Cisco Health Check Base

Cisco Health Check — Base Framework

This skill is the root framework for all Cisco product configuration health checks. It owns:

• The universal 5-step audit workflow
• Severity classification definitions
• Common report structure and output conventions
• Finding card format
• Revision tracking and disclaimer (verbatim)
• The extension model for new product skills

Every product-specific health check skill inherits this framework and adds product configuration knowledge on top. See references/new-skill-guide.md for how to create a new skill from this base.

Skill Instruction Precedence

These skill instructions are the authoritative reference for every audit any skill in this family produces. They take precedence over all external sources, including any Cisco best practice documents fetched during the audit.

When a conflict is detected

If an external source (fetched PDF, docs page, etc.) conflicts with an instruction in this skill or a product skill:

1. Follow the skill instruction — do not deviate regardless of what the external source says
2. Call out the conflict — add a note in the Methodology section of the report: which external source was involved, which skill instruction was followed, and a brief reason why

Standing overrides

Every product skill inherits these global overrides unconditionally:

Product skills may define additional standing overrides specific to their domain. See the wireless audit skill (FRA override) as an example.

Universal 5-Step Workflow

All health check skills follow this workflow. Product skills specialise each step.

Step 1 — Parse the Configuration File

File intake:

• If a file path is provided, use it directly
• If no path is given, search the current working directory for .log, .txt, .conf, .cfg, .xml, or .json files — prompt the user to confirm the correct file before proceeding
• Never assume a file is correct without confirming the device type, hostname, and software version from its header

Device metadata extraction: Read the first 200–400 lines to capture:

• Hostname
• Platform model and hardware generation
• Software / firmware version
• Serial number and uptime
• HA / redundancy / cluster state
• Country code or regional settings (where relevant)
• Management IP / interfaces

Config block identification: Locate the primary configuration sections relevant to this product. Use product-specific grep patterns (defined in the product skill's references/grep-patterns.md).

Scope filtering: Before analysis begins, identify and exclude any units, interfaces, or profiles that are:

• In a non-client-serving mode (e.g., monitor mode, passive, maintenance)
• Not assigned to active services (e.g., orphaned profiles, unused templates)

Document exclusions in the Informational section of the report.

Step 2 — Fetch Current Best Practices

Fetch the relevant Cisco best practice or configuration guide for the specific product and software version using the cdp-browser-automation skill. This is required because most Cisco documentation is behind SSO.

Procedure:

1. Load the cdp-browser-automation skill
2. Launch Chrome with a cloned profile targeting the product's best practice URL (defined in the product skill)
3. Extract the page text content via document.body.innerText
4. Kill the Chrome instance when done

If the fetch cannot be completed:

1. Continue the audit using embedded knowledge in the product skill
2. Insert a Critical warning block at the top of the Executive Summary:

   ⚠️ Best Practices Reference Unavailable The [Product] Best Practices document could not be retrieved. All findings are based on embedded best practice knowledge only. Manual cross-check against the latest guidance is strongly recommended before acting on any recommendation.

3. Record in the Methodology section:
   • Best Practices source: Embedded knowledge (fetch failed DD-Mon-YYYY)

Step 3 — Analyse All Categories

Work through every category in the product skill's references/audit-checklist.md. Apply:

• Scope filters from Step 1 — skip excluded units/profiles
• Regulatory / regional constraints identified in Step 1 metadata
• Best practices reference fetched in Step 2 (or embedded fallback)

For each category, determine whether the current configuration is compliant, partially compliant, or non-compliant. Map every non-compliant item to a finding with severity (Step 4).

Step 4 — Classify Severity

For every finding, document:

• Observation — exact configuration evidence (verbatim from the file)
• Impact — what this causes in practice
• Recommendation — corrected configuration snippet with inline comments

Step 5 — Generate the Report

Use the cisco-html-report skill to produce the HTML output. Also generate a Markdown (.md) companion file. See references/report-framework.md for the complete report structure, finding card format, revision tracking procedure, output file naming, and the verbatim disclaimer text.

Common Conventions

Config code block conventions

• Problematic lines: add inline comment ! Too high, ! Missing, ! Not recommended, etc.
• Correct/remediated lines: prefix comments to show the good state
• Always include a ! Cisco Best Practice: ... comment explaining the rationale

Output file naming

<Hostname>_<ProductShortName>_Audit_Report.html
<Hostname>_<ProductShortName>_Audit_Report.md

Both files are saved to the same directory as the source config file.

Markdown report conventions

Extending This Framework — Building a New Product Skill

See references/new-skill-guide.md for the complete step-by-step guide to creating a new Cisco product health check skill, including:

• What product-specific content to add
• Recommended file structure
• How to write product grep patterns and a checklist
• How to reference skill-creator to iterate and validate the new skill