Cisco Secure Firewall Audit Skill
This skill extends the Cisco health-check base framework and mirrors the same workflow style used by the uploaded wireless audit example.
Tier 0
Use this skill when the source material is a Cisco Secure Firewall health check report, FMC export, FTD notes, or copied findings and the user wants structured audit output, compliance mapping, or branded HTML.
Tier 1
- Parse the input file and normalize the text
- Extract metadata and evidence using
references/grep-patterns.md - Evaluate all categories in
references/audit-checklist.md - Cross-check severity using
references/reference-values.md - Generate branded HTML and Markdown using
references/report-templates.md
Tier 2
Advanced scope:
- Combine Word report content with raw FMC/FTD CLI evidence
- Preserve customer-authored findings where they already exist
- Mark ambiguous items as
Manual reviewrather than inventing evidence - Exclude historical or already-remediated exceptions from negative findings
Common failure modes
- Source report has recommendations but no evidence lines
- Device versions are missing, so lifecycle severity must be capped
- Rules engine misses findings because the customer's wording differs from expected keywords
- Placeholder or template text is misread as active evidence
Purpose
This skill converts Cisco Secure Firewall health-check input files into branded HTML, Markdown, and JSON reports.
Input types
- .docx
- .md
- .txt
- .log
- .cfg
- .conf
Workflow
- Read the source file from
input/reports/. - Extract plain text and structural content.
- Use
references/grep-patterns.mdto locate evidence. - Use
references/audit-checklist.mdto evaluate findings. - Use
references/reference-values.mdfor target values and severity. - Use
references/report-templates.mdto build the output structure. - Generate:
- HTML report
- Markdown report
- JSON findings file
Report rules
- Preserve exact evidence excerpts where possible.
- Do not include credentials or sensitive values.
- Keep output professional and customer-friendly.
- Show positive findings separately.
- Include methodology and disclaimer in every report.
- If evidence is incomplete, mark the item as unclear rather than guessing.
Output locations
output/html/output/markdown/output/json/output/extracted/