Skip to content

v1.0.0 — 24 skills, all reviewed

Choose a tag to compare

View all tags
@fastrevmd-lab fastrevmd-lab released this 05 Aug 16:21
· 137 commits to main since this release
v1.0.0
20ffd8c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First tagged release. 24 skills across five families, 24/24 with an independent technical review behind them.

curl -fsSL https://raw.githubusercontent.com/fastrevmd-lab/fwskillsshare/main/install.sh | bash

Install everything, one family (--family srx), or a single skill (--skill srx-nat). Targets Claude Code, Codex, and Hermes.

What's in it

Family Skills
Config parsers 4 — Cisco ASA/FTD, FortiGate, PAN-OS, Juniper SRX → one shared intermediate schema
SRX operational playbooks 9
NGFW compliance and STIG 7 — PCI, HIPAA, CMMC/NIST 800-171, CIS, ISO 27001, SOC 2, SRX DISA STIG
Cross-vendor tooling 3 — best-practices audit, conversion, diff
Security management deployment 1 — Security Director On-Prem on Proxmox

Since the last milestone

Two new skills reached 1.0.0.

  • srx-license-signature-maintenance — AppID and IDP/IPS entitlement audit, license installation, and offline signature updates behind two independent approval gates, with secret-safe license handling, per-node chassis-cluster verification, pilot-then-batch rollout, and condition-based polling. Validated read-only across 9 devices / 10 node records on three Junos releases.
  • sd-onprem-proxmox-deploy — promoted after three complete field deployments.

Live-device validation found and fixed real defects. These were not caught by review or offline tests:

  • parsing-srx-configs did not extract security dynamic-address, so GeoIP and feed-backed objects read as dangling references — false SEC-ORPHAN-REF on every rule using one.
  • It also dropped match dynamic-application, which collapsed distinct AppID-scoped rules into false SEC-REDUNDANT pairs and let an AppID-scoped deny pass as a terminal deny-all, silencing SEC-NO-DENY-ALL on a device that had none.
  • show system license accepts no node argument on a chassis cluster — every per-node form is a syntax error, while the IDP and AppID version commands do take node 0/node 1.
  • IDP and AppID emit different version-qualifier formats; one parser written to the IDP shape mis-handles AppID.
  • On a live cluster the two nodes disagreed on AppID package version while IDP matched — the case that justifies per-node verification, found in the field rather than in a fixture.

Security Director On-Prem onboarding now gates on proven NTP sync. A skewed SRX clock completes the mTLS handshake and gets its payloads acknowledged while logs never appear in the GUI. The gate decides on show ntp associations, because sync_ntp alone can accompany no_sys_peer and a missing clock_sync can accompany a genuinely synced device.

Honest boundaries

  • The licensing skill's mutating paths (request system license add, security-package install) have never been executed against hardware. The read-only surface is validated; that boundary is documented in the skill-test record.
  • CI here gates secret scanning only. Everything else — 14 validators, installer e2e, trivy — runs locally.
  • These are research and assessment-support skills, not certified products. Review output against current vendor documentation, live device behavior, and a qualified assessor before relying on it.

Unofficial community project, MIT licensed. Not affiliated with Cisco, Fortinet, Palo Alto Networks, Juniper Networks, or HPE.

Assets 2
Loading