[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GX4K560XNG4G64NNZDB7GC":3,"skill-same:01M6GX4K560XNG4G64NNZDB7GC":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":24,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":53,"install":54,"resources":67},"01M6GX4K560XNG4G64NNZDB7GC","netex",null,"Cross-vendor network orchestration umbrella for EmberAI. Coordinates installed vendor plugins (unifi, opnsense, and future vendors) to perform operations that span multiple network systems. Provides unified topology, health, VLAN provisioning, cross-vendor security audits, and policy synchronization. Requires at least one conforming vendor plugin.","bluminal\u002Femberai","bluminal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F260166565?v=4","01M6GX3XC0W0S4DSMM3WVJC3QJ","01M6GX3XJJK9YDQEWW5M24ZRSJ",1,"MIT","https:\u002F\u002Fgithub.com\u002Fbluminal\u002Femberai\u002Fblob\u002Fmain\u002Fnetex\u002Fskills\u002Fnetex\u002FSKILL.md",[],[5,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36],"operations","at","tree","io","systems","coordinates","main","unifi","vendor","github","synchronization","health","vlan","network","plugins","https","plugin","orchestration","policy","2026-11-10 10:12:30",false,"---\nname: netex\nversion: 0.3.1\ndescription: >\n  Cross-vendor network orchestration umbrella for EmberAI. Coordinates\n  installed vendor plugins (unifi, opnsense, and future vendors) to perform\n  operations that span multiple network systems. Provides unified topology,\n  health, VLAN provisioning, cross-vendor security audits, and policy\n  synchronization. Requires at least one conforming vendor plugin.\nauthor: Bluminal Labs\nlicense: MIT\nrepository: https:\u002F\u002Fgithub.com\u002Fbluminal\u002Femberai\u002Ftree\u002Fmain\u002Fnetex\ndocs: https:\u002F\u002Fbluminal.github.io\u002Femberai\u002Fnetex\u002F\n\n# netex is the orchestrator -- it enforces the contract but is not a vendor plugin.\n# It does not declare netex_vendor, netex_role, or netex_skills.\n# It discovers and orchestrates any plugin that conforms to the contract below.\nnetex_contract_version: \"1.0.0\"\n---\n\n# netex -- Cross-Vendor Network Orchestration Umbrella\n\nYou are operating the netex umbrella plugin for EmberAI. Your role is to\norchestrate operations that require coordinating two or more vendor plugins.\n\n## Plugin Discovery\n\nOn startup, query the Plugin Registry to discover installed vendor plugins:\n\n```\nregistry.list_plugins()  -> [{name, vendor, roles[], skills[], write_flag}]\n```\n\nUse this registry -- not hardcoded vendor names -- for all routing decisions.\nExample queries:\n\n```\nregistry.plugins_with_role(\"gateway\")   -> plugins that manage routing\u002Ffirewall\nregistry.plugins_with_role(\"edge\")      -> plugins that manage switching\u002Fports\nregistry.plugins_with_skill(\"firewall\") -> all plugins with firewall audit tools\nregistry.tools_for_skill(\"topology\")    -> all topology tools across all plugins\n```\n\nWhen a required plugin is not installed, tell the operator clearly which\nplugin is missing and what capability it provides. Do not silently degrade.\n\n## Scope\n\nnetex handles CROSS-VENDOR operations only. If an operator asks something\nthat a single vendor plugin can answer alone (e.g., \"show my UniFi clients\"),\nroute it to that plugin directly rather than running it through the umbrella.\nReserve netex commands for operations that genuinely require data or actions\nacross two or more vendor plugins.\n\n## Interaction Model\n\nnetex is an ASSISTANT, not an autonomous agent. This principle is more\ncritical here than in any individual vendor plugin: a cross-vendor operation\ncan touch the gateway AND the edge in the same workflow, compounding the\nblast radius of any mistake.\n\nAll write workflows follow the three-phase model:\n\n### PHASE 1 -- Resolve assumptions\n\nGather state from all relevant vendor plugins using read-only tools.\nIdentify genuine ambiguities (values not determinable from the API).\nRun the OutageRiskAgent and NetworkSecurityAgent in parallel.\nBatch all questions into a single AskUserQuestion call.