# Acl Rule Analysis

Vendor-agnostic ACL and firewall rule analysis with shadowed rule detection, overly...

- Repository: https://github.com/LeoYeAI/agent-master-skills (2171 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add LeoYeAI/agent-master-skills --skill acl-rule-analysis -g -a claude-code -y`
Codex: `npx skills add LeoYeAI/agent-master-skills --skill acl-rule-analysis -g -a codex -y`
Cursor: `npx skills add LeoYeAI/agent-master-skills --skill acl-rule-analysis -g -a cursor -y`
Gemini CLI: `npx skills add LeoYeAI/agent-master-skills --skill acl-rule-analysis -g -a gemini-cli -y`

## Description

Vendor-agnostic ACL and firewall rule analysis with shadowed rule detection, overly permissive rule identification, unused rule discovery, redundant rule flagging, and rule ordering optimization. Covers ACLs (Cisco/JunOS/EOS) and firewall policies (PAN-OS/FortiGate/CheckPoint).

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# ACL and Firewall Rule Analysis

Vendor-agnostic rule analysis for access control lists and firewall policies.
Unlike vendor-specific firewall audit skills that evaluate platform features
(App-ID, Security Profile Groups, zone protection), this skill focuses on
universal rule patterns that apply across all platforms: shadowed rules,
redundant rules, overly permissive rules, and unused rules.

Covers ACL-based platforms (Cisco IOS/IOS-XE/ASA, Juniper JunOS, Arista EOS)
and policy-based firewalls (Palo Alto PAN-OS, Fortinet FortiGate, Check Point).
The analysis algorithms are vendor-agnostic, only the rule retrieval commands
differ by platform.

Commands use inline labels **[Cisco]**, **[JunOS]**, **[EOS]**, **[PAN-OS]**,
**[FortiGate]**, **[CheckPoint]** where syntax diverges. Unlabeled statements
apply universally. See `references/cli-reference.md` for full command tables
and `references/rule-patterns.md` for detection algorithm details.

## When to Use

- Post-migration rule cleanup after converting from one platform to another
- Periodic rulebase hygiene to remove accumulated technical debt
- Compliance preparation requiring rule-level justification and minimal privilege
- Incident investigation, determining whether a rule permitted malicious traffic
- Change validation after rulebase modifications to confirm no shadowed rules
- Capacity optimization, reducing rule count to improve lookup performance
- Merger/acquisition integration, consolidating overlapping rulebases

## Prerequisites

The rest: https://github.com/LeoYeAI/agent-master-skills/blob/HEAD/skills/acl-rule-analysis/SKILL.md