Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add andycungkrinx91/konoha --skill configuring-zscaler-private-access-for-ztnagit clone --depth 1 https://github.com/andycungkrinx91/konohaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andycungkrinx91/konoha/configuring-zscaler-private-access-for-ztna)<a href="https://agentmods.dev/skills/andycungkrinx91/konoha/configuring-zscaler-private-access-for-ztna"><img src="https://agentmods.dev/badge/skills/andycungkrinx91/konoha/configuring-zscaler-private-access-for-ztna/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/andycungkrinx91/konoha/configuring-zscaler-private-access-for-ztna"><img src="https://agentmods.dev/badge/skills/andycungkrinx91/konoha/configuring-zscaler-private-access-for-ztna.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.02812 |
| Opus 5.5 | $0.00024 | $0.01125 |
| Sonnet 5.5 | $0.00012 | $0.00562 |
| Haiku 4.5 | $0.00006 | $0.00281 |
Grade B, and why
configuring-zscaler-private-access-for-ztna scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo yum install -y https://yum.private.zscaler.com/yum/el7/zpa-connector-latest.rpm Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sS https://dist.private.zscaler.com/apt/pubkey.gpg | sudo apt-key add - This is a copy
100% identical to configuring-zscaler-private-access-for-ztna — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 318 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Configuring Zscaler Private Access for ZTNA
When to Use
- When replacing traditional VPN concentrators with application-level zero trust access
- When providing remote users secure access to internal applications without network-level connectivity
- When implementing least-privilege access where users only see authorized applications
- When needing to make internal applications invisible to unauthorized users and the internet
- When integrating ZTNA with existing SASE architecture using Zscaler Internet Access (ZIA)
Do not use for applications requiring raw UDP access (ZPA primarily supports TCP), for providing full network-level access equivalent to site-to-site VPN (use ZPA AppProtection or branch connector instead), or when the organization requires on-premises-only access control without cloud dependency.
Prerequisites
- Zscaler Private Access subscription (Business or Transformation edition)
- Identity provider configured: Okta, Microsoft Entra ID, Ping Identity, or SAML 2.0 IdP
- App Connector VM requirements: Linux VM (CentOS 7/8, RHEL 7/8, Ubuntu 18.04+, Amazon Linux 2) with 2 vCPU, 4GB RAM minimum
- Outbound connectivity from App Connector to ZPA cloud on port 443 (no inbound ports required)
- DNS resolution from App Connector to internal application FQDNs
- Zscaler Client Connector deployed on user endpoints
Workflow
Step 1: Deploy App Connectors in Application Network
App Connectors establish outbound-only tunnels to the ZPA cloud, providing access to internal applications.
# Download and install App Connector on Linux VM
# Obtain provisioning key from ZPA Admin Portal > Administration > App Connectors
# For RHEL/CentOS
sudo yum install -y https://yum.private.zscaler.com/yum/el7/zpa-connector-latest.rpm
# For Ubuntu/Debian
curl -sS https://dist.private.zscaler.com/apt/pubkey.gpg | sudo apt-key add -
echo "deb https://dist.private.zscaler.com/apt stable main" | sudo tee /etc/apt/sources.list.d/zpa.list
sudo apt update && sudo apt install -y zpa-connector
# Configure the connector with provisioning key
sudo /opt/zscaler/bin/zpa-connector configure \
--provision-key "PROVISIONING_KEY_FROM_PORTAL"
# Start the connector service
sudo systemctl enable zpa-connector
sudo systemctl start zpa-connector
# Verify connector status
sudo systemctl status zpa-connector
sudo /opt/zscaler/bin/zpa-connector status
# Deploy second connector for HA (minimum 2 per site)
# Repeat on second VM with same App Connector Group provisioning key
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 318 lines · 59 tokens per session scan B 5988187bf658
configuring-zscaler-private-access-for-ztna is a skill published in the GitHub repository andycungkrinx91/konoha (12 stars, last pushed today), licensed MIT. It adds 59 tokens to every session and 2,812 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 2 findings (asks for root, makes network calls). It is 100% identical to configuring-zscaler-private-access-for-ztna, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
configuring-zscaler-private-access-for-ztna
Configuring Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring access policies based on user identity and device posture, and integrating with IdPs.
configuring-zscaler-private-access-for-ztna
Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring identity- and device-posture-based access policies, and integrating with IdPs. Use when replacing VPN concentrators with ZTNA or providing remote…
deploying-palo-alto-prisma-access-zero-trust
Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
implementing-zero-trust-network-access-with-zscaler
Use when implement Zero Trust Network Access using Zscaler Private Access (ZPA) to replace traditional VPN with identity-based, context-aware access to private applications through the Zscaler Zero Trust Exchange. Use when implementing zero trust network access using zscaler private access (zpa).
deploying-palo-alto-prisma-access-zero-trust
Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
implementing-zero-trust-network-access
Implementing Zero Trust Network Access (ZTNA) in cloud environments by configuring identity-aware proxies, micro-segmentation, continuous verification with conditional access policies, and replacing traditional VPN-based access with BeyondCorp-style architectures across AWS, Azure, and GCP.