Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gordcurrie/unifi-mcp --skill audit-network-securitygit clone --depth 1 https://github.com/gordcurrie/unifi-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gordcurrie/unifi-mcp/audit-network-security)<a href="https://agentmods.dev/skills/gordcurrie/unifi-mcp/audit-network-security"><img src="https://agentmods.dev/badge/skills/gordcurrie/unifi-mcp/audit-network-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gordcurrie/unifi-mcp/audit-network-security"><img src="https://agentmods.dev/badge/skills/gordcurrie/unifi-mcp/audit-network-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.03505 |
| Opus 5.5 | $0.00032 | $0.01402 |
| Sonnet 5.5 | $0.00016 | $0.00701 |
| Haiku 4.5 | $0.00008 | $0.00350 |
Grade A, and why
audit-network-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 349 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: Audit Network Security (UniFi via unifi-mcp)
This skill performs a structured security audit of a UniFi network using the tools exposed by gordcurrie/unifi-mcp. Work through each section below in order, collect findings, then produce a Prioritised Findings Report at the end.
Before you start
Confirm the unifi-mcp server is configured and the following tools are available:
list_clients, list_devices, list_firewall_policies, list_acl_rules,
get_acl_rule_ordering, list_traffic_matching_lists, list_wifi_broadcasts,
list_networks, list_firewall_zones, list_dns_policies, list_vpn_tunnels,
list_vpn_servers, get_device_stats, list_pending_devices, list_vouchers,
list_radius_profiles.
If destructive tools are enabled (UNIFI_ALLOW_DESTRUCTIVE=true), note that this
audit may surface items you want to remediate in the same session. The optional
delete_voucher tool is used in Section 8 only when destructive tools are enabled.
Pagination
Every list tool that returns a totalCount field must be fully paginated. After
the first call: if totalCount > len(data), repeat the call with offset += len(data)
(where len(data) is the number of items returned on the previous page) until
offset >= totalCount. Do not rely on the count field to increment the offset—it
may be absent or zero on some responses. Collect all pages before analysing results.
Section 1 — Device inventory and rogue device detection
Goal: Identify every device on the network and flag anything unexpected.
-
Call
list_devices(paginate until all pages retrieved). For each device note:name,model,macAddress,ipAddress,state,firmwareVersion,firmwareUpdatable
-
Call
list_pending_devices. Any device visible on the network but not yet adopted is a potential rogue or misconfigured device. Flag all results as [HIGH] findings — an unadopted device has unrestricted access to the network and its origin is unverified.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed · +348 lines · +81 tokens per session 62f43c752c04
- 1mo ago First seen · 1 lines · 0 tokens per session scan A 8272de9bb6d9
audit-network-security is a skill published in the GitHub repository gordcurrie/unifi-mcp (2 stars, last pushed 5d ago), licensed MIT. It adds 81 tokens to every session and 3,505 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
incident-investigation
Investigate one UniFi Network device incident (a switch, AP or gateway going offline, disconnecting or misbehaving) over an explicit, bounded time window, with Protect camera context, using only the local read-only evidence tools. Produces a cited report that states its coverage. Use when the user asks what happened…
firewall-auditor
Audit UniFi firewall policies for conflicts, redundancies, security gaps, and best practices. Use when asked to review firewall rules, check for security issues, audit network policies, or optimize firewall configuration.
firewall-manager
Manage UniFi firewall policies using natural language — create, modify, and review firewall rules, content filters, and traffic policies. Use when asked to block traffic, create firewall rules, manage content filtering, set up time-based access controls, or review firewall configuration.
security-digest
Generate a security digest summarizing events across UniFi Protect cameras, Access door events, and Network firewall activity. Use when asked about what happened overnight, security summary, event digest, recent activity, or reviewing camera and access events.
unifi-protect
How to manage UniFi Protect cameras and NVR — view cameras, smart detections, Find Anything detection search, recordings, snapshots, lights, sensors, Known Faces, license plates, and the Alarm Manager. Use this skill when the user mentions UniFi cameras, security cameras, NVR, recordings, motion detection, person…
unifi-access
How to manage UniFi Access door control — locks, credentials, visitors, access policies, and events. Use this skill when the user mentions UniFi Access, door locks, door access, building access, NFC cards, PIN codes, visitor passes, access policies, access schedules, door readers, or any UniFi Access task.