Not in the top 1,000 by GitHub stars
Con-Benksl/NetOps
Find which segment of your VPS/proxy chain is broken, without the agent disconnecting itself. Xray, 3x-ui, Reality, Hysteria2. Python stdlib only.
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
SKILL.md
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 7f5a5d62d0f1
No earlier version was observed for comparison.
skills/netops-build/SKILL.md
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 7f5a5d62d0f1
No earlier version was observed for comparison.
skills/netops-fix/SKILL.md
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 7f5a5d62d0f1
No earlier version was observed for comparison.
skills/netops-manage/SKILL.md
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 7f5a5d62d0f1
No earlier version was observed for comparison.
skills/netops-scan/SKILL.md
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Local scripts
First observation → 7f5a5d62d0f1
No earlier version was observed for comparison.
skills/netops-start/SKILL.md
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 7f5a5d62d0f1
No earlier version was observed for comparison.
View on GitHubAdd to my skills
Verified commit 7f5a5d62d0f1900a72808064d1c535e7646d9061
git clone --filter=blob:none --no-checkout https://github.com/Con-Benksl/NetOps.git .hotskills/con-benksl-netops && git -C .hotskills/con-benksl-netops checkout --detach 7f5a5d62d0f1900a72808064d1c535e7646d9061
# Copy each selected skill directory from .hotskills/con-benksl-netops into .agents/skills/<skill-name>/12GitHub stars
1star in 7 days
6skills in this repository
0commits in 30 days
Heat
1.7- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
- netops
/ - netops-build
skills/netops-build - netops-fix
skills/netops-fix - netops-manage
skills/netops-manage - netops-scan
skills/netops-scan - netops-start
skills/netops-start
How it works
netops
When your agent uses it
Route authorized VPS networking and proxy work to onboarding, read-only scanning, building, repair, or fleet management. Use for VPS access, 3x-ui/Xray/VLESS Reality/Hysteria2, DNS/TUN/routing failures, node performance, or ongoing multi-VPS operations. 典型中文请求：VPS 连不上、节点慢或掉线、搭建或修改节点、面板打不开、多台 VPS 统一维护。
What it loads into context
Frontmatter
100 tokensAlways available to the agent
SKILL.md
816 tokensWhen the skill is activated
Reference documents
38,314 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Route To One Workflow
- Conditional Gates
- Output
Scripts executed separately
netops_core/__init__.pynetops_core/bundle.pynetops_core/change.pynetops_core/cli.pynetops_core/control_channel.pynetops_core/external_tools.pynetops_core/fleet.pynetops_core/models.pynetops_core/monitor.pynetops_core/redaction.pynetops_core/remote_collector.pynetops_core/report.pynetops_core/scanner.pynetops_core/util.pyscripts/check_install_tree.pyscripts/check_secrets.pyscripts/installed_smoke.pyscripts/netopsctl.pyscripts/package_smoke.pyscripts/release_check.pyscripts/reproducible_build.pyscripts/sync_install_tree.pyscripts/validate_skills.pytests/test_bundle_redaction.pytests/test_cli_contract.pytests/test_control_channel.pytests/test_data_contracts.pytests/test_docs_contract.pytests/test_external_tools.pytests/test_fleet_change.pytests/test_fleet_contract.pytests/test_models_report.pytests/test_monitor.pytests/test_monitor_privacy.pytests/test_package_smoke.pytests/test_release_integrity.pytests/test_remote_collector.pytests/test_reproducible_build.pytests/test_scanner.pytests/test_secret_scan.pytests/test_serialization_safety.pytests/test_skill_contract.pytests/test_sync_install_tree.pytests/test_util.py
Files
.github/ISSUE_TEMPLATE/bug_report.ymlasset5,396 bytes.github/ISSUE_TEMPLATE/config.ymlasset690 bytes.github/ISSUE_TEMPLATE/feature_request.ymlasset4,162 bytes.github/PULL_REQUEST_TEMPLATE.mddoc4,385 bytes.github/dependabot.ymlasset945 bytes.github/workflows/test.ymlasset2,304 bytes.gitignoreasset181 bytesAGENTS.mddoc3,398 bytesCHANGELOG.mddoc16,474 bytesCONTRIBUTING.mddoc11,474 bytesLICENSEasset1,067 bytesMANIFEST.inasset1,452 bytesREADME.mddoc23,560 bytesREADME.zh-CN.mddoc21,879 bytesSECURITY.mddoc7,849 bytesSKILL.mdcore3,912 bytesSKILL.mdcore3,912 bytesagents/openai.yamlasset348 bytesexamples/change-spec.example.jsonasset2,394 bytesexamples/fleet.example.jsonasset810 bytesexamples/payload/service.jsonasset133 bytesnetops_core/__init__.pyruns167 bytesnetops_core/bundle.pyruns41,874 bytesnetops_core/change.pyruns141,033 bytesnetops_core/cli.pyruns34,908 bytesnetops_core/control_channel.pyruns20,703 bytesnetops_core/external_tools.pyruns49,032 bytesnetops_core/fleet.pyruns20,801 bytesnetops_core/models.pyruns20,936 bytesnetops_core/monitor.pyruns80,888 bytesnetops_core/redaction.pyruns56,003 bytesnetops_core/remote_collector.pyruns11,043 bytesnetops_core/report.pyruns19,489 bytesnetops_core/scanner.pyruns73,114 bytesnetops_core/util.pyruns23,464 bytespyproject.tomlasset459 bytesreferences/beginner-reporting.mddoc1,441 bytesreferences/build-runbook.mddoc3,087 bytesreferences/cases/README.mddoc975 bytesreferences/cases/destination-refusal.mddoc2,197 bytesreferences/cases/dual-stack-tun.mddoc1,858 bytesreferences/cases/intermittent-shared-node.mddoc1,983 bytesreferences/cases/per-node-egress.mddoc1,990 bytesreferences/control-channel-safety.mddoc18,241 bytesreferences/curated-tools.mddoc8,826 bytesreferences/emergency-recovery.mddoc3,526 bytesreferences/glossary.mddoc5,072 bytesreferences/guided-dialogue.mddoc3,567 bytesreferences/independence-protocol.mddoc5,393 bytesreferences/monitoring.mddoc3,268 bytesreferences/observable-path.mddoc1,622 bytesreferences/source-policy.mddoc1,614 bytesreferences/troubleshooting-model.mddoc1,969 bytesschemas/change-plan.schema.jsonasset14,742 bytesschemas/change-spec.schema.jsonasset9,757 bytesschemas/diagnostic-bundle.schema.jsonasset5,834 bytesschemas/fleet.schema.jsonasset7,160 bytesscripts/check_install_tree.pyruns22,318 bytesscripts/check_secrets.pyruns6,377 bytesscripts/installed_smoke.pyruns10,790 bytesscripts/netopsctl.pyruns296 bytesscripts/package_smoke.pyruns21,627 bytesscripts/release_check.pyruns28,678 bytesscripts/reproducible_build.pyruns21,476 bytesscripts/sync_install_tree.pyruns93,803 bytesscripts/validate_skills.pyruns20,390 bytestests/fixtures/generalized-intents.jsonasset5,329 bytestests/test_bundle_redaction.pyruns3,366 bytestests/test_cli_contract.pyruns29,039 bytestests/test_control_channel.pyruns22,012 bytestests/test_data_contracts.pyruns79,810 bytestests/test_docs_contract.pyruns16,608 bytestests/test_external_tools.pyruns37,281 bytestests/test_fleet_change.pyruns94,078 bytestests/test_fleet_contract.pyruns11,134 bytestests/test_models_report.pyruns10,734 bytestests/test_monitor.pyruns28,369 bytestests/test_monitor_privacy.pyruns18,341 bytestests/test_package_smoke.pyruns9,382 bytestests/test_release_integrity.pyruns11,192 bytestests/test_remote_collector.pyruns6,358 bytestests/test_reproducible_build.pyruns13,926 bytestests/test_scanner.pyruns56,475 bytestests/test_secret_scan.pyruns7,623 bytestests/test_serialization_safety.pyruns1,219 bytestests/test_skill_contract.pyruns29,648 bytestests/test_sync_install_tree.pyruns66,390 bytestests/test_util.pyruns11,090 bytes
Read SKILL.md
# NetOps
Route each request to exactly one primary workflow. When the goal and boundary are clear, act directly. Ask one question only when a missing user choice would change the action; discover technical facts with read-only checks instead of asking the user to guess.
