Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nanxiaoyao/network-huawei-skills --skill ssl-vpngit clone --depth 1 https://github.com/nanxiaoyao/network-huawei-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nanxiaoyao/network-huawei-skills/ssl-vpn)<a href="https://agentmods.dev/skills/nanxiaoyao/network-huawei-skills/ssl-vpn"><img src="https://agentmods.dev/badge/skills/nanxiaoyao/network-huawei-skills/ssl-vpn/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nanxiaoyao/network-huawei-skills/ssl-vpn"><img src="https://agentmods.dev/badge/skills/nanxiaoyao/network-huawei-skills/ssl-vpn.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00104 | $0.02130 |
| Opus 5 | $0.00052 | $0.01065 |
| Sonnet 5 | $0.00021 | $0.00426 |
| Haiku 4.5 | $0.00010 | $0.00213 |
Grade A, and why
ssl-vpn scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.
华为 USG SSL VPN 配置技能 (ssl-vpn)
适用平台：
- USG6000E V600R007C20+
- USG6000 / USG9500 / NGFW Module V500R005C20+
文档来源 华为 USG 产品文档 (sec_case_sslvpn_*)
⚠️ 版本差异提醒：V500 与 V600 在 SSL VPN 部分命令不一致，使用前请先看「版本差异」章节。
USG SSL VPN 给移动办公用户提供安全接入 终端走浏览器或 SecoClient 客户端 无需公网 IP 走 HTTPS 443
⚠️ V500 vs V600 命令差异（重要）
1. network-extension netpool 网址池
V500 无 ID语法（单池）：
network-extension netpool 172.16.1.1 172.16.1.100 255.255.255.0
V600 有 ID（支持多池）：
network-extension netpool 1 172.16.1.1 172.16.1.100 255.255.255.0
netpool 1 default
2. 推送内网路由命令
V500：network-extension manual-route <network> <mask>
V600：network-extension permit-route <network> <mask>
3. 角色配置
V500：
v-gateway example
role
role director
network-extension enable
web-proxy enable
web-proxy resource ERP
V600 类似但需先绑 condition：
v-gateway example
role
role director
condition all
user-group /cce.com/director
domain-resource share resource1 enable
4. 用户导入 (V500/V600 一致)
两者都使用 user-manage import-policy <name> from { ad | ldap } 语法。
触发场景
- 移动办公 出差访问公司内网
- 浏览器访问内部 Web Mail / ERP（Web Proxy）
- 远程访问文件共享 SMB/CIFS（文件共享业务）
- 远程访问 Telnet/SSH/RDP（端口转发）
- 全网通 全隧道接入内网（网络扩展）
- 对接 AD/LDAP/RADIUS 域认证
- 证书认证 / 双因子认证
- SecoClient 客户端部署
SSL VPN 五大业务类型
| 业务 | 适用场景 | 客户端要求 |
|---|---|---|
| Web 代理（Web Link/改写） | 浏览器访问内部 HTTP 应用 | 仅浏览器 |
| 文件共享 | 访问 SMB/CIFS 共享 | 仅浏览器 |
| 端口转发 | 访问 Telnet/SSH/RDP | 浏览器+控件 |
| 网络扩展 Network Extension | 全隧道 等同于在内网 | SecoClient 或浏览器控件 |
| Web 改写 | 不支持的复杂 Web 应用 | 仅浏览器 |
最常用：网络扩展 + AD 认证
配置六步走
1 接口与安全区域
外网接口（接 untrust）+ 内网接口（接 trust）
2 安全策略（关键 容易漏）
必须配 4 条：
1) untrust → local 开放 https 443 允许用户接入 SSL VPN
2) local → trust FW 访问内网资源（代理/文件共享回包）
3) untrust → trust 网络扩展用户访问内网 源地址为虚拟 IP 池
4) local → 认证服务器所在 zone 允许对接 AD/LDAP/RADIUS
3 认证服务器对接（AD 范式）
ad-server template ad_server
ad-server authentication 10.3.0.155 88 no-ssl
ad-server authentication base-dn dc=cce,dc=com
ad-server authentication manager cn=administrator,cn=users Admin@123 Admin@123
ad-server user-filter sAMAccountName
ad-server group-filter ou
test-aaa user_0001 Admin@123 ad-template ad_server
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 243 lines · 104 tokens per session scan A 7427ee62a045
ssl-vpn is a skill published in the GitHub repository nanxiaoyao/network-huawei-skills (2 stars, last pushed 1mo ago), licensed MIT. It adds 104 tokens to every session and 2,130 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
chinese-git-workflow
A reference for configuring Git with Chinese code-hosting services such as Gitee, Coding.net, GitLab China, and CNB, including SSH, HTTPS, credentials, CI, and repository mirroring.
chinese-documentation
A Chinese technical-documentation style guide covering spacing, punctuation, numbers, terminology, and links when Chinese and English appear together.
patent-map
A tool for making a visual map of stored patent case notes in an Obsidian vault. Obsidian is a note-taking application that stores linked text files.
seedance-vocab-zh
This skill should be used when the user asks for Chinese Seedance 2.0 prompt wording, Mandarin cinematic vocabulary, Chinese prompt compression, or translation of camera, lighting, action, VFX, audio, and production terms into Chinese.
percepxion-oob
Manage Lantronix out-of-band (OOB) infrastructure via Percepxion central management platform: device inventory, serial port inspection via SLC CLI, firmware compliance, config management, security auditing, and closed-loop incident remediation. Use during outages, maintenance windows, compliance cycles, and…
fmc-firewall-ops
Cisco Secure Firewall FMC — access policy search, rule inspection, FTD device targeting, multi-FMC profile management. Use when searching firewall rules by IP or FQDN, checking if host A can reach host B through the firewall, auditing FMC access policies, or reviewing SGT-based segmentation rules.