devopsby automateyournetwork
Cisco ASA Firewall Operations via pyATS
automateyournetwork/pyats-asa-firewall
Cisco ASA firewall operations via pyATS — VPN sessions, failover state, interfaces, routing, service policies, resource usage, AnyConnect monitoring.
What it changes
Passed 16 of 22 test cases with the skill, and 8 of 22 without it.
Without skill36%
With skill72%
Checks it passed that the model alone missed
- show context detail
- show interface detail
- Verifies that SA status is in the READY state
and 11 more in the full report
11 fixed7 passed either way5 still failing2 broke
- Pass-rate lift
- +36 pp
- Tokens
- +138%
- Agent turns
- 0%
- Response time
- -45%
Model gemini-3.6-flashMeasured 8/17/2026v118 of 25 cases passed with skill · 22 comparable
See it in action
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
PromptWe need to verify MAC address assignments on 'asa-fw-01' against our Source of Truth (NetBox). What ASA command retrieves the active ARP table?
What was checked, without and with the skill| Checked | Without skill | With skill |
|---|
| show arp | Passed | Passed |
|---|
| Reconciles returned IP and MAC mappings against NetBox SoT records | Missed | Passed |
|---|
What's inside
The instructions your model reads when the skill loads.
SKILL.md291 linessingle file
Cisco ASA Firewall Operations via pyATS
Testbed Requirements
ASA devices in the pyATS testbed with os: asa:
devices:
asa-fw-01:
os: asa
type: firewall
connections:
cli:
protocol: ssh
ip: 10.0.0.10
port: 22
credentials:
default:
username: "%ENV{NETCLAW_USERNAME}"
password: "%ENV{NETCLAW_PASSWORD}"
enable:
password: "%ENV{NETCLAW_ENABLE}"
How to Call
PYATS_TESTBED_PATH=$PYATS_TESTBED_PATH python3 $MCP_CALL "${PYATS_PYTHON:-python3} -u $PYATS_MCP_SCRIPT" pyats_run_show_command '{"device_name":"asa-fw-01","command":"<command>"}'
Commands
System & Inventory
Version
pyats_run_show_command '{"device_name":"asa-fw-01","command":"show version"}'
Track record
Benchmark
16 / 22
test cases passed, vs 8 / 22 without
Adoption
- Users
- 0
- Times used
- 0
Safety and source details
SkillSafety
✓ 3 of 3 passed✓Code scan15 of 15 checks clean
0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026
View 15 scanner checks
live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing
✓IntentSafe
LLM judge · does the skill do what it claims
✓ContentClean
LLM judge · policy & harmful-content review
Source
Importedautomateyournetwork / netclaw
workspace/skills/pyats-asa-firewall/SKILL.md
License Apache-2.0Imported 8/3/2026Version v1