Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fastrevmd-lab/fwskillsshare --skill firewall-config-diffgit clone --depth 1 https://github.com/fastrevmd-lab/fwskillsshareWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fastrevmd-lab/fwskillsshare/firewall-config-diff)<a href="https://agentmods.dev/skills/fastrevmd-lab/fwskillsshare/firewall-config-diff"><img src="https://agentmods.dev/badge/skills/fastrevmd-lab/fwskillsshare/firewall-config-diff/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fastrevmd-lab/fwskillsshare/firewall-config-diff"><img src="https://agentmods.dev/badge/skills/fastrevmd-lab/fwskillsshare/firewall-config-diff.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.02463 |
| Opus 5.5 | $0.00021 | $0.00985 |
| Sonnet 5.5 | $0.00011 | $0.00493 |
| Haiku 4.5 | $0.00005 | $0.00246 |
Grade A, and why
firewall-config-diff scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Firewall Config Diff
Overview
Use this skill to compare two firewall or NGFW configurations and report how they differ, by pivoting both through the parsing-* intermediate JSON schema. Each side is normalized to the same vendor-neutral sections — address_objects, address_groups, service_objects, service_groups, security_policies, nat_rules, zones, interfaces, static_routes / virtual_routers / routing, vpn_tunnels, ha_config, admin_users, and system — and then compared section by section. Because the comparison happens on the schema pivot rather than the raw text, same-vendor and cross-vendor diffs are one mechanism: the only cross-vendor addition is a normalization step for constructs that two vendors model differently.
The comparison is always semantic, never textual. Items are paired by what they mean — an address object by its value, a policy by its match-and-action tuple — so a rename, a reorder, or a different vendor's syntax does not register as a difference. A plain diff of two config files would flag every cosmetic and ordering change and miss the fact that two differently-named objects describe the same subnet; it would add nothing here and actively mislead. This skill compares meaning; it does not emit a target config (that is firewall-config-conversion) and does not judge the rulebase against best practice (that is firewall-best-practices-audit).
The output is always two parts: a per-section report listing what was added, removed, and changed, followed by a single parity verdict (EQUIVALENT or DIFFERENCES FOUND). Where a feature on one side has no equivalent on the other — common in cross-vendor comparisons — it is flagged not-comparable and excluded from the diff rather than reported as a false difference. The report never claims more than the schema supports and always lists what could not be compared.
Scope and routing
Compare two normalized parser outputs. Use a text-diff tool for literal line changes, firewall-config-conversion to emit target syntax, and firewall-best-practices-audit to assess one rulebase.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 127 lines · 53 tokens per session scan A 7568f4d8a70b
firewall-config-diff is a skill published in the GitHub repository fastrevmd-lab/fwskillsshare (9 stars, last pushed 1mo ago), licensed MIT. It adds 53 tokens to every session and 2,463 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
fmc-firewall-ops
Cisco Secure Firewall FMC — access policy search, rule inspection, FTD device targeting, multi-FMC profile management. Use when searching firewall rules by IP or FQDN, checking if host A can reach host B through the firewall, auditing FMC access policies, or reviewing SGT-based segmentation rules.
fortianalyzer-ops
FortiAnalyzer log operations — policy-filtered traffic log query within a bounded time window, offset pagination, per-policy activity checks, and logging-device inventory. Use when asking whether traffic actually matched a firewall rule, investigating what hit a policy, or determining whether a rule is genuinely…
fortigate-ops
FortiGate device operations — system status, interfaces, routing, IPsec VPN tunnel state with phase 1 and phase 2 reported separately, HA member identification, per-VDOM scoping, and manager-vs-device drift detection. Use when asking what a FortiGate is ACTUALLY doing right now, whether a tunnel is up, or whether the…
fortimanager-ops
FortiManager policy operations — ADOM inventory, policy package review, recursive object resolution, revision history, install preview, and gated package install. Use when auditing FortiGate firewall policy at the MANAGER level (intent), reviewing ADOM policy packages, or planning a package install with rollback…
meraki-security-appliance
Cisco Meraki MX security appliance (read-only) — L3/L7 firewall rules, content filtering, IDS/IPS and AMP settings, site-to-site VPN, traffic shaping via Cisco's official Meraki MCP. Use when auditing Meraki firewall rules, reviewing content filtering, or inspecting MX VPN configuration.
radkit-remote-access
Cisco RADKit — cloud-relayed remote device access, CLI execution, SNMP polling, device inventory discovery, attribute inspection. Use when accessing remote network devices through a cloud relay, running CLI on air-gapped devices, polling SNMP metrics remotely, or discovering device inventory via RADKit.