Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lance0/nbox/device-contextnpx skills add lance0/nbox --skill device-contextgit clone --depth 1 https://github.com/lance0/nboxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00091 | $0.00913 |
| Opus 5 | $0.00046 | $0.00456 |
| Sonnet 5 | $0.00018 | $0.00183 |
| Haiku 4.5 | $0.00009 | $0.00091 |
Grade A, and why
nbox-device-context scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
nbox device context
These read commands answer the physical/connectivity questions: what a device
is, how it's wired, what an interface terminates into, and where it sits. All
are read-only. For the flags of any one, run nbox <cmd> --help — this skill is
flag-free by design, describing what each command answers.
What each command answers
nbox device <name|slug|id>— a device plus its interfaces, IPs, cables, VLANs, and services. The starting point for "what isedge01and what's on it?"nbox interface <device> <interface>— one interface: type, MTU, MAC, mode, VLANs, addresses, the attached cable, and the cable-path A↔Z trace (a diagram naming the device at each hop). The reference is the<device><interface>pair; interface names may contain slashes (e.g.xe-0/0/1).nbox mac <addr>— reverse-resolve a MAC to the interface(s) and device(s) that carry it. Any common form is normalized (aa:bb:cc:dd:ee:ff,AABB.CCDD.EEFF,aa-bb-…,aabbccddeeff).nbox rack <name|id>/nbox site <name|slug>— the rack or site a device sits in, for surrounding context.
nbox --no-tui device edge01 --json --envelope
nbox --no-tui interface edge01 xe-0/0/1 --json # config + cable-path trace
nbox --no-tui mac aa:bb:cc:dd:ee:ff --json # → carrying interface/device
nbox --no-tui rack R12 --json
nbox --no-tui site DC1 --json
The cable-path trace (A↔Z)
nbox interface is the connectivity tool: its cable-path section traces the
physical path end to end, naming the device at each hop. Reach for it to answer
"what is edge01:xe-0/0/1 actually wired to?" — the trace follows through
patch panels and intermediate cables to the far-end device/interface.
The <device>/<name> ref form
Some commands take an interface as a single <device>/<name> reference rather
than two arguments — e.g. nbox journal interface edge01/xe-0/0/1,
nbox history interface edge01/xe-0/0/1, and nbox open interface/edge01/xe-0/0/1. The interface name keeps its slashes; the resolver
splits on the device boundary, so xe-0/0/1 stays intact.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 66 lines · 91 tokens per session scan A 45db7ad52799
nbox-device-context is a skill published in the GitHub repository lance0/nbox (11 stars, last pushed 20d ago), licensed Apache-2.0. It adds 91 tokens to every session and 913 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
generic-resource-actions
Shared CRUD pattern for NetBox resources whose entire CLI surface is generated from the OpenAPI schema.
dcim-devices
NetBox DCIM device CRUD with foreign-key name resolution and bulk operations.
dcim-interfaces
NetBox DCIM interface CRUD with composite addressing, VLAN/LAG name resolution, and cable trace.
ipam-prefixes
NetBox IPAM prefix CRUD plus available-ips and available-prefixes allocation helpers.
config
Manage nbx NetBox URL, token, and named contexts in /.config/nbx/config.toml.
preflight
Verify NetBox reachability and token authentication before running mutations.