Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mikeholownych/unifi-mcp --skill unifi-dns-triagegit clone --depth 1 https://github.com/mikeholownych/unifi-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mikeholownych/unifi-mcp/unifi-dns-triage)<a href="https://agentmods.dev/skills/mikeholownych/unifi-mcp/unifi-dns-triage"><img src="https://agentmods.dev/badge/skills/mikeholownych/unifi-mcp/unifi-dns-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mikeholownych/unifi-mcp/unifi-dns-triage"><img src="https://agentmods.dev/badge/skills/mikeholownych/unifi-mcp/unifi-dns-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.00859 |
| Opus 5 | $0.00028 | $0.00430 |
| Sonnet 5 | $0.00011 | $0.00172 |
| Haiku 4.5 | $0.00006 | $0.00086 |
Grade A, and why
unifi-dns-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
UniFi DNS Triage
Separate name resolution failures from connectivity failures — they look identical to users ("the internet is broken") but have completely different fixes.
Step 0 — Version & context
get_sysinfo for Network version (facts verified on 10.x). Then get_networks
— note each network's domain_name and topology.
The test ladder (run in order, stop at first break)
Have the user (or use your own knowledge of results) run:
ping 8.8.8.8— works? → connectivity is FINE; this is DNS. Skip to 3. fails? → genuine connectivity issue → route tounifi-internet-down.ping google.com— resolves? Public DNS works. fails with "could not be resolved" → name resolution broken. Continue.nslookup google.com(uses DHCP-given resolver) vsnslookup google.com 8.8.8.8:- Direct-to-8.8.8.8 works but default resolver fails → the configured internal resolver is dead or unreachable → step 4.
- Both fail → device-side (wrong DNS manually set, captive portal, VPN app).
- Identify the resolver chain:
get_networks(per-network domain_name),get_client_detailson the affected device (which network/DNS it holds). On networks where an AD/domain exists (ad.holownych.comstyle), the resolvers are typically domain controllers — check those hosts are up (list_clients/get_device_details).
Controller-specific patterns (Network 9+/10 zone firewall)
- Internal-DNS enforcement is commonly done by BLOCK rules on outbound
tcp/udp 53 per zone (look for names like "external DNS block",
"Block WORK External DNS" in
get_firewall_policies). Consequences:- Devices with hardcoded 8.8.8.8 silently fail to resolve → fix the device, not the firewall.
- DoH/DoT escape (443/853) is NOT blocked by port-53 rules — devices may resolve via encrypted DNS and bypass internal names entirely.
- Allow-rules to DNS-server zones are often scoped
tcp_udp 53ONLY — other DNS transports will fail while basic lookups work.
- Split-horizon: internal names (
*.ad.holownych.com) resolve ONLY via internal resolvers. "Works at office, fails at home" (or vice versa) is normal. - If ALL resolution dies house-wide but WAN is up: prime suspect is the DNS
server zone being down or a changed zone-policy (verify with
get_firewall_policies: are the "X to DNS Servers" allows still enabled?).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 67 lines · 55 tokens per session scan A b8528399463e
unifi-dns-triage is a skill published in the GitHub repository mikeholownych/unifi-mcp (0 stars, last pushed 12d ago), licensed MIT. It adds 55 tokens to every session and 859 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gke-ai-troubleshooting-tpu-dynamic-slices-monitoring
Monitors, troubleshoots, and manages GKE TPU Dynamic Slices custom resources. Use when checking TPU slice lifecycle states, troubleshooting slice provisioning failures, validating single-slice or multi-slice (JobSet) workload manifests, or safely patching stuck finalizers and disabling the slice controller. Don't use…
gke-ai-troubleshooting-tpu-vbar-oom
Diagnoses and prevents vbarcontrolagent segfaults, out-of-memory (OOM) errors, and TPU device initialization failures on TPU v6e nodes in GKE caused by race conditions during TPU device resets or high-frequency metrics polling. Use when troubleshooting vbarcontrolagent crashes, memory cgroup OOMs in serial console…
competition-firmware-layout
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for firmware images, partition tables, boot chains, update packages, extracted filesystems, embedded configs, and device-facing trust boundaries. Use when the user asks to unpack firmware, map partition layout, inspect bootloader or init…
doca-flow
Build and debug DOCA Flow applications on supported NVIDIA NICs/DPUs: define match/action pipes, initialize ports and representors, choose forwarding targets, validate pipes before hardware programming, read counters, match the Flow version to the installed DOCA release, and diagnose Flow API errors. Trigger on DOCA…
diagnose-driver-install
Diagnose NVIDIA driver installation failures on DeepOps-managed nodes — nvidia-smi errors, "No devices were found", DKMS build failures, or GPU pods crash-looping. Use before reinstalling anything.
catc-troubleshoot
Catalyst Center troubleshooting workflows - device unreachable investigation, client connectivity issues, interface down analysis, site-wide outage triage, wireless roaming problems, integration with pyATS for CLI-level diagnostics. Use when a device is unreachable, a user reports connectivity problems, an interface…