network-config-validation

network-config-validation provides pre-deployment checks for router and switch configuration, targeting Cisco IOS and IOS-XE style snippets. It solves the problem of catching risky changes before a change window or an automation run touches production devices, surfacing dangerous commands, duplicate IP addresses, subnet overlaps, stale references, management-plane exposure, and IOS-style security hygiene gaps. It treats validation as layered evidence rather than a complete parser: regex checks are useful for pre-flight warnings, but final approval still needs a network engineer to review intent, platform syntax, and rollback steps.

The skill prescribes a validation order and ships concrete Python routines for each layer. It detects destructive commands via a DANGEROUS_PATTERNS list (reload, erase startup/nvram/flash, format, no router bgp/ospf/eigrp, no interface, aaa new-model, crypto key zeroize/generate) with find_dangerous_commands. It extracts interface IPs and networks and finds duplicate addresses and overlapping subnets using the ipaddress module (find_duplicate_ips, find_subnet_overlaps). Management-plane checks parse VTY blocks section by section (iter_blocks, check_vty_blocks) to flag Telnet transport, missing inbound access-class restrictions, and missing exec-timeout. Security hygiene checks flag default or SNMPv2 communities, SSH version 1, enable password instead of enable secret, and local username password instead of secret, while best-practice checks warn on missing NTP, log timestamps, logging destinations, SNMPv3 authPriv groups, and login banners.

It is aimed at network engineers and automation authors doing change-window preflights or auditing config generated by scripts and templates. It describes using validation as a blocking gate before Netmiko, NAPALM, Ansible, or vendor API pushes, failing closed on dangerous commands and credentials and warning on out-of-scope best-practice gaps. Stated anti-patterns include treating regex validation as a device parser, applying config without a dry-run diff, recommending SNMPv2 communities, and using regex that spans unrelated VTY sections. The skill also references related agents (network-config-reviewer, network-troubleshooter) and the network-interface-health skill.