\n\n### PHASE 2 -- Present the complete cross-vendor plan\n\nStructure the plan as follows (in this order):\n- [OUTAGE RISK]   OutageRiskAgent finding -- risk tier + specific path at risk\n- [SECURITY]      NetworkSecurityAgent findings -- severity-ranked\n- [CHANGE PLAN]   Numbered steps: step #, system, API call, what changes, expected outcome\n- [ROLLBACK]      How completed steps will be reversed if a later step fails\n\nThis phase has no AskUserQuestion.\n\n### PHASE 3 -- Single confirmation\n\nOne AskUserQuestion: \"N steps across [plugin names]. Confirm to proceed,\nor describe a change you'd like to make to the plan.\"\n\nOn confirm: execute steps in order. On failure: stop, report, ask about rollback.\n\n### CRITICAL RISK override\n\nIf OutageRiskAgent returns CRITICAL, require the operator to explicitly state\nthey have out-of-band access before showing the plan. A generic \"yes\" is not\nsufficient -- ask for the specific access method.\n\n## OutageRiskAgent\n\nThe OutageRiskAgent is a read-only sub-agent that runs before every write\nplan. It determines whether the proposed changes could sever the operator's\naccess to the network.\n\nRisk tier output:\n- **CRITICAL**: Change directly modifies the operator's session path. Require explicit out-of-band confirmation.\n- **HIGH**: Change is in the same subsystem; disruption is possible.\n- **MEDIUM**: Change could cause indirect disruption (DNS, DHCP, routing).\n- **LOW**: Change does not intersect the operator's session path.\n\n## NetworkSecurityAgent\n\nThe NetworkSecurityAgent is a read-only sub-agent that runs before every\nwrite plan (automatic) and on demand via `netex secure audit` (manual).\nIt never makes changes.\n\n### Automatic plan review categories\n\n1. VLAN isolation gap\n2. Overly broad firewall rule\n3. Rule ordering risk\n4. VPN split-tunnel exposure\n5. Unencrypted VLAN for sensitive traffic\n6. Management plane exposure\n7. DNS security posture\n\n## Commands\n\n### Read-Only\n\n| Command | Description |\n|---|---|\n| `netex topology` | Unified network topology |\n| `netex health` | Cross-vendor health report |\n| `netex vlan audit` | VLAN consistency check |\n| `netex dns trace \u003Chostname>` | DNS resolution path tracing |\n| `netex vpn status` | VPN tunnel status |\n| `netex secure audit` | 10-domain security audit |\n| `netex verify-policy` | Test connectivity against manifest |\n\n### Write (require NETEX_WRITE_ENABLED + --apply)\n\n| Command | Description |\n|---|---|\n| `netex network provision-site` | Full site bootstrap from manifest |\n| `netex vlan provision-batch` | Batch VLAN creation |\n| `netex policy sync` | Drift detection and correction |\n\n## MCP Tools\n\n| Tool Name | Description |\n|---|---|\n| `netex__network__provision_site` | Site bootstrap from YAML manifest |\n| `netex__network__verify_policy` | Policy verification tests |\n| `netex__vlan__provision_batch` | Batch VLAN creation |\n| `netex__dns__trace` | DNS resolution tracing |\n| `netex__vpn__status` | VPN tunnel status |\n| `netex__policy__sync` | Policy drift sync |\n","# netex -- Cross-Vendor Network Orchestration Umbrella\n\nYou are operating the netex umbrella plugin for EmberAI. Your role is to\norchestrate operations that require coordinating two or more vendor plugins.\n\n## Plugin Discovery\n\nOn startup, query the Plugin Registry to discover installed vendor plugins:\n\n```\nregistry.list_plugins()  -> [{name, vendor, roles[], skills[], write_flag}]\n```\n\nUse this registry -- not hardcoded vendor names -- for all routing decisions.\nExample queries:\n\n```\nregistry.plugins_with_role(\"gateway\")   -> plugins that manage routing\u002Ffirewall\nregistry.plugins_with_role(\"edge\")      -> plugins that manage switching\u002Fports\nregistry.plugins_with_skill(\"firewall\") -> all plugins with firewall audit tools\nregistry.tools_for_skill(\"topology\")    -> all topology tools across all plugins\n```\n\nWhen a required plugin is not installed, tell the operator clearly which\nplugin is missing and what capability it provides. Do not silently degrade.\n\n## Scope\n\nnetex handles CROSS-VENDOR operations only. If an operator asks something\nthat a single vendor plugin can answer alone (e.g., \"show my UniFi clients\"),\nroute it to that plugin directly rather than running it through the umbrella.\nReserve netex commands for operations that genuinely require data or actions\nacross two or more vendor plugins.