How do I install the Cisco Security Audit skill?

Run npx skillmds@latest add bradmccloskey/cisco-security-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cisco Security Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cisco Security Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cisco Security Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cisco Security Audit?

bradmccloskey (@bradmccloskey) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cisco Security Audit by bradmccloskey

Name: Cisco Security Audit
Author: bradmccloskey

File contents

Cisco Security Audit Scripts

Write Python scripts that audit and validate Cisco device security. Follow these standards:

Audit Categories

Device Hardening (CIS Benchmark / STIG aligned)

Check for service password-encryption
Verify enable secret (not enable password)
Ensure no ip http server (or HTTPS only with ACL)
Check login block-for and login delay settings
Verify unused interfaces are shut down and in a blackhole VLAN
Check banner motd / login presence
Verify no cdp run on external interfaces
Check no ip source-route, no ip directed-broadcast
Verify VTY line ACLs and transport input ssh
Ensure ip ssh version 2 and no Telnet

AAA & Access Control

Verify AAA new-model configuration
Check TACACS+/RADIUS server configuration
Validate local fallback account exists
Review privilege levels and role-based access
Check console and AUX line security

Routing Security

Verify routing protocol authentication (OSPF MD5/SHA, BGP MD5, EIGRP)
Check for route filtering on external peers
Validate uRPF (unicast reverse path forwarding)
Check for no ip proxy-arp on appropriate interfaces

ACL Review

Parse and analyze all ACLs
Flag overly permissive rules (permit ip any any)
Identify shadowed rules (unreachable ACEs)
Check ACL application to interfaces (in/out)
Verify management ACLs on VTY lines

ASA / Firewall Specific

Validate security levels on interfaces
Check NAT rules for exposure
Review access-group assignments
Verify failover configuration
Check for any-to-any rules

Output Requirements

Compliance score (percentage of checks passed)
Categorized findings: CRITICAL / HIGH / MEDIUM / LOW / INFO
Each finding includes: description, current config, expected config, remediation command
CSV/JSON export for reporting
Support for baseline comparison over time

Libraries to Use

netmiko for config collection
ciscoconfparse or ttp for config parsing
re for regex-based checks
rich for formatted audit reports
jinja2 for HTML report generation (optional)

Security Requirements for the Script Itself

NEVER hardcode credentials
Use environment variables or secure vault
Log audit actions (who ran what, when)
Do not modify any device configuration (read-only audit)

---name: cisco-security-auditdescription: Generate Python scripts that audit Cisco device security posture. Use when the user wants to check security hardening, compliance, ACL review, or vulnerability assessment of Cisco devices.---## Cisco Security Audit ScriptsWrite Python scripts that audit and validate Cisco device security. Follow these standards:### Audit Categories#### Device Hardening (CIS Benchmark / STIG aligned)- Check for `service password-encryption`- Verify `enable secret` (not `enable password`)- Ensure `no ip http server` (or HTTPS only with ACL)- Check `login block-for` and `login delay` settings- Verify unused interfaces are shut down and in a blackhole VLAN- Check banner motd / login presence- Verify `no cdp run` on external interfaces- Check `no ip source-route`, `no ip directed-broadcast`- Verify VTY line ACLs and `transport input ssh`- Ensure `ip ssh version 2` and no Telnet#### AAA & Access Control- Verify AAA new-model configuration- Check TACACS+/RADIUS server configuration- Validate local fallback account exists- Review privilege levels and role-based access- Check console and AUX line security#### Routing Security- Verify routing protocol authentication (OSPF MD5/SHA, BGP MD5, EIGRP)- Check for route filtering on external peers- Validate uRPF (unicast reverse path forwarding)- Check for `no ip proxy-arp` on appropriate interfaces#### ACL Review- Parse and analyze all ACLs- Flag overly permissive rules (`permit ip any any`)- Identify shadowed rules (unreachable ACEs)- Check ACL application to interfaces (in/out)- Verify management ACLs on VTY lines#### ASA / Firewall Specific- Validate security levels on interfaces- Check NAT rules for exposure- Review access-group assignments- Verify failover configuration- Check for any-to-any rules### Output Requirements- Compliance score (percentage of checks passed)- Categorized findings: CRITICAL / HIGH / MEDIUM / LOW / INFO- Each finding includes: description, current config, expected config, remediation command- CSV/JSON export for reporting- Support for baseline comparison over time### Libraries to Use- `netmiko` for config collection- `ciscoconfparse` or `ttp` for config parsing- `re` for regex-based checks- `rich` for formatted audit reports- `jinja2` for HTML report generation (optional)### Security Requirements for the Script Itself- NEVER hardcode credentials- Use environment variables or secure vault- Log audit actions (who ran what, when)- Do not modify any device configuration (read-only audit)

Frequently asked questions

Cisco Security Audit