Agent Skills · IT Ops & Security

IT and security skills read configs, logs, and captures, or they draft a hardening step. They belong in a lab or on a host you administer. They do not belong on a capture from a shared network, and they do not belong pointed at a customer system because the category name says security.

Packet-analysis cards are the sharp edge. Captures contain cookies, tokens, and other people's traffic. Trim to the flow you understand before any prompt sees the file. Do not upload a raw pcap to find out what the skill does. When not to install lists this shelf for that reason.

Separate defense from stress testing. A skill that explains a failed TLS handshake is not a skill that generates attacks. Attack generation shows up more honestly under plugin categories such as admin-security, but prompts here sometimes blur the line. Read for the verb. Explain and patch are different from flood and evade.

An agent with shell access plus a security skill will eventually be asked to "just fix it" on production. Do the first run against a reproduced log in a scratch VM. If you cannot reproduce the log, you are not ready to let the skill touch the live host.

Development skills write features. This shelf should be boring: a diagnosis, a diff you can read, a rollback. If the prompt is mostly personality, it is not an ops skill. Stars do not measure whether the suggested iptables rule locked you out. Have the console open.

Write down the frame number the skill cited before you change anything. If you cannot find that frame, there is no finding. A story without a frame is how a production rule gets added for a packet that was never there. Keep the trimmed capture with the note until the rule is reviewed.