## Route To One Workflow
- Learning, terminology, a first VPS, or an unclear starting point: `skills/netops-start/SKILL.md`.
- Read-only environment, client/server/node-path evidence, comparison, or baseline: `skills/netops-scan/SKILL.md`.
- Installing or changing a panel, node, DNS, TLS, inbound, outbound, firewall rule, or approved standard: `skills/netops-build/SKILL.md`.
- Diagnosing or repairing a timeout, disconnect, slowness, inaccessible service, DNS/TUN/IPv6 fault, or target rejection: `skills/netops-fix/SKILL.md`.
- Backups, upgrades, security, capacity, monitoring review, subscriptions, users, or fleet drift: `skills/netops-manage/SKILL.md`.
If a request spans workflows, choose the workflow that owns the user's next outcome. A current failure starts with `netops-fix`; when its failing segment is unknown, that workflow invokes `netops-scan` for read-only evidence before any repair. Route directly to `netops-scan` when the requested outcome is evidence, comparison, or a baseline rather than incident resolution.
netops-build
When your agent uses it
Audit, plan, and execute authorized VPS networking or proxy-node changes, including 3x-ui, Xray, VLESS Reality, Hysteria2, TLS, DNS, address-family separation, firewall rules, and per-node upstream exits. Use for installing, adding, or changing services while preserving existing behavior. 典型中文请求：装一个节点、增加入站、换域名和证书、给某个节点单独配置出口、修改端口和防火墙。
What it loads into context
Frontmatter
111 tokensAlways available to the agent
SKILL.md
650 tokensWhen the skill is activated
Reference documents
863 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Shared Reference Root
- Direct-Invocation Safety
- Decision Boundary
- Change Flow
- Architecture Defaults
Files
../../references/guided-dialogue.mddoc3,567 bytesSKILL.mdcore3,251 bytesSKILL.mdcore3,251 bytesSKILL.mdcore3,251 bytesagents/openai.yamlasset351 bytes
Read SKILL.md
# NetOps Build
Build from current evidence and make the smallest reviewed change.
## Shared Reference Root
Before reading a shared reference, resolve `<reference-root>` once. Use `../../references` when `../../references/guided-dialogue.md` exists (repository or monolithic root installation); otherwise use `../netops/references` when `../netops/references/guided-dialogue.md` exists (flat installation beside the root `netops` Skill). If neither candidate exists, stop and report an incomplete installation. Do not reconstruct or bypass missing safety rules.
## Direct-Invocation Safety
These rules apply even when this child Skill is invoked without the root router. Authorized direct SSH is allowed when the target VPS is unrelated to the agent's current path and the change does not modify the local control plane. Require explicit authorization, affected-state backup, pre-apply validation, post-apply verification, executable rollback, and a concise receipt. Use an exact plan ID and `netopsctl change apply` when its file-transaction contract fits or when a shared remote path needs automatic rollback; do not force every independent SSH change through that executor. Preserve existing nodes and the host default route unless the reviewed operation explicitly changes either invariant.
## Decision Boundary
netops-fix
When your agent uses it
Evidence-led diagnosis and authorized repair for current VPS or proxy failures: disconnects, timeouts, slowness, inaccessible panels/sites, TUN loops, IPv6 bypass, DNS/UDP/MTU/TLS faults, resource pressure, upstream restrictions, or destination risk controls. Use whether or not the failing segment is known; invoke netops-scan first when evidence is missing. 典型中文请求：节点慢或掉线、面板打不开、一个网站打不开、升级后无法连接。
What it loads into context
Frontmatter
113 tokensAlways available to the agent
SKILL.md
687 tokensWhen the skill is activated
Reference documents
863 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Shared Reference Root
- Direct-Invocation Safety
- Decision Boundary
- Diagnostic Branch
- Repair Branch
- Output
Files
../../references/guided-dialogue.mddoc3,567 bytesSKILL.mdcore3,445 bytesagents/openai.yamlasset325 bytes
Read SKILL.md
# NetOps Fix
Diagnose by segment and falsifiable evidence; do not promote a plausible story to a confirmed root cause.
## Shared Reference Root
Before reading a shared reference, resolve `<reference-root>` once. Use `../../references` when `../../references/guided-dialogue.md` exists (repository or monolithic root installation); otherwise use `../netops/references` when `../netops/references/guided-dialogue.md` exists (flat installation beside the root `netops` Skill). If neither candidate exists, stop and report an incomplete installation. Do not reconstruct or bypass missing safety rules.
## Direct-Invocation Safety
These rules apply even when this child Skill is invoked without the root router. Authorized direct SSH is allowed for a proven repair on an unrelated remote VPS that does not change the local control plane. Require explicit authorization, affected-state backup, pre-apply validation, post-apply verification, executable rollback, and a concise receipt. Use a reviewed exact plan ID and `netopsctl change apply` for shared-path or exact-file transactions, not as a blanket requirement for every SSH repair. Preserve existing nodes and the host default route unless the reviewed operation explicitly changes either invariant. Diagnosis and read-only evidence collection do not imply mutation authorization.
## Decision Boundary
netops-manage
When your agent uses it
Long-term VPS and proxy operations: monitoring review, baselines, incident bundles, backups, upgrades, compatibility, security, capacity, fleet drift, user lifecycle, subscriptions, and read-only traffic portals. Use for ongoing reliability and multi-VPS management rather than a one-time repair. 典型中文请求：统一多台 VPS、定期备份和升级、管理用户和限流、订阅管理、长期监控方案。
What it loads into context
Frontmatter
100 tokensAlways available to the agent
SKILL.md
706 tokensWhen the skill is activated
Reference documents
863 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Shared Reference Root
- Direct-Invocation Safety
- Decision Boundary
- Branches
- Change Boundary
Files
../../references/guided-dialogue.mddoc3,567 bytesSKILL.mdcore3,713 bytesSKILL.mdcore3,713 bytesagents/openai.yamlasset361 bytes
Read SKILL.md
# NetOps Manage
Keep the fleet observable, reversible, and understandable.
## Shared Reference Root
Before reading a shared reference, resolve `<reference-root>` once. Use `../../references` when `../../references/guided-dialogue.md` exists (repository or monolithic root installation); otherwise use `../netops/references` when `../netops/references/guided-dialogue.md` exists (flat installation beside the root `netops` Skill). If neither candidate exists, stop and report an incomplete installation. Do not reconstruct or bypass missing safety rules.
