, and a meaning-based config diff for drift, HA parity or migration validation. - Seven NGFW compliance playbooks that map firewall capabilities to control evidence for PCI DSS v4.0.1, HIPAA, CMMC Level 2 / NIST SP 800-171, CIS Controls v8/v8.1, ISO/IEC 27001:2022, SOC 2 and the DISA SRX STIG, producing assessor-facing findings and gap lists rather than certification claims. - Two deployment skills for running Juniper Security Director On-Prem and HPE Aruba ClearPass Policy Manager as Proxmox VE guests, covering sizing, first-boot configuration, and validation steps. Installation is through an installer script (curl-able, or run from a clone) with interactive selection or flags such as --all, --skill, --family (parsers, srx, tooling, compliance, deployment), --target (claude, codex, hermes, both, all), --dir, --list, --uninstall, --force and -y. Skills are copied rather than linked, so re-running the installer is needed to pick up updates. The README is explicit about limits and risks: skills are instructions loaded into the agent's context and some direct the agent at real equipment; users are advised to read the whole skill directory before installing, to treat pasted configs as untrusted input because prompt injection is not defended against, and to avoid pasting secrets into hosted models. Device-changing steps are written to require explicit approval in the authoring intent, but the README notes that actual permissions are what constrain the agent, and recommends verifying behaviour against your own platform and release. Quality notes state that 26 of 29 skills have passed independent technical review, while clearpass-proxmox-deploy ships as a draft and parsing-firepower-configs and srx-syslog-logging are unreviewed. The project is unofficial and not affiliated with Cisco, Fortinet, Palo Alto Networks, Juniper Networks or HPE, and is MIT licensed.