Safe Python Netmiko patterns for read-only collection, bounded batch SSH, TextFSM parsing, guarded config changes, timeouts, and network automation error handling.
Detected risks:
The netmiko-ssh-automation skill provides safe Python patterns for automating network devices with Netmiko. It solves the problem of writing or reviewing SSH automation that touches routers, switches, and firewalls without introducing risk: the default path is read-only collection, and configuration changes are gated behind explicit operator approval, a change window, peer review, and a rollback plan. It is meant to be used when collecting show output, building small audit scripts, adding timeouts and exception handling, parsing output with TextFSM, or reviewing automation before it reaches production.
It establishes concrete safety defaults: start with read-only send_command() collection, keep the inventory small and explicit rather than sweeping address ranges, source credentials from environment variables, a vault, or getpass (never hardcoded), set connection and read timeouts, limit concurrency, require an explicit operator flag before send_config_set(), and never call save_config() until a change is verified and approved. The doc includes worked patterns: a read-only ConnectHandler example with conn_timeout, auth_timeout, banner_timeout, and read_timeout_override plus handling of NetmikoAuthenticationException, NetmikoTimeoutException, and ReadTimeout; batch collection using ThreadPoolExecutor with a low max_workers; structured parsing with use_textfsm=True and raise_parsing_error=False, keeping raw output alongside parsed results; and a guarded config pattern driven by an APPLY_NETWORK_CHANGES=1 environment variable that otherwise performs a dry run and captures before/after running-config evidence.
Target users are network engineers and reviewers writing Python SSH automation. The skill supplies a review checklist (explicit inventory source, credentials absent from source and logs, timeouts set, per-device failure reporting, no broad scans or unbounded concurrency, config changes gated, save_config() separated from the push) and anti-patterns to avoid, such as hardcoded secrets, config as the default path, running against a CIDR range, logging unsanitized configs, and treating parser success as proof of device state. It references related skills cisco-ios-patterns, network-config-validation, and network-interface-health.
When collecting show command output across network devices, building small audit scripts for interface/routing/config evidence, adding timeouts and exception handling to SSH scripts, parsing command output with TextFSM, or reviewing automation before it touches production devices.
The default path is read-only. Config changes require an explicit operator flag (the example gates send_config_set() behind APPLY_NETWORK_CHANGES=1), capture before/after running-config evidence, and save_config() is kept as a separate approval step tied to verification, not run by default.
Through environment variables, a vault, or getpass. The doc explicitly forbids hardcoding passwords, enable secrets, or private keys in source, logs, or exception messages.
Set conn_timeout, auth_timeout, banner_timeout, and command read_timeout, and handle NetmikoAuthenticationException, NetmikoTimeoutException, and ReadTimeout. In batch mode, failures should be reported per device without stopping the whole run.
Parser output from TextFSM, TTP, or Genie is an optimization, not the only evidence path. If use_textfsm returns a plain string, no template matched, so raw output should be stored for review, and raw output should be kept alongside parsed results when a decision depends on it.
Quick Setup:
.claude/skills/Repository
affaan-m/everything-claude-code