Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nanxiaoyao/network-huawei-skills --skill mirrorgit clone --depth 1 https://github.com/nanxiaoyao/network-huawei-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nanxiaoyao/network-huawei-skills/mirror)<a href="https://agentmods.dev/skills/nanxiaoyao/network-huawei-skills/mirror"><img src="https://agentmods.dev/badge/skills/nanxiaoyao/network-huawei-skills/mirror/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nanxiaoyao/network-huawei-skills/mirror"><img src="https://agentmods.dev/badge/skills/nanxiaoyao/network-huawei-skills/mirror.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00127 | $0.02744 |
| Opus 5.5 | $0.00051 | $0.01098 |
| Sonnet 5.5 | $0.00025 | $0.00549 |
| Haiku 4.5 | $0.00013 | $0.00274 |
Grade A, and why
mirror scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 281 lines — stays where its author put it; the contents beside it link to each section on GitHub.
华为交换机镜像配置技能 (mirror)
适用平台 S 系列 V200R011C10+ ｜ CE 系列 V200R022C00+ 文档来源 华为产品文档 dc_cfg_mirror_*
镜像把流量复制一份送到观察口 用于流量分析 抓包 安全审计 不影响原业务
触发场景
- 业务异常 要抓包定位
- 安全审计 流量监听
- 接 IDS/IPS/流量分析仪
- 排查广播风暴 / ARP 异常
- 验证 ACL 是否生效
- 配置远程镜像 跨设备送流量
镜像类型对比
| 类型 | 复制源 | 复制到 | 适用 |
|---|---|---|---|
| 本地端口镜像 Local Port | 接口入/出/双向 | 本机另一接口 | 单机抓包 最简单 |
| 远程端口镜像 RSPAN | 接口流量 | 远端设备的接口（经 VLAN 传输） | 跨设备抓包 |
| 本地流镜像 Local Flow | 符合 ACL 的流量 | 本机另一接口 | 精确抓取某类流量 |
| 远程流镜像 | 符合 ACL 的流量 | 远端接口 | 跨设备精准抓 |
| MQC 镜像 | 流分类匹配的流 | 本机/远端 | 灵活分类 |
基本概念
| 术语 | 解释 |
|---|---|
| 镜像源 mirror source | 被复制流量的接口或流 |
| 观察口 observe-port | 接收复制流量的接口（接抓包设备） |
| 镜像方向 | inbound 入 / outbound 出 / both 双向 |
| 镜像比例 | 全部 1:1 或按比例采样 |
配置三步走 本地端口镜像
1 配置观察口
system-view
observe-port 1 interface GigabitEthernet 0/0/24
观察口接抓包电脑或流量分析仪 不能再做其他业务
2 配置镜像源
interface GigabitEthernet 0/0/1
port-mirroring to observe-port 1 inbound # 入向
port-mirroring to observe-port 1 outbound # 出向
port-mirroring to observe-port 1 both # 双向
3 验证
display observe-port
display port-mirroring
远程镜像 RSPAN
拓扑
[源SW] → 业务VLAN透传镜像VLAN → [中间SW] → [目的SW with 观察口]
配置 源 SW
# 1 创建镜像 VLAN
vlan 100
description Mirror-VLAN
quit
# 2 观察口指向镜像 VLAN
observe-port 1 vlan 100
# 3 镜像源接口
interface GigabitEthernet 0/0/1
port-mirroring to observe-port 1 inbound
# 4 上联口透传镜像 VLAN
interface GigabitEthernet 0/0/24
port link-type trunk
port trunk allow-pass vlan 100
配置 中间 SW
# 只需透传镜像 VLAN
interface GigabitEthernet 0/0/1
port link-type trunk
port trunk allow-pass vlan 100
interface GigabitEthernet 0/0/2
port link-type trunk
port trunk allow-pass vlan 100
配置 目的 SW
# 1 镜像 VLAN
vlan 100
# 2 抓包口加入镜像 VLAN
interface GigabitEthernet 0/0/24
port link-type access
port default vlan 100
抓包设备从该接口收到所有源 SW 的镜像流量
本地流镜像（按 ACL）
# 1 定义 ACL 圈定关心的流量
acl number 3000
rule 5 permit tcp source 10.1.1.0 0.0.0.255 destination-port eq 80
quit
# 2 创建流分类
traffic classifier c1
if-match acl 3000
quit
# 3 创建流行为 引用观察口
traffic behavior b1
mirror to observe-port 1
quit
# 4 流策略绑定
traffic policy p1
classifier c1 behavior b1
quit
# 5 接口下发
interface GigabitEthernet 0/0/1
traffic-policy p1 inbound
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 281 lines · 127 tokens per session scan A 0c9f1b35f9f8
mirror is a skill published in the GitHub repository nanxiaoyao/network-huawei-skills (2 stars, last pushed 3mo ago), licensed MIT. It adds 127 tokens to every session and 2,744 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gke-ai-troubleshooting-tpu-dynamic-slices-monitoring
Monitors, troubleshoots, and manages GKE TPU Dynamic Slices custom resources. Use when checking TPU slice lifecycle states, troubleshooting slice provisioning failures, validating single-slice or multi-slice (JobSet) workload manifests, or safely patching stuck finalizers and disabling the slice controller. Don't use…
gke-ai-troubleshooting-tpu-vbar-oom
Diagnoses and prevents vbarcontrolagent segfaults, out-of-memory (OOM) errors, and TPU device initialization failures on TPU v6e nodes in GKE caused by race conditions during TPU device resets or high-frequency metrics polling. Use when troubleshooting vbarcontrolagent crashes, memory cgroup OOMs in serial console…
doca-flow
DOCA Flow packet steering on NVIDIA NICs/DPUs, linked into a C application: match/action pipes, ports, representors, forwarding, hairpin, counters. Trigger on packet steering, classifier, rule-matching, representor, hairpin or 5-tuple-to-queue questions even when "DOCA Flow" is not named. Also covers pipe validation…
systematic-debugging
A step-by-step method for finding the underlying cause of technical problems before changing code. It covers reading errors, reproducing failures, checking recent changes, and tracing data across system components.
diagnose-driver-install
Diagnose NVIDIA driver installation failures on DeepOps-managed nodes — nvidia-smi errors, "No devices were found", DKMS build failures, or GPU pods crash-looping. Use before reinstalling anything.
percepxion-oob
Manage Lantronix out-of-band (OOB) infrastructure via Percepxion central management platform: device inventory, serial port inspection via SLC CLI, firmware compliance, config management, security auditing, and closed-loop incident remediation. Use during outages, maintenance windows, compliance cycles, and…