## Direct-Invocation Safety
These rules apply even when this child Skill is invoked without the root router. Authorized direct SSH is allowed for maintenance on an unrelated remote VPS when the local control plane remains unchanged. Require explicit authorization, affected-state backup, pre-apply validation, post-apply verification, executable rollback, and a concise receipt. Use a reviewed exact plan ID and `netopsctl change apply` for shared-path or exact-file transactions, not as a blanket requirement for every SSH maintenance action. Preserve existing nodes and the host default route unless the reviewed operation explicitly changes either invariant. Scheduled monitor installation and removal remain unreleased: `netopsctl monitor install/remove` may only generate dry-run review material and never touch a scheduler.
## Decision Boundary
netops-scan
When your agent uses it
Read-only scanning of clients, authorized VPS hosts, proxy nodes, and observable paths. Use when the requested outcome is evidence, comparison, a baseline, or existing monitor data, and when netops-fix needs evidence for an unknown failing segment. Report confidence and blind spots rather than claiming a complete physical route. 典型中文请求：扫描本机和 VPS、比较两台电脑、保存正常基线、收集故障证据。
What it loads into context
Frontmatter
102 tokensAlways available to the agent
SKILL.md
810 tokensWhen the skill is activated
Reference documents
863 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Shared Reference Root
- Read-Only Boundary
- Branches
- Execution and Output
Scripts executed separately
../../scripts/netopsctl.py
Files
../../references/guided-dialogue.mddoc3,567 bytes../../scripts/netopsctl.pyruns296 bytesSKILL.mdcore3,920 bytesagents/openai.yamlasset345 bytes
Read SKILL.md
# NetOps Scan
Collect only the evidence needed to distinguish the client, access network, VPS ingress, proxy core, upstream egress, and destination.
## Shared Reference Root
Before reading a shared reference, resolve `<reference-root>` once. Use `../../references` when `../../references/guided-dialogue.md` exists (repository or monolithic root installation); otherwise use `../netops/references` when `../netops/references/guided-dialogue.md` exists (flat installation beside the root `netops` Skill). If neither candidate exists, stop and report an incomplete installation. Do not reconstruct or bypass missing safety rules.
## Read-Only Boundary
This Skill does not change the configuration or service state of an observed client, server, or network. A formal scan may write only its declared local machine-readable JSON bundle by default. Authorized SSH here is for scanning only; hand proven changes to `netops-build`, `netops-fix`, or `netops-manage`. This workflow does not install scheduled tasks.
## Branches
netops-start
When your agent uses it
Beginner onboarding for VPS networking and proxy operations. Use when the user has a first VPS, does not know where to start, or needs a plain-language explanation of domains, ports, DNS, inbound/outbound, proxies, dual stack, routes, or node protocols. This workflow teaches and routes; factual discovery belongs to netops-scan. 典型中文请求：第一次买 VPS 不知道从哪开始、这些术语是什么意思、自建和机场有什么区别、我该选哪种协议。
What it loads into context
Frontmatter
112 tokensAlways available to the agent
SKILL.md
488 tokensWhen the skill is activated
Reference documents
863 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Shared Reference Root
- Boundary
- Branches
- Output
Files
../../references/guided-dialogue.mddoc3,567 bytesSKILL.mdcore2,321 bytesSKILL.mdcore2,321 bytesSKILL.mdcore2,321 bytesagents/openai.yamlasset339 bytes
Read SKILL.md
# NetOps Start
Clarify the immediate goal, explain only what is needed, and route to the next workflow.
## Shared Reference Root
Before reading a shared reference, resolve `<reference-root>` once. Use `../../references` when `../../references/guided-dialogue.md` exists (repository or monolithic root installation); otherwise use `../netops/references` when `../netops/references/guided-dialogue.md` exists (flat installation beside the root `netops` Skill). If neither candidate exists, stop and report an incomplete installation. Do not reconstruct or bypass missing safety rules.
## Boundary
This onboarding workflow does not mutate systems itself. Answer a clear terminology question directly and do not create JSON. If the goal is unclear and the missing choice changes the next workflow, ask one plain-language question under `<reference-root>/guided-dialogue.md`; do not force an introductory menu.
## Branches
Skills included
- netops
- netops-build
- netops-fix
- netops-manage
- netops-scan
- netops-start
Repository facts
- License
- MIT
- Created
- Jul 18, 2026
- Last pushed
- Oct 25, 2026
- Forks
- 1
- Open issues
- 0
- Project activity
- Active
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 7, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 6 notes
SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/netops-build/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/netops-build/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/netops-manage/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/netops-start/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/netops-start/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 18 dangerous shell commandsin 7 files: netops_core/change.py:1644 tests/test_fleet_change.py:725 README.md:258 and 4 more
- 257 network referencesin 29 files: tests/test_data_contracts.py:86 tests/test_scanner.py:79 netops_core/scanner.py:3 and 26 more
- 3 obfuscation signalsin 3 files: netops_core/bundle.py:344 netops_core/redaction.py:1131 tests/test_reproducible_build.py:142
- No instruction overrides
- 45 executable scriptsin 44 files: scripts/netopsctl.py:1 netops_core/__init__.py:1 netops_core/bundle.py:1 and 41 more
- 94 references to secretsin 22 files: tests/test_scanner.py:54 netops_core/bundle.py:232 netops_core/redaction.py:184 and 19 more
- No requests to vote in Hot
Show all 417 signals by file
.github/ISSUE_TEMPLATE/bug_report.yml
.github/ISSUE_TEMPLATE/config.yml
- Network accessline 2
contact_links: - name: Report a security vulnerability url: https://github.com/Con-Benksl/NetOps/security/advisories/new - Network accessline 3
- name: Report a security vulnerability url: https://github.com/Con-Benksl/NetOps/security/advisories/new about: Do not open a public issue. Use private vulnerability reporting; the scope and the response timeline are in SECURITY.md - Network accessline 4
url: https://github.com/Con-Benksl/NetOps/security/advisories/new - Network accessline 5
about: Do not open a public issue. Use private vulnerability reporting; the scope and the response timeline are in SECURITY.md. - name: Security policy url: https://github.com/Con-Benksl/NetOps/blob/main/SECURITY.md - Network accessline 6
