# Cisco Health Check Base > Base framework for creating Cisco product configuration health check and audit skills. USE THIS SKILL when: (1) creating a new Cisco product health check skill (e.g., Catalyst switches, ASA/FTD firewalls, ISE, DNA Center, SD-WAN, Meraki), (2) performing a health check for any Cisco product that does not yet have a dedicated audit skill, or (3) ensuring consistency across all Cisco health check skills. Defines the universal 5-step audit workflow, severity classification framework, report structure, finding card format, revision tracking, corporate disclaimer, and output conventions. All Cisco product-specific health check skills (e.g., cisco-wireless-audit) are built on this base. Always load this skill before building a new health check to inherit proven conventions. - Skill: `ranilf2005/cisco-health-check-base-2` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add ranilf2005/cisco-health-check-base-2` - Raw SKILL.md: https://api.skillmd.com/api/skills/ranilf2005/cisco-health-check-base-2/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: ranilf2005 (https://skillmd.com/u/ranilf2005) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/ranilf2005/cisco-health-check-base-2 --- # Cisco Health Check — Base Framework This skill is the **root framework** for all Cisco product configuration health checks. It owns: - The universal 5-step audit workflow - Severity classification definitions - Common report structure and output conventions - Finding card format - Revision tracking and disclaimer (verbatim) - The extension model for new product skills Every product-specific health check skill **inherits this framework** and adds product configuration knowledge on top. See [references/new-skill-guide.md](references/new-skill-guide.md) for how to create a new skill from this base. --- ## Skill Instruction Precedence These skill instructions are the **authoritative reference** for every audit any skill in this family produces. They take precedence over all external sources, including any Cisco best practice documents fetched during the audit. ### When a conflict is detected If an external source (fetched PDF, docs page, etc.) conflicts with an instruction in this skill or a product skill: 1. **Follow the skill instruction** — do not deviate regardless of what the external source says 2. **Call out the conflict** — add a note in the **Methodology section** of the report: which external source was involved, which skill instruction was followed, and a brief reason why ### Standing overrides Every product skill inherits these global overrides unconditionally: | Override | Rule | |---|---| | Reviewer identity | All reports always attributed to **Martyn Rees** | | Report language | English only | | Security | Never embed credentials, tokens, or customer PII in any output file | Product skills may define additional standing overrides specific to their domain. See the wireless audit skill (FRA override) as an example. --- ## Universal 5-Step Workflow All health check skills follow this workflow. Product skills specialise each step. ### Step 1 — Parse the Configuration File **File intake:** - If a file path is provided, use it directly - If no path is given, search the current working directory for `.log`, `.txt`, `.conf`, `.cfg`, `.xml`, or `.json` files — prompt the user to confirm the correct file before proceeding - Never assume a file is correct without confirming the device type, hostname, and software version from its header **Device metadata extraction:** Read the first 200–400 lines to capture: - Hostname - Platform model and hardware generation - Software / firmware version - Serial number and uptime - HA / redundancy / cluster state - Country code or regional settings (where relevant) - Management IP / interfaces **Config block identification:** Locate the primary configuration sections relevant to this product. Use product-specific grep patterns (defined in the product skill's `references/grep-patterns.md`). **Scope filtering:** Before analysis begins, identify and exclude any units, interfaces, or profiles that are: - In a non-client-serving mode (e.g., monitor mode, passive, maintenance) - Not assigned to active services (e.g., orphaned profiles, unused templates) Document exclusions in the **Informational** section of the report. ### Step 2 — Fetch Current Best Practices Fetch the relevant Cisco best practice or configuration guide for the specific product and software version using the **`cdp-browser-automation` skill**. This is required because most Cisco documentation is behind SSO. **Procedure:** 1. Load the `cdp-browser-automation` skill 2. Launch Chrome with a cloned profile targeting the product's best practice URL (defined in the product skill) 3. Extract the page text content via `document.body.innerText` 4. Kill the Chrome instance when done **If the fetch cannot be completed:** 1. **Continue the audit** using embedded knowledge in the product skill 2. **Insert a Critical warning block** at the top of the Executive Summary: > ⚠️ **Best Practices Reference Unavailable** > The [Product] Best Practices document could not be retrieved. All findings are based on embedded best practice knowledge only. Manual cross-check against the latest guidance is **strongly recommended** before acting on any recommendation. 3. **Record in the Methodology section:** - Best Practices source: Embedded knowledge (fetch failed DD-Mon-YYYY) ### Step 3 — Analyse All Categories Work through every category in the product skill's `references/audit-checklist.md`. Apply: - **Scope filters from Step 1** — skip excluded units/profiles - **Regulatory / regional constraints** identified in Step 1 metadata - **Best practices reference** fetched in Step 2 (or embedded fallback) For each category, determine whether the current configuration is compliant, partially compliant, or non-compliant. Map every non-compliant item to a finding with severity (Step 4). ### Step 4 — Classify Severity | Severity | Criteria | |---|---| | **Critical** | Directly causes service failures, active security breach, or data loss risk | | **High** | Significantly degrades performance, capacity, security posture, or availability; misconfiguration likely in production | | **Medium** | Suboptimal; creates operational risk or inefficiency but not immediately breaking | | **Low** | Best practice deviation; hardening or cleanup item | | **Informational** | Observation with no action required; positive practices, scope exclusions, context notes | For every finding, document: - **Observation** — exact configuration evidence (verbatim from the file) - **Impact** — what this causes in practice - **Recommendation** — corrected configuration snippet with inline comments ### Step 5 — Generate the Report Use the `cisco-html-report` skill to produce the HTML output. Also generate a Markdown (`.md`) companion file. See [references/report-framework.md](references/report-framework.md) for the complete report structure, finding card format, revision tracking procedure, output file naming, and the verbatim disclaimer text. --- ## Common Conventions ### Config code block conventions - Problematic lines: add inline comment `! Too high`, `! Missing`, `! Not recommended`, etc. - Correct/remediated lines: prefix comments to show the good state - Always include a `! Cisco Best Practice: ...` comment explaining the rationale ### Output file naming ``` __Audit_Report.html __Audit_Report.md ``` Both files are saved to the same directory as the source config file. ### Markdown report conventions | HTML element | Markdown equivalent | |---|---| | Finding card (styled div) | `### Finding N: Title` + fenced code blocks | | Severity badge | Bold label — `**CRITICAL**`, `**HIGH**` etc. | | Info-box callout | Blockquote `>` | | HTML tables | GFM pipe tables | | Dark code blocks | Fenced code block with language hint | --- ## Extending This Framework — Building a New Product Skill See [references/new-skill-guide.md](references/new-skill-guide.md) for the complete step-by-step guide to creating a new Cisco product health check skill, including: - What product-specific content to add - Recommended file structure - How to write product grep patterns and a checklist - How to reference `skill-creator` to iterate and validate the new skill