headcount is an organization of independently installable Claude Code plugins, each grouping skills for a department such as finance, security, or demand generation. Claude Code users install the departments they need and invoke their skills for specialized work; the catalogue entries are skills and related agent tooling from that organization.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/cbrock84/headcount/network-administrationnpx skills add cbrock84/headcount --skill network-administrationgit clone --depth 1 https://github.com/cbrock84/headcountWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cbrock84/headcount/network-administration)<a href="https://agentmods.dev/skills/cbrock84/headcount/network-administration"><img src="https://agentmods.dev/badge/skills/cbrock84/headcount/network-administration.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.00917 |
| Opus 5 | $0.00031 | $0.00458 |
| Sonnet 5 | $0.00012 | $0.00183 |
| Haiku 4.5 | $0.00006 | $0.00092 |
Grade A, and why
network-administration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Network administration
The network is the substrate everything else assumes works. It gets attention when it fails and is otherwise expected to be invisible, which is why its design debts persist for years.
Segment by trust, and mean it
A flat network means one compromised laptop reaches the finance server. Segmentation is the highest- value structural control available and the most commonly deferred.
Separate at minimum: user devices, servers, management interfaces, guest, and anything unmanaged — printers, cameras, building systems, contractor equipment. That last category is the recurring entry point, because it is rarely patched and rarely owned.
Default deny between segments, and permit specific flows. Rules that accumulate without review become an allow-all with extra steps; review them on a cadence and remove what no longer has a reason.
Remote access
The perimeter stopped being a perimeter when the workforce and the workloads left it. Treat network location as weak evidence of trust: being on the corporate network should not by itself grant access to anything sensitive.
Prefer per-application access over full network access. A remote user needing one internal application does not need a route to the entire internal estate, which is what a traditional VPN grants by default.
Authentication and authorization policy belongs to security:access-and-identity; this skill
implements the network path.
DNS and addressing are load-bearing
DNS failure presents as everything being broken, which is why it is misdiagnosed for the first twenty minutes of many incidents. Run it redundantly, monitor resolution from the client's perspective rather than the server's, and keep records under change control.
Plan addressing with room to grow and document it. Overlapping private ranges is the problem that surfaces years later during an acquisition or a site merge and is expensive at exactly that moment.
Diagnose in layers
Work bottom-up and prove each layer before moving on: physical, then addressing, then routing, then name resolution, then the application. Most misdiagnosis comes from starting at the application because that is where the complaint originated.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 87 lines · 62 tokens per session scan A 8a4ed5ccd375
network-administration is a skill published in the GitHub repository cbrock84/headcount (1,247 stars, last pushed 2d ago), licensed MIT. It adds 62 tokens to every session and 917 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
cloud-deployment-routing-workflow
Choose a cloud deployment path before implementation. Route AWS work to the official AWS Agent Toolkit and Azure work to Microsoft's Azure Skills plugin while keeping credentials, regions, and mutation boundaries explicit.
blob-store
This skill should be used when the user wants a "blob store" or "object storage", names "S3" or an S3-compatible store, needs to "store images / video / files", asks about "multipart upload" or "resumable upload", "signed / presigned URLs", "media storage", "unstructured data at scale", object "versioning", storage…
dns
This skill should be used when the user asks about "DNS", "domain resolution", "GeoDNS / geo routing", "latency-based routing", "weighted / failover routing", "Route 53 / Cloud DNS", an "A/CNAME/ALIAS record", "anycast", or "DNS TTL / propagation". It gives the global front door that maps a name to the right IP and…
macos-distribution-workflow
Inspect, prepare, validate, and troubleshoot exported macOS distribution artifacts. Use when checking signing identities, entitlements, hardened runtime, nested code, Gatekeeper, notarization readiness/results, stapling, or distribution-only launch failures.
prepare-isolated-analysis-lab
Prepare a verified disposable Linux or macOS analysis lab from an approved isolation decision. Use before active research to control host integration, networking, baseline, monitoring, evidence export, reset, and teardown.
flash
Write code locally, iterate with flash dev — it runs your functions on remote Runpod GPUs/CPUs with hot-reload and live worker logs — then flash deploy to ship. Endpoint handles provisioning.