- name: Security policy url: https://github.com/Con-Benksl/NetOps/blob/main/SECURITY.md about: What is in scope, what is out of scope, and how quickly you can expect a reply. - Network accessline 7
url: https://github.com/Con-Benksl/NetOps/blob/main/SECURITY.md - Network accessline 8
about: What is in scope, what is out of scope, and how quickly you can expect a reply. - name: Contributing guide url: https://github.com/Con-Benksl/NetOps/blob/main/CONTRIBUTING.md - Network accessline 9
- name: Contributing guide url: https://github.com/Con-Benksl/NetOps/blob/main/CONTRIBUTING.md about: Architecture, the rules a change has to satisfy, and the local gate to run before opening a pull request. - Network accessline 10
url: https://github.com/Con-Benksl/NetOps/blob/main/CONTRIBUTING.md
.github/ISSUE_TEMPLATE/feature_request.yml
- Network accessline 20
See [CONTRIBUTING.md](https://github.com/Con-Benksl/NetOps/blob/main/CONTRIBUTING.md)
.gitignore
- Access to secretsline 15
[Credential-related source omitted]
CHANGELOG.md
- Network accessline 5
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), - Network accessline 6
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). - Network accessline 85
- Both READMEs now link directly to [LINUX DO](https://linux.do), and the - Network accessline 320
[Unreleased]: https://github.com/Con-Benksl/NetOps/compare/v0.6.0...HEAD - Network accessline 321
[0.6.0]: https://github.com/Con-Benksl/NetOps/compare/v0.5.1...v0.6.0 - Network accessline 322
[0.5.1]: https://github.com/Con-Benksl/NetOps/compare/v0.5.0...v0.5.1 - Network accessline 323
[0.5.0]: https://github.com/Con-Benksl/NetOps/compare/v0.4.0...v0.5.0 - Network accessline 324
[0.4.0]: https://github.com/Con-Benksl/NetOps/compare/v0.3.1...v0.4.0 - Network accessline 325
[0.3.2]: https://github.com/Con-Benksl/NetOps/pull/2 - Network accessline 326
[0.3.1]: https://github.com/Con-Benksl/NetOps/releases/tag/v0.3.1
README.md
- Network accessline 5
Open-source community: [LINUX DO](https://linux.do) - Network accessline 7
[](https://github.com/Con-Benksl/NetOps/actions/workflows/test.yml) - Network accessline 8
[](LICENSE) - Network accessline 9
[](https://www.python.org/) - Network accessline 10
[](pyproject.toml) - Network accessline 51
git clone --branch v0.6.0 --depth 1 https://github.com/Con-Benksl/NetOps.git - Network accessline 70
git clone --branch v0.6.0 --depth 1 https://github.com/Con-Benksl/NetOps.git - Network accessline 256
- Public IP lookups happen only with an explicit `--external`. - Curated tools run only when both `--tool` and the matching consent flag are given: `--external` for node scans, `--tool-external` for client and local server scans. Load gener - Network accessline 257
- Curated tools run only when both `--tool` and the matching consent flag are given: `--external` for node scans, `--tool-external` for client and local server scans. Load generating tools must also be covered by the user's informed authori - Dangerous shell operationline 258
- Nothing is fetched through `curl | bash`, no floating version is downloaded silently, and no external script is allowed to install system dependencies on your behalf. - Network accessline 258
- Nothing is fetched through `curl | bash`, no floating version is downloaded silently, and no external script is allowed to install system dependencies on your behalf.
README.zh-CN.md
- Network accessline 5
开源社区：[LINUX DO](https://linux.do) - Network accessline 56
git clone --branch v0.6.0 --depth 1 https://github.com/Con-Benksl/NetOps.git - Network accessline 103
git clone --branch v0.6.0 --depth 1 https://github.com/Con-Benksl/NetOps.git - Network accessline 281
- 公网 IP 查询只有在明确使用 `--external` 时才会发生。 - 精选外部工具只有在显式指定 `--tool` 及其对应授权参数时才会运行：节点扫描使用 `--external`，客户端和本机服务器扫描使用 `--tool-external`；高流量工具还需要独立授权。 - NetOps 不会通过 `curl | bash` 静默下载浮动版本，也不会让外部脚本自动安装系统依赖。 - Network accessline 282
- 精选外部工具只有在显式指定 `--tool` 及其对应授权参数时才会运行：节点扫描使用 `--external`，客户端和本机服务器扫描使用 `--tool-external`；高流量工具还需要独立授权。 - NetOps 不会通过 `curl | bash` 静默下载浮动版本，也不会让外部脚本自动安装系统依赖。 - 导出的诊断包默认会隐藏 IP、域名、用户目录和疑似凭据。 - Dangerous shell operationline 283
- NetOps 不会通过 `curl | bash` 静默下载浮动版本，也不会让外部脚本自动安装系统依赖。 - Network accessline 283
- NetOps 不会通过 `curl | bash` 静默下载浮动版本，也不会让外部脚本自动安装系统依赖。
SECURITY.md
- Network accessline 13
**https://github.com/Con-Benksl/NetOps/security/advisories/new**
examples/fleet.example.json
- Network accessline 8
"management": { "address": "192.0.2.10", "panel_reference": "https://panel.example.invalid" - Network accessline 9
"address": "192.0.2.10", "panel_reference": "https://panel.example.invalid" }, - Network accessline 10
"panel_reference": "https://panel.example.invalid" - Access to secretsline 16
[Credential-related source omitted]
netops_core/__init__.py
- Executable scriptline 1
Executable file
netops_core/bundle.py
- Executable scriptline 1
Executable file - Access to secretsline 232
[Credential-related source omitted] - Possible obfuscationline 344
decoded = base64.b64decode( - Access to secretsline 460
[Credential-related source omitted] - Access to secretsline 465
[Credential-related source omitted] - Access to secretsline 471
[Credential-related source omitted] - Access to secretsline 495
[Credential-related source omitted] - Access to secretsline 554
[Credential-related source omitted] - Access to secretsline 566
[Credential-related source omitted] - Access to secretsline 567
[Credential-related source omitted] - Access to secretsline 572
[Credential-related source omitted] - Access to secretsline 573
[Credential-related source omitted] - Access to secretsline 578
[Credential-related source omitted]
netops_core/change.py
- Executable scriptline 1
Executable file - Access to secretsline 1591
[Credential-related source omitted] - Access to secretsline 1643
[Credential-related source omitted] - Dangerous shell operationline 1644
' rm -f -- "$ACTIVE_LEASE"', - Access to secretsline 1656
[Credential-related source omitted] - Access to secretsline 1659
[Credential-related source omitted] - Dangerous shell operationline 1835
' ./.backup-stage.*) rm -rf -- "$BACKUP_STAGE" ;;', - Dangerous shell operationline 2046
f' rm -f -- "${{{variable}}}"', - Dangerous shell operationline 2124
' ./.restore-stage.*) rm -rf -- "$STAGE" ;;', - Dangerous shell operationline 2381
' [ -z "$INSTALL_TEMP" ] || rm -f -- "$INSTALL_TEMP"', - Dangerous shell operationline 2497
f"rm -f -- {shlex.quote('./' + temporary_name)}", - Access to secretsline 2739
[Credential-related source omitted] - Dangerous shell operationline 2740
' rm -f -- "$ACTIVE_LEASE"\n' - Dangerous shell operationline 2745
' trap \'[ -z "$temporary" ] || rm -f -- "$temporary"\' HUP INT TERM EXIT\n' - Dangerous shell operationline 2808
"rm -f -- ./.active-change", - Dangerous shell operationline 2978
