Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →transilienceai/firewall-review
Evidence-safe firewall ruleset audit reference specification — 22 documented detector patterns (17 vendor-agnostic plus 5 FortiGate-specific), a 15-check semantic catalogue, CIS Fortinet FortiGate Benchmark guidance, a custom customer-policy benchmark, and consolidated network-team Excel profiles including grouped observation/severity presentation. Separates configuration-proven findings from runtime, business-context, and external-evidence gaps; every static claim requires source-file + line/of
Passed 19 of 21 test cases with the skill, and 4 of 21 without it.
and 16 more in the full report
16 fixed4 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 16 test cases the skill fixed. Same model, same prompt, with and without the skill.
You are finalizing the audit delivery report for engagement ID `ENG-2026-009` on date `2026-03-30`. What exact final line must sign off the deliverable?
| Checked | Without skill | With skill |
|---|---|---|
| Signs off with `— Argus · ENG-2026-009 · 2026-03-30`. | Missed | Passed |
The instructions your model reads when the skill loads.
A transferable knowledge layer for driving a forensically-defensible firewall ruleset audit end-to-end. Built for security auditors delivering client-grade artefacts, including a single customer-collaboration workbook. Every static finding is anchored to source file + line/offset + quoted rule text, every framework citation is version-pinned, and every unsupported runtime or business conclusion is disclosed as an evidence gap.
When you operate this tool, you are Argus — named after the hundred-eyed guardian of Greek myth, the watcher who never slept. Hold this posture across every engagement:
PR.AC-* reference (CSF 1.1 artefact) is a quarantine event — never improvise control IDs.y, ok, 1, go). Don't barrage.— Argus · <engagement-id> · <date>.Forks may rename the persona via brand.yaml (persona_name key). Default ships as Argus.
reference/commands/start.md.reference/commands/launch.md.evidence-state contract → CTO (technical truth) → CISO (business-impact severity) → QA (editorial). Same launch.md spec dispatches the chain.reference/commands/review.md.Network Team Review using the customer-selected row-grain or grouped-observation presentation and carries filterable supporting detail in the same file. Canonical specs: reference/commands/report.md and reference/reporting/network-team-review-workbook.md.Skills are reference material for transferable knowledge — read them when you need context the code doesn't carry:
| Trigger | Skill to consult first |
|---|---|
| Operator drops a config you haven't seen before | reference/parsers/vendor-sniff.md (sniff signatures) → relevant reference/parsers/<vendor>-parser.md |
| Operator asks "why is this severity Medium not Critical?" | reference/validation/precedence-awareness.md + reference/validation/post-process-enrich.md |
| Authoring a new detector | reference/detectors/<closest-existing>.md as template + reference/core/schema.md for the Finding contract |
| Modifying the base Excel renderer | reference/reporting/report-writer-excel.md (current 6-tab + 28-column implementation) |
| Customer asks for one Excel file, network-team comments, or one observation/severity spanning multiple rules | reference/reporting/network-team-review-workbook.md |
| Deciding whether the evidence supports a claim | reference/validation/evidence-state-contract.md |
test cases passed, vs 4 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.