unifi-firewall

unifi-firewall is a skill for Claude Code from t3chnaztea/unifi-skills. It costs 147 tokens per session (1,680 once invoked), scanned A, original, MIT.

Instructions for managing firewall rules and network zones on UniFi gateways. A zone-based firewall controls traffic between groups of networks, such as an internal network and an IoT network.

In plain words
What is it for?
Finding the correct UniFi firewall and zone endpoints, isolating devices such as cameras or IoT equipment, and troubleshooting segmented networks.
Why use it?
Older UniFi API paths can return no rules even when rules exist, leading an agent to misunderstand the gateway's security setup.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the unifi plugin — 6 skills shipped together

Good fit Finding the correct UniFi firewall and zone endpoints, isolating devices such as cameras or IoT equipment, and troubleshooting segmented networks.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/t3chnaztea/unifi-skills/unifi-firewall
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add t3chnaztea/unifi-skills --skill unifi-firewall
Clone the repo
git clone --depth 1 https://github.com/t3chnaztea/unifi-skills

Made for: Claude Code.

Or install unifi, the plugin that ships this one along with the rest of its 6 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for unifi-firewall

README.md
[![agentmods](https://agentmods.dev/badge/skills/t3chnaztea/unifi-skills/unifi-firewall/github.svg)](https://agentmods.dev/skills/t3chnaztea/unifi-skills/unifi-firewall)
Your own site
<a href="https://agentmods.dev/skills/t3chnaztea/unifi-skills/unifi-firewall"><img src="https://agentmods.dev/badge/skills/t3chnaztea/unifi-skills/unifi-firewall/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for unifi-firewall

Your own site · 80×15
<a href="https://agentmods.dev/skills/t3chnaztea/unifi-skills/unifi-firewall"><img src="https://agentmods.dev/badge/skills/t3chnaztea/unifi-skills/unifi-firewall.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 147 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,680 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00147 $0.01680
Opus 5 $0.00073 $0.00840
Sonnet 5 $0.00029 $0.00336
Haiku 4.5 $0.00015 $0.00168

Measured 12d ago against content hash a3358dabc7a8, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

unifi-firewall scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/unifi-firewall/SKILL.md · 159 lines

How it starts

The opening of the file, as written. The whole thing — 159 lines — stays where its author put it; the contents beside it link to each section on GitHub.

UniFi Firewall

Modern UniFi Network replaced the old LAN-IN / LAN-LOCAL / WAN-IN rule groups with a zone-based firewall. Every network belongs to a zone, and policies govern traffic between zone pairs rather than between interfaces. This is a better model and a worse migration, because the old API endpoint still exists and still answers.

Why your firewall rules look empty

udm raw GET /proxy/network/api/s/default/rest/firewallrule
# []

An empty array. The endpoint is alive, authenticated, and lying by omission: on a zone-based controller your rules are not there. They are here:

udm policies    # GET /proxy/network/v2/api/site/default/firewall-policies
udm zones       # GET /proxy/network/v2/api/site/default/firewall/zone

An agent that reads rest/firewallrule, sees [], and concludes the network is unfirewalled will confidently propose rebuilding rules that already exist. If a gateway reports zero firewall rules and it is clearly not wide open, you are on the wrong endpoint.

The zone endpoint is singular. /firewall/zone works, /firewall/zones 404s. There is no reason for this; just remember it.

The trap: new zones default to BLOCK against Internal

The single most expensive thing to learn the hard way.

Creating a new custom zone auto-generates default policies, and the Internal↔zone pair defaults to BLOCK in both directions. External and Gateway pairs default to allow, and custom→External allows, so the new zone reaches the internet fine. What it loses, instantly and completely, is the trusted LAN: DNS resolvers, the media server, the home-automation hub, the NAS.

The failure mode is nasty because it is partial. Devices still have internet. They still associate, still pull DHCP, still look healthy in the controller. They just cannot resolve names against your internal resolver, so everything degrades ten seconds later in a way that reads like a DNS outage.

Stage the allow policies before you create the zone. Have the payloads written and ready to POST, create the zone, then immediately POST the allows. Do not create a zone at the end of a session, and do not create one for a segment containing anything you or your household will notice going down.

Read the full file on GitHub · 159 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 159 lines · 147 tokens per session scan A a3358dabc7a8

Subscribe to this mod's changes

unifi-firewall is a skill published in the GitHub repository t3chnaztea/unifi-skills (39 stars, last pushed 20d ago), licensed MIT. It adds 147 tokens to every session and 1,680 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

unifi-cli

Use when asked about UniFi network gear or the local network — access points, gateway, switches, WiFi, or which clients/devices are connected. Queries the local UniFi gateway via the unifi CLI.

baileywickham/unifi-cli · 49 tokens

lab-hardware-cad

Design custom laboratory hardware as parametric build123d models and export fabrication-ready STEP, STL, and DXF files - microfluidic chips and molds, optomechanical mounts and breadboard adapters, cuvette and microplate holders, tube racks, animal-behavior rigs, and 3D-printed instrument fixtures. Use when a research…

K-Dense-AI/scientific-agent-skills · 106 tokens

opentrons-integration

Author, review, migrate, simulate, and troubleshoot official Opentrons Python Protocol API v2 protocols for Flex and OT-2 robots. Use for robot-specific liquid handling, deck and labware setup, pipettes, modules, runtime parameters, liquid classes, and Opentrons App analysis. Use pylabrobot instead when one workflow…

K-Dense-AI/scientific-agent-skills · 79 tokens

pylabrobot

Develop and review PyLabRobot lab-automation resources, liquid-handling plans, offline simulations, and supported-device integrations. Use for PyLabRobot protocols or API questions; keep physical execution behind an explicit operator safety gate.

K-Dense-AI/scientific-agent-skills · 49 tokens

offensive-wifi

Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons…

SnailSploit/Claude-Red · 183 tokens

offensive-wifi-recon

Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSID/ESSID/channel/PMF/encryption fingerprinting, client probe analysis, vendor OUI lookup, war-driving with Kismet/airodump-ng/Wigle, and…

SnailSploit/Claude-Red · 130 tokens