' trap \'[ -z "$temporary" ] || rm -f -- "$temporary"\' HUP INT TERM EXIT\n'
netops_core/cli.py
- Executable scriptline 1
Executable file
netops_core/control_channel.py
- Executable scriptline 1
Executable file
netops_core/external_tools.py
- Executable scriptline 1
Executable file - Network accessline 67
purpose_zh="连续采样路径延迟、抖动和丢包", category="route", official_url="https://github.com/traviscross/mtr", - Network accessline 68
category="route", official_url="https://github.com/traviscross/mtr", license="GPL-2.0", - Network accessline 69
official_url="https://github.com/traviscross/mtr", - Network accessline 109
purpose_zh="生成协议匹配的结构化路由快照", category="route", official_url="https://github.com/nxtrace/NTrace-core", - Network accessline 110
category="route", official_url="https://github.com/nxtrace/NTrace-core", license="GPL-3.0", - Network accessline 111
official_url="https://github.com/nxtrace/NTrace-core", - Network accessline 150
purpose_zh="测量指定 DNS 解析器的延迟、抖动和丢包", category="dns", official_url="https://github.com/farrokhi/dnsdiag", - Network accessline 151
category="dns", official_url="https://github.com/farrokhi/dnsdiag", license="BSD-2-Clause", - Network accessline 152
official_url="https://github.com/farrokhi/dnsdiag", - Network accessline 181
purpose_zh="检查指定 TLS 服务的协议、证书和服务端默认参数", category="tls", official_url="https://github.com/testssl/testssl.sh", - Network accessline 182
category="tls", official_url="https://github.com/testssl/testssl.sh", license="GPL-2.0", - Network accessline 183
official_url="https://github.com/testssl/testssl.sh", - Network accessline 220
purpose_zh="汇总当前出口的 IP 类型、信誉和服务可用性线索", category="ip-quality", official_url="https://github.com/xykt/IPQuality", - Network accessline 221
category="ip-quality", official_url="https://github.com/xykt/IPQuality", license="AGPL-3.0", - Network accessline 222
official_url="https://github.com/xykt/IPQuality", - Network accessline 255
purpose_zh="对用户控制的 iperf3 端点执行限时限速吞吐测试", category="performance", official_url="https://software.es.net/iperf/", - Network accessline 256
category="performance", official_url="https://software.es.net/iperf/", license="BSD-3-Clause", - Network accessline 257
official_url="https://software.es.net/iperf/", - Access to secretsline 371
[Credential-related source omitted] - Access to secretsline 425
[Credential-related source omitted]
netops_core/fleet.py
- Executable scriptline 1
Executable file - Access to secretsline 16
[Credential-related source omitted] - Access to secretsline 18
[Credential-related source omitted] - Access to secretsline 26
[Credential-related source omitted] - Access to secretsline 405
[Credential-related source omitted] - Access to secretsline 571
[Credential-related source omitted]
netops_core/models.py
- Executable scriptline 1
Executable file
netops_core/monitor.py
netops_core/redaction.py
- Executable scriptline 1
Executable file - Access to secretsline 184
[Credential-related source omitted] - Access to secretsline 234
[Credential-related source omitted] - Access to secretsline 238
[Credential-related source omitted] - Access to secretsline 242
[Credential-related source omitted] - Access to secretsline 247
[Credential-related source omitted] - Access to secretsline 316
[Credential-related source omitted] - Access to secretsline 317
[Credential-related source omitted] - Access to secretsline 490
[Credential-related source omitted] - Access to secretsline 533
[Credential-related source omitted] - Access to secretsline 534
[Credential-related source omitted] - Access to secretsline 539
[Credential-related source omitted] - Network accessline 962
# Retaining network identifiers must never retain credentials embedded # in curl options. Redact the complete command because cookie/cert - Network accessline 963
# in curl options. Redact the complete command because cookie/cert - Possible obfuscationline 1131
decoded = base64.b64decode(
netops_core/remote_collector.py
- Executable scriptline 1
Executable file
netops_core/report.py
- Executable scriptline 1
Executable file
netops_core/scanner.py
- Executable scriptline 1
Executable file - Network accessline 3
import http.client - Network accessline 100
url, timeout_text = sys.argv[1:3] try: request = urllib.request.Request(url, headers={"User-Agent": __NETOPS_USER_AGENT__}) - Network accessline 101
try: request = urllib.request.Request(url, headers={"User-Agent": __NETOPS_USER_AGENT__}) opener = urllib.request.build_opener(NoRedirect()) - Network accessline 102
request = urllib.request.Request(url, headers={"User-Agent": __NETOPS_USER_AGENT__}) - Access to secretsline 132
[Credential-related source omitted] - Network accessline 424
def _external_identity(*, timeout: float = 8) -> list[Observation]: providers = [ ("ipify-v4", "https://api.ipify.org?format=json"), - Network accessline 425
providers = [ ("ipify-v4", "https://api.ipify.org?format=json"), ("cloudflare-trace", "https://www.cloudflare.com/cdn-cgi/trace"), - Network accessline 426
("ipify-v4", "https://api.ipify.org?format=json"), - Network accessline 427
("cloudflare-trace", "https://www.cloudflare.com/cdn-cgi/trace"), - Access to secretsline 508
[Credential-related source omitted] - Access to secretsline 568
[Credential-related source omitted] - Network accessline 1097
sockaddr = (address["address"], port) started = time.monotonic() sock = socket.socket(family, socket.SOCK_STREAM) - Network accessline 1098
started = time.monotonic() sock = socket.socket(family, socket.SOCK_STREAM) sock.settimeout(timeout) - Network accessline 1099
sock = socket.socket(family, socket.SOCK_STREAM) - Network accessline 1131
) started = time.monotonic() raw = socket.socket(family, socket.SOCK_STREAM) - Network accessline 1132
started = time.monotonic() raw = socket.socket(family, socket.SOCK_STREAM) raw.settimeout(timeout) - Network accessline 1133
raw = socket.socket(family, socket.SOCK_STREAM) - Network accessline 1189
else (address["address"], port) ) connection = socket.socket(family, socket.SOCK_STREAM) - Network accessline 1190
) connection = socket.socket(family, socket.SOCK_STREAM) connection.settimeout(timeout) - Network accessline 1191
connection = socket.socket(family, socket.SOCK_STREAM) - Network accessline 1201
class _ResolvedHTTPConnection(http.client.HTTPConnection): - Network accessline 1221
class _ResolvedHTTPSConnection(http.client.HTTPSConnection): - Network accessline 1257
network_path = _network_http_path(path) if tls: connection: http.client.HTTPConnection = _ResolvedHTTPSConnection( - Network accessline 1258
if tls: connection: http.client.HTTPConnection = _ResolvedHTTPSConnection( network_host, - Network accessline 1259
connection: http.client.HTTPConnection = _ResolvedHTTPSConnection( - Network accessline 1287
