Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nanxiaoyao/network-huawei-skills --skill aaa-auth-configgit clone --depth 1 https://github.com/nanxiaoyao/network-huawei-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nanxiaoyao/network-huawei-skills/aaa-auth-config)<a href="https://agentmods.dev/skills/nanxiaoyao/network-huawei-skills/aaa-auth-config"><img src="https://agentmods.dev/badge/skills/nanxiaoyao/network-huawei-skills/aaa-auth-config/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nanxiaoyao/network-huawei-skills/aaa-auth-config"><img src="https://agentmods.dev/badge/skills/nanxiaoyao/network-huawei-skills/aaa-auth-config.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00165 | $0.05161 |
| Opus 5 | $0.00082 | $0.02580 |
| Sonnet 5 | $0.00033 | $0.01032 |
| Haiku 4.5 | $0.00016 | $0.00516 |
Grade A, and why
aaa-auth-config scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 466 lines — stays where its author put it; the contents beside it link to each section on GitHub.
华为 AAA 认证配置技能 (aaa-auth-config)
适用平台：S 系列 V200R011C10+ / V200R022C00+（含 S5735S-L24T4S-A）/ CloudEngine V200R022C00+ / USG6000E V500R005C20+ / V600R007C20+ 覆盖：AAA 框架 / RADIUS / HWTACACS（TACACS+）/ 802.1X / MAC 认证 / Portal 认证 / 域管理 / 认证模板 / free-rule / 排错 文档来源：《802.1X 认证基础》《802.1X 认证失败故障处理》《配置 RADIUS 和 HWTACACS（V200）》《什么是 TACACS，如何配置 TACACS？》
一、触发场景
召唤关键词：AAA / 802.1X / MAC 认证 / Portal / RADIUS / HWTACACS / TACACS+ / 认证 / 授权 / 计费 / 域管理 / authentication / authentication-profile / dot1x / free-rule / NAC / 统一模式 / 传统模式
典型问题：
- "S5735S 上接 802.1X 认证怎么配？"
- "RADIUS 服务器连不上怎么办？"
- "TACACS+ 认证失败 / 服务器不可达"
- "NAC 统一模式 vs 传统模式 区别"
- "客户端认证拒绝（Access-Reject）"
- "认证模板怎么用？认证域怎么配？"
- "free-rule 是什么？用户认证前能访问什么？"
- "EAP-CHAP / EAP-PAP / EAP 中继 怎么选？"
不适用：
- 防火墙
security-policy/ipsec-vpn（用对应 skill） - 交换机二层 VLAN / 三层接口（用
vlan-config/interface-config）
二、AAA 框架速记
AAA = Authentication（认证）+ Authorization（授权）+ Accounting（计费）
5 大核心组件
| 组件 | 用途 | 关键命令 |
|---|---|---|
| 认证方案 authentication-scheme | 认证模式 + 备份 | authentication-mode radius local |
| 授权方案 authorization-scheme | 授权模式 + 备份 | authorization-mode hwtacacs local |
| 计费方案 accounting-scheme | 计费模式 + 失败策略 | accounting-mode radius + accounting start-fail online |
| 服务器模板 radius-server / hwtacacs-server | 服务器 IP / 端口 / 共享密钥 | radius-server authentication 10.1.1.2 1812 + shared-key cipher ... |
| 域 domain | 绑定上述 4 组件 | domain huawei + 在域下引用 4 方案 |
认证模式（authentication-mode）
| 模式 | 含义 | 备份 |
|---|---|---|
local |
本地用户 | （无需备份） |
radius |
RADIUS 认证 | local（服务器挂掉时降级） |
hwtacacs |
HWTACACS / TACACS+ 认证 | local |
none |
不认证（公开接入） | — |
推荐搭配（生产环境）
authentication-mode radius local # RADIUS 优先 + 本地备份
authorization-mode hwtacacs local # HWTACACS（命令授权）+ 本地备份
accounting-mode radius # 计费一般只用 RADIUS
accounting start-fail online # 计费失败允许上线（推荐）
三、AAA 六步走配置
第 1 步：配置 RADIUS 服务器模板
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 466 lines · 165 tokens per session scan A ed408f975f60
aaa-auth-config is a skill published in the GitHub repository nanxiaoyao/network-huawei-skills (2 stars, last pushed 1mo ago), licensed MIT. It adds 165 tokens to every session and 5,161 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
percepxion-oob
Manage Lantronix out-of-band (OOB) infrastructure via Percepxion central management platform: device inventory, serial port inspection via SLC CLI, firmware compliance, config management, security auditing, and closed-loop incident remediation. Use during outages, maintenance windows, compliance cycles, and…
meraki-security-appliance
Cisco Meraki MX security appliance (read-only) — L3/L7 firewall rules, content filtering, IDS/IPS and AMP settings, site-to-site VPN, traffic shaping via Cisco's official Meraki MCP. Use when auditing Meraki firewall rules, reviewing content filtering, or inspecting MX VPN configuration.
unifi-wifi
Use when UniFi Wi-Fi is slow, unstable, or being tuned: "my wifi is slow but speedtest on the router is fast", "great signal, terrible speed", "should I use 80MHz or 40MHz", "channel planning", "co-channel interference", "DFS channels", "my APs keep picking the same channel", "audit my SSIDs", "hidden SSID", or…
unifi-connect
Use when connecting an agent to a UniFi gateway (UDM Pro, UDM SE, Cloud Gateway) for the first time, or when API calls to one are failing: empty response bodies, curl returning HTTP 000, 401 on a key that works elsewhere, "how do I get a UniFi API key", "SSH is closed on my UDM", "connect to UniFi", "talk to my UniFi…
unifi-clients
Use when operating on UniFi clients, devices, switch ports, or DHCP: "block a device", "kick a client off wifi", "restart an access point", "power cycle a PoE port", "move a device to a different VLAN", "my device is on the wrong subnet after I changed the port", "set a DHCP reservation", "change DHCP DNS servers"…
unifi-context-map
Use when an agent keeps guessing wrong about a UniFi network, when starting recurring agent work against a gateway, or when asked to "map my network", "document my UniFi setup", "build a network inventory", "what's on my network", "why does the agent keep using the wrong AP", or "audit my reservations against…