Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →automateyournetwork/pyats-security
Network security audit - ACLs, AAA, control plane policing, management plane hardening, encryption, port security, and CIS benchmark checks.
Passed 13 of 18 test cases with the skill, and 9 of 18 without it.
and 6 more in the full report
7 fixed9 passed either way4 still failing3 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
Can you conduct a security vulnerability review on router R1? Check its running configuration and cross-reference its Cisco software version against known CVEs to identify actual exposure risks. Provide the output as a structured audit report listing findings by severity rank and concluding with a summary of critical, high, medium, and low issues.
| Checked | Without skill | With skill |
|---|---|---|
| Calls search_cves to query NVD vulnerabilities for the router software version. | Missed | Passed |
| Maps CVSS score 7.0 or higher to HIGH severity finding. | Missed | Passed |
The instructions your model reads when the skill loads.
Always start by capturing the full running config for analysis:
PYATS_TESTBED_PATH=$PYATS_TESTBED_PATH python3 $MCP_CALL "${PYATS_PYTHON:-python3} -u $PYATS_MCP_SCRIPT" pyats_show_running_config '{"device_name":"R1"}'
Scan the full config for the checks below.
Check these items in the running config:
| Check | What to Look For | Finding If Missing |
|---|---|---|
| SSH version | ip ssh version 2 | CRITICAL: SSHv1 vulnerable to MITM |
| Telnet disabled | No transport input telnet on VTY lines | CRITICAL: Telnet sends cleartext credentials |
| VTY ACL | access-class on VTY lines | HIGH: Unrestricted management access |
| Console timeout | exec-timeout on console (not 0 0) | MEDIUM: Unattended console sessions |
| VTY timeout | exec-timeout on VTY lines (not 0 0) | MEDIUM: Stale management sessions |
| Password encryption | service password-encryption | MEDIUM: Type 0 passwords visible |
| Enable secret | enable secret (not enable password) | HIGH: Enable password uses weak hash |
| Login banner | banner login or banner motd | LOW: Legal/compliance requirement |
| HTTP server disabled | no ip http server | MEDIUM: Unnecessary attack surface |
| HTTPS server | ip http secure-server if web management needed | MEDIUM: Use HTTPS not HTTP |
| Aux port disabled | no exec on aux line | LOW: Unused port open |
test cases passed, vs 9 / 18 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.