status, application_outcome = _http_semantics(response.status) evidence["application_outcome"] = application_outcome except (OSError, http.client.HTTPException, ssl.SSLError) as exc: - Network accessline 1288
evidence["application_outcome"] = application_outcome except (OSError, http.client.HTTPException, ssl.SSLError) as exc: evidence = { - Network accessline 1289
except (OSError, http.client.HTTPException, ssl.SSLError) as exc: - Access to secretsline 1329
[Credential-related source omitted]
netops_core/util.py
- Executable scriptline 1
Executable file - Access to secretsline 245
[Credential-related source omitted] - Access to secretsline 246
[Credential-related source omitted] - Access to secretsline 247
[Credential-related source omitted] - Access to secretsline 262
[Credential-related source omitted] - Access to secretsline 265
[Credential-related source omitted] - Access to secretsline 270
[Credential-related source omitted] - Access to secretsline 276
[Credential-related source omitted] - Access to secretsline 281
[Credential-related source omitted] - Access to secretsline 285
[Credential-related source omitted] - Access to secretsline 427
[Credential-related source omitted]
references/control-channel-safety.md
- Network accessline 217
- systemd 的 `--on-active=` 会创建 transient timer，由服务管理器在 SSH 断开后继续管理；成功提交后通过停止对应 `.timer` 解除。 - 最后验证日期：2026-07-20。 - 权威参考：[systemd-run manual](https://www.freedesktop.org/software/systemd/man/latest/systemd-run.html)、[systemctl manual](https: - Network accessline 219
- 权威参考：[systemd-run manual](https://www.freedesktop.org/software/systemd/man/latest/systemd-run.html)、[systemctl manual](https://www.freedesktop.org/software/systemd/man/latest/systemctl.html)。
references/curated-tools.md
- Network accessline 9
| 工具 | 最适合回答的问题 | 接入方式 | 上游当前稳定版 / NetOps 最低兼容版 | | --- | --- | --- | --- | | [MTR](https://github.com/traviscross/mtr/tree/v0.96) | 哪一段开始出现持续延迟、抖动或端到端丢包？ | 5 轮报告模式，JSON | 上游 v0.96；最低 v0.95，且本机必须实际支持适配器使用的全部 JSON、报告和协议参数 | - Network accessline 10
| --- | --- | --- | --- | | [MTR](https://github.com/traviscross/mtr/tree/v0.96) | 哪一段开始出现持续延迟、抖动或端到端丢包？ | 5 轮报告模式，JSON | 上游 v0.96；最低 v0.95，且本机必须实际支持适配器使用的全部 JSON、报告和协议参数 | | [NextTrace](https://github.com/nxtrace/NTrace-core/releases/tag/v - Network accessline 11
| [MTR](https://github.com/traviscross/mtr/tree/v0.96) | 哪一段开始出现持续延迟、抖动或端到端丢包？ | 5 轮报告模式，JSON | 上游 v0.96；最低 v0.95，且本机必须实际支持适配器使用的全部 JSON、报告和协议参数 | - Network accessline 12
| [NextTrace](https://github.com/nxtrace/NTrace-core/releases/tag/v1.7.1) | 当前去程经过哪些可见跳点？TCP/UDP 路径是否不同？ | 3 次采样、最多 30 跳，JSON | v1.7.1；Windows 为实验性支持，TCP/UDP 需要管理员权限和 WinDivert | - Network accessline 13
| [dnsdiag](https://github.com/farrokhi/dnsdiag/releases/tag/v2.9.4) | 指定 DNS 解析器是否延迟高、抖动大或丢包？ | `dnsping` 5 次查询 | dnsdiag 2.9.4；必须支持显式解析器端口 | - Network accessline 14
| [testssl.sh](https://github.com/testssl/testssl.sh/releases/tag/v3.2.4) | TLS 协议、证书或服务端默认参数是否异常？ | 聚焦 TLS 检查，JSON 文件 | testssl.sh 3.2.4；IPv6 目标必须使用方括号形式 | - Network accessline 15
| [IPQuality](https://github.com/xykt/IPQuality/tree/44c35cca002782ddd6364e039be2949a2535d1cc) | 当前出口在多个数据库中被怎样分类？ | 隐私模式、禁止装依赖、JSON 文件 | 固定提交 `44c35cca002782ddd6364e039be2949a2535d1cc`；Bash 4+ | - Network accessline 16
| [iperf3](https://github.com/esnet/iperf/releases/tag/3.21) | 两个自有端点之间是否存在明显吞吐差异？ | 有界时长、TCP 约 10 Mbit/s 或 UDP 约 5 Mbit/s，JSON | 上游 3.21；最低 3.16，且本机必须实际支持限时、限速、连接超时和 JSON 参数 | - Network accessline 55
MTR 和 iperf3 优先使用操作系统软件包，但“上游当前稳定版”不是硬性的最低兼容版。例如 [Ubuntu 24.04 的 mtr-tiny](https://packages.ubuntu.com/noble/mtr-tiny) 是 0.95、[iperf3](https://packages.ubuntu.com/noble/iperf3) 是 3.16；[Debian 13 的 mtr-tiny](https://packages.debian.org/trixi - Dangerous shell operationline 68
NetOps 不提供 `curl | bash` 安装流程。升级外部工具时应记录官方来源、稳定版本或提交、校验和与核验日期，然后运行 `tools status --versions` 和单元测试。版本号只是第一道门：还要探测实际参数和结构化输出能力。上游命令行或 JSON 结构改变时，适配器必须返回 `unsupported` 或 `unknown`，不能静默回退到纯文本猜测，也不能把命令退出码 0 当作网络健康。 - Network accessline 68
NetOps 不提供 `curl | bash` 安装流程。升级外部工具时应记录官方来源、稳定版本或提交、校验和与核验日期，然后运行 `tools status --versions` 和单元测试。版本号只是第一道门：还要探测实际参数和结构化输出能力。上游命令行或 JSON 结构改变时，适配器必须返回 `unsupported` 或 `unknown`，不能静默回退到纯文本猜测，也不能把命令退出码 0 当作网络健康。
references/source-policy.md
- Network accessline 27
- Xray routing: https://xtls.github.io/en/config/routing.html - Network accessline 28
- Xray outbound and target strategy: https://xtls.github.io/en/config/outbound.html - Network accessline 29
- Hysteria 2 troubleshooting: https://v2.hysteria.network/docs/advanced/Troubleshooting/ - Network accessline 30
- v2rayN Wiki: https://github.com/2dust/v2rayN/wiki - Network accessline 31
- Cloudflare IPv6 behavior: https://developers.cloudflare.com/network/ipv6-compatibility/ - Network accessline 38
- 已安装工具的结构化输出仍要记录版本、观察点、目标、时间、限制和原始返回状态。 - 不把工具热度、星标数量或聚合评分当作正确性证明。 - 不通过 `curl | bash` 运行浮动版本；使用系统包或经过审核的官方稳定版本，并在升级后重新验证参数和输出结构。 - Network accessline 39
- 不把工具热度、星标数量或聚合评分当作正确性证明。 - 不通过 `curl | bash` 运行浮动版本；使用系统包或经过审核的官方稳定版本，并在升级后重新验证参数和输出结构。 - GPL/AGPL 工具作为独立程序调用。NetOps 不复制其源码，也不删除其来源和许可证信息。 - Dangerous shell operationline 40
- 不通过 `curl | bash` 运行浮动版本；使用系统包或经过审核的官方稳定版本，并在升级后重新验证参数和输出结构。 - Network accessline 40
- 不通过 `curl | bash` 运行浮动版本；使用系统包或经过审核的官方稳定版本，并在升级后重新验证参数和输出结构。
schemas/change-plan.schema.json
schemas/change-spec.schema.json
schemas/diagnostic-bundle.schema.json
schemas/fleet.schema.json
scripts/check_install_tree.py
- Executable scriptline 1
#!/usr/bin/env python3
scripts/check_secrets.py
- Executable scriptline 1
#!/usr/bin/env python3
scripts/installed_smoke.py
- Executable scriptline 1
#!/usr/bin/env python3
scripts/netopsctl.py
scripts/package_smoke.py
scripts/release_check.py
- Executable scriptline 1
#!/usr/bin/env python3
scripts/reproducible_build.py
scripts/sync_install_tree.py
- Executable scriptline 1
#!/usr/bin/env python3
scripts/validate_skills.py
- Executable scriptline 1
#!/usr/bin/env python3
tests/test_bundle_redaction.py
tests/test_cli_contract.py
tests/test_control_channel.py
- Executable scriptline 1
Executable file
tests/test_data_contracts.py
- Executable scriptline 1
Executable file - Access to secretsline 59
[Credential-related source omitted] - Network accessline 86
"url": ( "https://" + "user" - Network accessline 87
"https://" + "user" + ":" - Access to secretsline 93
[Credential-related source omitted] - Network accessline 99
[Credential-related source omitted] - Network accessline 100
[Credential-related source omitted] - Network accessline 101
[Credential-related source omitted] - Network accessline 102
"https://example.invalid/" - Network accessline 105
[Credential-related source omitted] - Network accessline 106
"malformed_url": ( "http://" + "bad-user:bad-pass@example.invalid:notaport/path" ), - Network accessline 107
"http://" + "bad-user:bad-pass@example.invalid:notaport/path" - Network accessline 240
"sshpass -phunter2 ssh host", "sshpass -p'hunter2' ssh host", "curl -u alice:hunter2 https://example.invalid", - Network accessline 241
