How do I install the Netops Build skill?

Run npx skillmds@latest add con-benksl/netops-build in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Netops Build safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Netops Build?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Netops Build free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Netops Build?

Con-Benksl (@con-benksl) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Netops Build by con-benksl — Agent Skill

Name: Netops Build
Author: Con-Benksl

Netops Build

Audit, plan, and execute authorized VPS networking or proxy-node changes, including 3x-ui, Xray, VLESS Reality, Hysteria2, TLS, DNS, address-family separation, firewall rules, and per-node upstream exits. Use for installing, adding, or changing services while preserving existing behavior. 典型中文请求：装一个节点、增加入站、换域名和证书、给某个节点单独配置出口、修改端口和防火墙。

Con-Benksl 73b3bbb 2 files · 3.5 KB Updated Sep 17, 2026

File contents

NetOps Build

Build from current evidence and make the smallest reviewed change.

Shared Reference Root

Before reading a shared reference, resolve <reference-root> once. Use ../../references when ../../references/guided-dialogue.md exists (repository or monolithic root installation); otherwise use ../netops/references when ../netops/references/guided-dialogue.md exists (flat installation beside the root netops Skill). If neither candidate exists, stop and report an incomplete installation. Do not reconstruct or bypass missing safety rules.

Direct-Invocation Safety

These rules apply even when this child Skill is invoked without the root router. Authorized direct SSH is allowed when the target VPS is unrelated to the agent's current path and the change does not modify the local control plane. Require explicit authorization, affected-state backup, pre-apply validation, post-apply verification, executable rollback, and a concise receipt. Use an exact plan ID and netopsctl change apply when its file-transaction contract fits or when a shared remote path needs automatic rollback; do not force every independent SSH change through that executor. Preserve existing nodes and the host default route unless the reviewed operation explicitly changes either invariant.

Decision Boundary

Follow <reference-root>/guided-dialogue.md. A clear audit-only, plan-only, or execution request proceeds to that boundary without a process menu. Ask one design question only when the answer cannot be discovered safely and would change the implementation. Never ask whether to preserve existing nodes, panel access, SSH, or the default route; those are invariants unless the user explicitly requests a reviewed exception.

Change Flow

Audit the live target and define the exact delta, affected components, invariants, and actual ingress/egress identities.
Apply <reference-root>/control-channel-safety.md and the evidence ladder in <reference-root>/independence-protocol.md.
Use <reference-root>/guided-dialogue.md for execution confirmation and <reference-root>/control-channel-safety.md for the execution mode and transaction lifecycle; those references own the complete contracts.
If control has already been lost, stop the change and use <reference-root>/emergency-recovery.md.

Architecture Defaults

Keep ingress and egress independent; route a named client or inbound to its outbound instead of changing the host default route. Put precise rules before broad defaults, use separate listener identities for separate inbounds, and verify current component/client compatibility before an upgrade.

Use <reference-root>/build-runbook.md for protocol and provider mechanics. Keep those details out of this Skill.

---name: netops-builddescription: Audit, plan, and execute authorized VPS networking or proxy-node changes, including 3x-ui, Xray, VLESS Reality, Hysteria2, TLS, DNS, address-family separation, firewall rules, and per-node upstream exits. Use for installing, adding, or changing services while preserving existing behavior. 典型中文请求：装一个节点、增加入站、换域名和证书、给某个节点单独配置出口、修改端口和防火墙。---# NetOps BuildBuild from current evidence and make the smallest reviewed change.## Shared Reference RootBefore reading a shared reference, resolve `<reference-root>` once. Use `../../references` when `../../references/guided-dialogue.md` exists (repository or monolithic root installation); otherwise use `../netops/references` when `../netops/references/guided-dialogue.md` exists (flat installation beside the root `netops` Skill). If neither candidate exists, stop and report an incomplete installation. Do not reconstruct or bypass missing safety rules.## Direct-Invocation SafetyThese rules apply even when this child Skill is invoked without the root router. Authorized direct SSH is allowed when the target VPS is unrelated to the agent's current path and the change does not modify the local control plane. Require explicit authorization, affected-state backup, pre-apply validation, post-apply verification, executable rollback, and a concise receipt. Use an exact plan ID and `netopsctl change apply` when its file-transaction contract fits or when a shared remote path needs automatic rollback; do not force every independent SSH change through that executor. Preserve existing nodes and the host default route unless the reviewed operation explicitly changes either invariant.## Decision BoundaryFollow `<reference-root>/guided-dialogue.md`. A clear audit-only, plan-only, or execution request proceeds to that boundary without a process menu. Ask one design question only when the answer cannot be discovered safely and would change the implementation. Never ask whether to preserve existing nodes, panel access, SSH, or the default route; those are invariants unless the user explicitly requests a reviewed exception.## Change Flow1. Audit the live target and define the exact delta, affected components, invariants, and actual ingress/egress identities.2. Apply `<reference-root>/control-channel-safety.md` and the evidence ladder in `<reference-root>/independence-protocol.md`.3. Use `<reference-root>/guided-dialogue.md` for execution confirmation and `<reference-root>/control-channel-safety.md` for the execution mode and transaction lifecycle; those references own the complete contracts.4. If control has already been lost, stop the change and use `<reference-root>/emergency-recovery.md`.## Architecture DefaultsKeep ingress and egress independent; route a named client or inbound to its outbound instead of changing the host default route. Put precise rules before broad defaults, use separate listener identities for separate inbounds, and verify current component/client compatibility before an upgrade.Use `<reference-root>/build-runbook.md` for protocol and provider mechanics. Keep those details out of this Skill.

Frequently asked questions