\n\n## Interaction Model\n\nnetex is an ASSISTANT, not an autonomous agent. This principle is more\ncritical here than in any individual vendor plugin: a cross-vendor operation\ncan touch the gateway AND the edge in the same workflow, compounding the\nblast radius of any mistake.\n\nAll write workflows follow the three-phase model:\n\n### PHASE 1 -- Resolve assumptions\n\nGather state from all relevant vendor plugins using read-only tools.\nIdentify genuine ambiguities (values not determinable from the API).\nRun the OutageRiskAgent and NetworkSecurityAgent in parallel.\nBatch all questions into a single AskUserQuestion call.\n\n### PHASE 2 -- Present the complete cross-vendor plan\n\nStructure the plan as follows (in this order):\n- [OUTAGE RISK]   OutageRiskAgent finding -- risk tier + specific path at risk\n- [SECURITY]      NetworkSecurityAgent findings -- severity-ranked\n- [CHANGE PLAN]   Numbered steps: step #, system, API call, what changes, expected outcome\n- [ROLLBACK]      How completed steps will be reversed if a later step fails\n\nThis phase has no AskUserQuestion.\n\n### PHASE 3 -- Single confirmation\n\nOne AskUserQuestion: \"N steps across [plugin names]. Confirm to proceed,\nor describe a change you'd like to make to the plan.\"\n\nOn confirm: execute steps in order. On failure: stop, report, ask about rollback.\n\n### CRITICAL RISK override\n\nIf OutageRiskAgent returns CRITICAL, require the operator to explicitly state\nthey have out-of-band access before showing the plan. A generic \"yes\" is not\nsufficient -- ask for the specific access method.\n\n## OutageRiskAgent\n\nThe OutageRiskAgent is a read-only sub-agent that runs before every write\nplan. It determines whether the proposed changes could sever the operator's\naccess to the network.\n\nRisk tier output:\n- **CRITICAL**: Change directly modifies the operator's session path. Require explicit out-of-band confirmation.\n- **HIGH**: Change is in the same subsystem; disruption is possible.\n- **MEDIUM**: Change could cause indirect disruption (DNS, DHCP, routing).\n- **LOW**: Change does not intersect the operator's session path.\n\n## NetworkSecurityAgent\n\nThe NetworkSecurityAgent is a read-only sub-agent that runs before every\nwrite plan (automatic) and on demand via `netex secure audit` (manual).\nIt never makes changes.\n\n### Automatic plan review categories\n\n1. VLAN isolation gap\n2. Overly broad firewall rule\n3. Rule ordering risk\n4. VPN split-tunnel exposure\n5. Unencrypted VLAN for sensitive traffic\n6. Management plane exposure\n7. DNS security posture\n\n## Commands\n\n### Read-Only\n\n| Command | Description |\n|---|---|\n| `netex topology` | Unified network topology |\n| `netex health` | Cross-vendor health report |\n| `netex vlan audit` | VLAN consistency check |\n| `netex dns trace \u003Chostname>` | DNS resolution path tracing |\n| `netex vpn status` | VPN tunnel status |\n| `netex secure audit` | 10-domain security audit |\n| `netex verify-policy` | Test connectivity against manifest |\n\n### Write (require NETEX_WRITE_ENABLED + --apply)\n\n| Command | Description |\n|---|---|\n| `netex network provision-site` | Full site bootstrap from manifest |\n| `netex vlan provision-batch` | Batch VLAN creation |\n| `netex policy sync` | Drift detection and correction |\n\n## MCP Tools\n\n| Tool Name | Description |\n|---|---|\n| `netex__network__provision_site` | Site bootstrap from YAML manifest |\n| `netex__network__verify_policy` | Policy verification tests |\n| `netex__vlan__provision_batch` | Batch VLAN creation |\n| `netex__dns__trace` | DNS resolution tracing |\n| `netex__vpn__status` | VPN tunnel status |\n| `netex__policy__sync` | Policy drift sync |\n",{"docs":42,"name":5,"author":43,"license":14,"version":44,"repository":45,"description":46,"netex_contract_version":47},"https:\u002F\u002Fbluminal.github.io\u002Femberai\u002Fnetex\u002F","Bluminal Labs","0.3.1","https:\u002F\u002Fgithub.com\u002Fbluminal\u002Femberai\u002Ftree\u002Fmain\u002Fnetex","Cross-vendor network orchestration umbrella for EmberAI. Coordinates installed vendor plugins (unifi, opnsense, and future vendors) to perform operations that span multiple network systems. Provides unified topology, health, VLAN provisioning, cross-vendor security audits, and policy synchronization. Requires at least one conforming vendor plugin.\n","1.0.0","9d6b1619ec04c0b28e3666ff6bc16f303fd1a340","netex\u002Fskills\u002Fnetex",0,"https:\u002F\u002Fgithub.com\u002Fbluminal\u002Femberai","https:\u002F\u002Fgithub.com\u002Fbluminal","2026-08-18 23:17:24",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add bluminal\u002Femberai --skill netex",{"tool":60,"command":61},"bunx","bunx skills add bluminal\u002Femberai --skill netex",{"tool":63,"command":64},"pnpm","pnpm dlx skills add bluminal\u002Femberai --skill netex","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fbluminal\u002Femberai\u002Fblob\u002Fmain\u002Fnetex\u002Fskills\u002Fnetex\u002FSKILL.md",true,[],[69,91,117,136,159],{"skillNo":70,"name":25,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":37},"01M6GX63EVRSAWS2ARXMMJEJDF","UniFi network intelligence plugin for EmberAI. Provides topology discovery, health monitoring, WiFi analysis, client management, traffic inspection, security audit, configuration drift detection, and multi-site operations across UniFi Site Manager, Cloud V1, and Local Gateway APIs.","https:\u002F\u002Fgithub.com\u002Fbluminal\u002Femberai\u002Fblob\u002Fmain\u002Funifi\u002Fskills\u002Funifi\u002FSKILL.md",[],[25,75,76,77,21,78,79,80,81,24,82,83,84,31,85,86,87,88,89,90],"analysis","manager","traffic","local","across","drift","intelligence","write","wifi","security audit","monitoring","topology","audit","gateway","config","security",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":105,"publishedAt":37},"01M6GX5EF9HEN4QGDKNXEZE81E","talos","Talos Linux Kubernetes cluster intelligence plugin for EmberAI. Provides cluster lifecycle management, node health monitoring, etcd cluster operations, Kubernetes component status, diagnostics, configuration management, security auditing, and image management via talosctl CLI with gRPC + mTLS transport.","https:\u002F\u002Fgithub.com\u002Fbluminal\u002Femberai\u002Fblob\u002Fmain\u002Ftalos\u002FSKILL.md",[97,102],{"categoryNo":98,"categoryName":99,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":103,"categoryName":104,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000016","图像与多媒体",[93,106,107,82,108,109,110,85,111,112,113,89,81,90,114,115,24,20,116,21],"component","images","node","etcd","mtls","grpc","diagnostics","status","cli","image","cluster",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":37},"01M6GX58W7NVFERYSC7QMQ71XC","opnsense","OPNsense gateway intelligence plugin for EmberAI. Provides interface and VLAN management, firewall rule analysis, static routing, VPN tunnel status and configuration, DNS (Unbound), DHCP (Kea), IDS\u002FIPS (Suricata), traffic shaping, live diagnostics, and firmware management via the OPNsense REST API.","https:\u002F\u002Fgithub.com\u002Fbluminal\u002Femberai\u002Fblob\u002Fmain\u002Fopnsense\u002Fskills\u002Fopnsense\u002FSKILL.md",[],[119,124,77,125,21,126,127,81,82,128,129,75,130,131,132,133,134,135,113,24],"unbound","interface","tunnel","vpn","shaping","api","ips","suricata","ids","firewall","firmware","dns",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":150,"publishedAt":37},"01M6GX4S1TT2FKWB50M933TGVG","nextdns","NextDNS intelligence plugin for EmberAI. Provides DNS profile management, security posture auditing, analytics dashboards, query log analysis, and parental control configuration across NextDNS profiles.","https:\u002F\u002Fgithub.com\u002Fbluminal\u002Femberai\u002Fblob\u002Fmain\u002Fnextdns\u002FSKILL.md",[142,145],{"categoryNo":143,"categoryName":144,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":146,"categoryName":147,"taxonomyType":148,"taxonomyTypeDesc":149},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[138,135,151,34,152,90,27,75,20,153,21,154,79,81,155,24,156,157,82,158],"logs","analytics","profiles","control","query","log","log analysis","dashboards",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":37},"01M6GX47T042G7AGSVVCNMMGNC","cisco","Cisco SG-300 managed switch intelligence plugin for EmberAI. Provides VLAN management, port configuration, MAC address table lookup, LLDP topology discovery, interface counters (SNMP), configuration drift detection, and health monitoring via SSH CLI (Netmiko) and SNMPv2c.","https:\u002F\u002Fgithub.com\u002Fbluminal\u002Femberai\u002Fblob\u002Fmain\u002Fcisco\u002Fskills\u002Fcisco\u002FSKILL.md",[],[161,24,20,125,166,21,80,81,167,168,82,169,29,170,171,85,86,34,89,114],"port","switch","mac","table","discovery","edge"]