"sshpass -p'hunter2' ssh host", "curl -u alice:hunter2 https://example.invalid", "curl --user=alice:hunter2 https://example.invalid", - Network accessline 242
"curl -u alice:hunter2 https://example.invalid", - Network accessline 243
"curl --user=alice:hunter2 https://example.invalid", - Network accessline 244
"curl -ualice:hunter2 https://example.invalid", - Network accessline 245
"curl --proxy-user alice:proxypass https://example.invalid", - Network accessline 246
"mysql -uroot -pmysql-secret", "http --auth alice:http-secret https://example.invalid", ], - Network accessline 247
"http --auth alice:http-secret https://example.invalid", - Network accessline 431
[Credential-related source omitted] - Network accessline 432
[Credential-related source omitted] - Network accessline 433
[Credential-related source omitted] - Network accessline 529
probe="http-head", status="unknown", target="https://example.invalid" + current_path, - Network accessline 530
status="unknown", target="https://example.invalid" + current_path, ) - Network accessline 531
target="https://example.invalid" + current_path, - Network accessline 564
[Credential-related source omitted] - Network accessline 565
[Credential-related source omitted] - Network accessline 566
subscription_url = "https://example.test/sub/" + opaque_token - Network accessline 567
literal_plus_url = "https://example.test/sub/abcdefghijklmno+" - Network accessline 568
encoded_separator_url = ( "https://example.test/sub/abcdefghijklmno%2Fprivate" ) - Network accessline 569
"https://example.test/sub/abcdefghijklmno%2Fprivate" - Network accessline 573
) punctuated_subscription_urls = ( "https://example.test/sub/@abcdefghijklmnop", - Network accessline 574
punctuated_subscription_urls = ( "https://example.test/sub/@abcdefghijklmnop", "https://example.test/sub/:abcdefghijklmnop", - Network accessline 575
"https://example.test/sub/@abcdefghijklmnop", - Network accessline 576
"https://example.test/sub/:abcdefghijklmnop", - Network accessline 577
"https://example.test/sub/!abcdefghijklmnop", - Network accessline 578
"https://example.test/sub/abcdefghijklmnop@private", - Network accessline 579
"https://example.test/sub/abc12345", - Network accessline 580
"https://example.test/sub/秘密令牌", - Network accessline 581
"https://example.test/sub/secret-token-private-key", - Network accessline 582
) ordinary_urls = { "docs_url": "https://example.test/sub/documentation", - Network accessline 583
ordinary_urls = { "docs_url": "https://example.test/sub/documentation", "help_url": "https://example.test/subscription/getting-started-guide", - Network accessline 584
"docs_url": "https://example.test/sub/documentation", - Network accessline 585
"help_url": "https://example.test/subscription/getting-started-guide", - Network accessline 586
"encoded_help_url": ( "https://example.test/subscription/getting%2Dstarted%2Dguide" ), - Network accessline 587
"https://example.test/subscription/getting%2Dstarted%2Dguide" - Access to secretsline 694
[Credential-related source omitted] - Access to secretsline 698
[Credential-related source omitted] - Network accessline 1701
"az login -u alice -p opaque-azure-secret", "pscp -pw opaque-putty-secret file user@server:/tmp", "curl --cookie session=opaque-cookie-secret https://example.invalid", - Network accessline 1702
"pscp -pw opaque-putty-secret file user@server:/tmp", "curl --cookie session=opaque-cookie-secret https://example.invalid", ] - Network accessline 1703
"curl --cookie session=opaque-cookie-secret https://example.invalid", - Network accessline 1722
] urls = [ "https://hooks.slack.com/services/T1/B2/opaque-slack-secret", - Network accessline 1723
urls = [ "https://hooks.slack.com/services/T1/B2/opaque-slack-secret", "https://discord.com/api/webhooks/123/opaque-discord-secret", - Network accessline 1724
"https://hooks.slack.com/services/T1/B2/opaque-slack-secret", - Network accessline 1725
"https://discord.com/api/webhooks/123/opaque-discord-secret", - Network accessline 1726
"https://api.telegram.org/botopaque-telegram-secret/getMe", - Network accessline 1727
"https://storage.googleapis.com/object?x-goog-signature=opaque-gcs-secret", - Network accessline 1790
f"resolver: {identifiers[2]}", f"target: {identifiers[3]}", "https://2130706433/path", - Network accessline 1791
f"target: {identifiers[3]}", "https://2130706433/path", "https://127.0.0.1./path", - Network accessline 1792
"https://2130706433/path", - Network accessline 1793
"https://127.0.0.1./path",
tests/test_docs_contract.py
- Executable scriptline 1
Executable file - Network accessline 298
"", "```bash", "git clone --depth 1 https://example.test/NetOps.git", - Network accessline 299
"```bash", "git clone --depth 1 https://example.test/NetOps.git", "netopsctl tools list", - Network accessline 300
"git clone --depth 1 https://example.test/NetOps.git",
tests/test_external_tools.py
- Executable scriptline 1
Executable file - Access to secretsline 726
[Credential-related source omitted] - Access to secretsline 745
[Credential-related source omitted] - Access to secretsline 759
[Credential-related source omitted] - Access to secretsline 776
[Credential-related source omitted] - Access to secretsline 781
[Credential-related source omitted] - Access to secretsline 786
[Credential-related source omitted] - Access to secretsline 908
[Credential-related source omitted] - Network accessline 909
[Credential-related source omitted] - Network accessline 910
[Credential-related source omitted] - Network accessline 911
"HTTPS_PROXY": "http://private-proxy.invalid:8080",
tests/test_fleet_change.py
- Executable scriptline 1
Executable file - Access to secretsline 325
[Credential-related source omitted] - Access to secretsline 327
[Credential-related source omitted] - Access to secretsline 331
[Credential-related source omitted] - Access to secretsline 333
[Credential-related source omitted] - Dangerous shell operationline 725
"command": "rm -f /tmp/example", - Dangerous shell operationline 744
self.assertIn("rm -f /tmp/example", script) - Network accessline 853
def test_remote_output_removes_terminal_control_sequences(self): value = "\x1b]8;;https://evil.invalid\x07click\x1b]8;;\x07\x1b[31mRED\x1b[0m" - Network accessline 854
value = "\x1b]8;;https://evil.invalid\x07click\x1b]8;;\x07\x1b[31mRED\x1b[0m" - Dangerous shell operationline 1476
if "rm -f -- ./payload-" in script:
tests/test_fleet_contract.py
- Executable scriptline 1
Executable file - Access to secretsline 58
[Credential-related source omitted] - Access to secretsline 83
[Credential-related source omitted] - Network accessline 154
with self.subTest(unsafe=unsafe): self.assertIsNone(re.fullmatch(reviewed_pattern, unsafe)) for invalid_domain in ("192.0.2.9", "https://panel.example.test/"): - Network accessline 155
