Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add automateyournetwork/netclaw --skill nsm-ids-triagegit clone --depth 1 https://github.com/automateyournetwork/netclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/automateyournetwork/netclaw/nsm-ids-triage)<a href="https://agentmods.dev/skills/automateyournetwork/netclaw/nsm-ids-triage"><img src="https://agentmods.dev/badge/skills/automateyournetwork/netclaw/nsm-ids-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/automateyournetwork/netclaw/nsm-ids-triage"><img src="https://agentmods.dev/badge/skills/automateyournetwork/netclaw/nsm-ids-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.01074 |
| Opus 5 | $0.00034 | $0.00537 |
| Sonnet 5 | $0.00013 | $0.00215 |
| Haiku 4.5 | $0.00007 | $0.00107 |
Grade A, and why
nsm-ids-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NSM IDS Triage (read-only)
MCP Server
- Server:
nsm-mcp(NetClaw-authored, spec 091) - Tools:
nsm_status,nsm_update_rules,nsm_alerts,nsm_analyze - Engine: Suricata 8.0.6, pinned by image digest
- Input: a
.pcap/.pcapngfile already on disk. Nothing sniffs an interface.
The rule that matters most here
Zero alerts is not a clean result until you have checked the signature count.
Stock Suricata loads 0 signatures and reports 0 alerts, announcing it with two
non-fatal warnings. Measured: 0 signatures on stock config versus 52,205 after
nsm_update_rules. A detector that loaded nothing inspected nothing.
nsm_alerts attaches suricata_posture to every response for exactly this reason:
state |
What it means | What you may say |
|---|---|---|
ARMED |
signatures loaded, detector ran | "no alerts matched the loaded ruleset" |
INERT |
0 signatures | "the detector was off" — never "the traffic is clean" |
UNKNOWN |
count seen, no ruleset file | treat with suspicion, re-run after nsm_update_rules |
When posture is INERT, the tool replaces an empty alert list with an object carrying
NOT_A_CLEAN_RESULT. That is deliberate: it cannot be read as a clean verdict by a caller
that only looks at the alert field.
Workflow: triage a capture
nsm_status— is docker reachable, is a ruleset present, how old is it?- If no ruleset:
nsm_update_rules, then continue. Do not proceed to conclusions on anINERTrun — report that the detector was off and stop. nsm_alertswithmin_severity=2— the alerts worth a human's attention firstnsm_alertsunfiltered — the full picture, notingtruncatedif set- For each alert that matters, pivot to the session with
nsm-session-pivotusing thesrc_ip/dest_ip/dest_port— an alert without its session context is a signature match, not an incident
Reading alerts honestly
- A signature match is not a compromise. ET Open contains policy and informational rules;
categoryandseveritymatter. Say what matched, not what it implies. - A ruleset age is part of the finding. A 30-day-old ruleset cannot alert on last week's
signatures;
nsm_statusreportsruleset_age_daysand the skill should quote it. - Suricata alerts on malformed traffic too.
SURICATA TCPv4 invalid checksummeans the capture has bad checksums — usually NIC offloading, not an attack. It is also a signal that Zeek would discard those packets, so cross-check withnsm-session-pivot. truncated: truemeans you are looking at a page. Never present it as the total.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 81 lines · 67 tokens per session scan A 77c635b2ccc2
nsm-ids-triage is a skill published in the GitHub repository automateyournetwork/netclaw (655 stars, last pushed 4d ago), licensed Apache-2.0. It adds 67 tokens to every session and 1,074 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Network Security & Traffic Analysis
Network traffic analysis, PCAP parsing, IDS/IPS rule creation, firewall configuration auditing, and network anomaly detection.
configuring-suricata-for-network-monitoring
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.
writing-suricata-and-snort-rules
Writes and validates Suricata/Snort IDS rules for network-based malware detection, covering rule anatomy, content/pcre matching, flow and threshold options, and common mistakes that cause false positives or no matches. Activates for requests to write a Suricata rule, create Snort signatures, or build network detection…
configuring-suricata-for-network-monitoring
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic inspection (HTTP, TLS, DNS, SMB) and SIEM integration. Use when running Suricata in IDS or inline IPS mode to detect or block malicious traffic, or when combining…
configuring-suricata-for-network-monitoring
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.
analyzing-network-traffic-of-malware
Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding…