network-segmentation-review — Claude Code skill
Inspects traffic boundaries across local networks, firewalls, and cloud environments. It helps engineers spot routing leaks and test zone isolation.
npx skills add securityskills/skills --skill network-segmentation-review -a claude-codeWhat network-segmentation-review does
The skill guides an audit of network boundaries separating environments like DMZ, production, and corporate subnets. It compares architecture diagrams against a default-deny baseline. At layers 2 and 3, the workflow inspects double-tagging risks, trunking negotiation on client switchports, native VLAN mismatches, and missing ACLs on switch virtual interfaces.
Firewall rules and cloud constructs receive equal scrutiny. The skill inspects policies for overly permissive any-to-any entries, shadowed rules, unlogged drops, and exposed administrative interfaces like SSH. In cloud environments, it evaluates security group configurations, transit routing tables, and outbound filters to prevent exfiltration paths.
Active verification relies on authorized probing with targeted commands like nmap -PN -sT -p <port>. Both directions and return traffic get checked. The final deliverable includes a structured matrix of tested paths alongside device-level evidence. Probing requires pre-approved testing access from representative hosts in each subnet.
What it helps with
- Audit firewall rulebases for over-permissive any-any filters and shadowed entries
- Detect VLAN hopping vulnerabilities and dynamic trunking misconfigurations
- Identify exposed management planes reachable from untrusted user subnets
- Spot transit routing table leaks and overly broad security group rules in cloud setups
- Validate cross-zone connectivity with directional port probes
Example prompts for the agent
- Audit our core firewall rulebase to identify any-to-any rules reaching the database subnet
- Draft an nmap testing procedure to verify isolation between DMZ and corporate segments
- Review our cloud transit gateway route tables for overlapping CIDR allocations
How to install network-segmentation-review
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill network-segmentation-review -a claude-code2Manually: put the files in place
~/.claude/skills/network-segmentation-review/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/network-segmentation-review/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill network-segmentation-review -a codex2Manually: put the files in place
.agents/skills/network-segmentation-review/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill network-segmentation-review -a cursor2Manually: put the files in place
.cursor/skills/network-segmentation-review/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install securityskills/skills network-segmentation-review2Manually: put the files in place
.github/skills/network-segmentation-review/SKILL.md1Skills CLI (Vercel)
npx skills add securityskills/skills --skill network-segmentation-review -a gemini-cli2Platform CLI
gemini skills install https://github.com/securityskills/skills --path network-security/network-segmentation-reviewManually: put the files in place
.devin/skills/network-segmentation-review/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add securityskills/skills --skill network-segmentation-review -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about network-segmentation-review
How to install network-segmentation-review in Claude Code?
Run npx skills add securityskills/skills --skill network-segmentation-review -a claude-code in your terminal. Alternatively, copy the skill definition file into ~/.claude/skills/network-segmentation-review/SKILL.md.
What does network-segmentation-review do?
It evaluates internal network architectures across switches, firewalls, and cloud providers. The skill checks layer 2 and layer 3 isolation, validates policy rulebases, and tests boundary enforcement.
What deliverables does this skill produce?
The assessment outputs a verified flow matrix comparing expected and observed cross-zone connectivity. It also details device-level evidence for uncovered gaps and provides targeted remediation advice.