self.assertIsNone(re.fullmatch(reviewed_pattern, unsafe)) for invalid_domain in ("192.0.2.9", "https://panel.example.test/"): with self.subTest(domain=invalid_domain): - Network accessline 156
for invalid_domain in ("192.0.2.9", "https://panel.example.test/"): - Network accessline 183
"panel reference": lambda host: host["management"].__setitem__( "panel_reference", "https://" + "user" + ":" + "secret" + "@example.test/", - Network accessline 184
"panel_reference", "https://" + "user" + ":" + "secret" + "@example.test/", ), - Network accessline 185
"https://" + "user" + ":" + "secret" + "@example.test/", - Network accessline 252
), "URL in domain list": lambda host: host["domains"]["panel"].append( "https://panel.example.test/" - Network accessline 253
"URL in domain list": lambda host: host["domains"]["panel"].append( "https://panel.example.test/" ), - Network accessline 254
"https://panel.example.test/"
tests/test_models_report.py
- Executable scriptline 1
Executable file
tests/test_monitor.py
- Executable scriptline 1
Executable file
tests/test_monitor_privacy.py
- Executable scriptline 1
Executable file
tests/test_package_smoke.py
- Executable scriptline 1
Executable file
tests/test_release_integrity.py
- Executable scriptline 1
Executable file - Network accessline 51
"## [1.2.3] - 2026-08-29\n\n" f"{release_body}\n\n" "[Unreleased]: https://example.test/compare/v1.2.3...HEAD\n" - Network accessline 52
f"{release_body}\n\n" "[Unreleased]: https://example.test/compare/v1.2.3...HEAD\n" "[1.2.3]: https://example.test/compare/v1.2.2...v1.2.3\n", - Network accessline 53
"[Unreleased]: https://example.test/compare/v1.2.3...HEAD\n" - Network accessline 54
"[1.2.3]: https://example.test/compare/v1.2.2...v1.2.3\n",
tests/test_remote_collector.py
tests/test_reproducible_build.py
- Executable scriptline 1
Executable file - Possible obfuscationline 142
self.assertEqual(header[:4], b"\x1f\x8b\x08\x00") - Access to secretsline 266
[Credential-related source omitted] - Network accessline 267
[Credential-related source omitted] - Network accessline 268
[Credential-related source omitted] - Network accessline 269
"HTTPS_PROXY": "http://secret.example",
tests/test_scanner.py
- Executable scriptline 1
Executable file - Access to secretsline 54
[Credential-related source omitted] - Access to secretsline 59
[Credential-related source omitted] - Network accessline 79
def _listener(self): server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - Network accessline 80
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - Network accessline 394
with patch.dict( "os.environ", {"HTTPS_PROXY": 'http://proxy.invalid\noutput = "/tmp/leak"'}, - Network accessline 395
[Credential-related source omitted] - Access to secretsline 395
[Credential-related source omitted] - Network accessline 396
{"HTTPS_PROXY": 'http://proxy.invalid\noutput = "/tmp/leak"'}, - Network accessline 417
with patch.dict( "os.environ", {"HTTPS_PROXY": "http://127.0.0.1:8080"}, - Network accessline 418
[Credential-related source omitted] - Access to secretsline 418
[Credential-related source omitted] - Network accessline 419
{"HTTPS_PROXY": "http://127.0.0.1:8080"}, - Network accessline 432
no_proxy_index = command.index("--noproxy") self.assertEqual(command[no_proxy_index + 1], "") self.assertEqual(command[-1], "https://[2001:db8::1]:443/%5B1-100%5D") - Network accessline 433
self.assertEqual(command[no_proxy_index + 1], "") self.assertEqual(command[-1], "https://[2001:db8::1]:443/%5B1-100%5D") self.assertEqual(command.count(command[-1]), 1) - Network accessline 434
self.assertEqual(command[-1], "https://[2001:db8::1]:443/%5B1-100%5D") - Network accessline 454
"2001:db8::1", 8080, "/", False, 1, address ) self.assertEqual(ipv6_observation.target, "http://[2001:db8::1]:8080/") - Network accessline 455
) self.assertEqual(ipv6_observation.target, "http://[2001:db8::1]:8080/") connection_class.assert_called_with( - Network accessline 456
self.assertEqual(ipv6_observation.target, "http://[2001:db8::1]:8080/") - Network accessline 468
self.assertEqual( idna_observation.target, "http://xn--fsqu00a.xn--0zwm56d:80/%E8%B7%AF%E5%BE%84", - Network accessline 469
idna_observation.target, "http://xn--fsqu00a.xn--0zwm56d:80/%E8%B7%AF%E5%BE%84", ) - Network accessline 470
"http://xn--fsqu00a.xn--0zwm56d:80/%E8%B7%AF%E5%BE%84", - Network accessline 528
with patch.dict( "os.environ", {"HTTPS_PROXY": "http://proxy.exa\u200dmple"}, - Network accessline 529
[Credential-related source omitted] - Access to secretsline 529
[Credential-related source omitted] - Network accessline 530
{"HTTPS_PROXY": "http://proxy.exa\u200dmple"}, - Network accessline 567
status="unknown", ) proxy_value = "http://" + "user:password@" + "Proxy.Example:8443" - Network accessline 568
) proxy_value = "http://" + "user:password@" + "Proxy.Example:8443" with patch.dict( - Network accessline 569
proxy_value = "http://" + "user:password@" + "Proxy.Example:8443" - Access to secretsline 571
[Credential-related source omitted] - Access to secretsline 618
[Credential-related source omitted] - Network accessline 633
with patch.dict( "os.environ", {"HTTPS_PROXY": "http://[bad"}, - Network accessline 634
[Credential-related source omitted] - Access to secretsline 634
[Credential-related source omitted] - Network accessline 635
{"HTTPS_PROXY": "http://[bad"}, - Network accessline 648
) proxy_probe.assert_not_called() self.assertNotIn("http://[bad", str(invalid_bundle.to_dict())) - Network accessline 650
self.assertNotIn("http://[bad", str(invalid_bundle.to_dict())) - Network accessline 710
def test_proxy_environment_summary_does_not_store_proxy_value(self): proxy_url = "http://" + "user" + ":" + "password" + "@127.0.0.1:8080" - Network accessline 711
proxy_url = "http://" + "user" + ":" + "password" + "@127.0.0.1:8080" - Access to secretsline 713
[Credential-related source omitted] - Network accessline 726
def test_proxy_environment_summary_fails_closed_for_malformed_url(self): malformed = "http://[bad" - Network accessline 727
malformed = "http://[bad" - Access to secretsline 729
[Credential-related source omitted] - Access to secretsline 795
[Credential-related source omitted] - Network accessline 796
result = _run_isolated_python( _URL_FETCH_SCRIPT, [f"http://127.0.0.1:{server.server_port}/", "3"], - Network accessline 797
_URL_FETCH_SCRIPT, [f"http://127.0.0.1:{server.server_port}/", "3"], timeout=3, - Network accessline 798
[f"http://127.0.0.1:{server.server_port}/", "3"], - Network accessline 1270
with patch.dict( "os.environ", {"HTTPS_PROXY": "http://proxy-one.example:8080"}, - Network accessline 1271
[Credential-related source omitted] - Access to secretsline 1271
[Credential-related source omitted] - Network accessline 1272
{"HTTPS_PROXY": "http://proxy-one.example:8080"}, - Network accessline 1282
with patch.dict( "os.environ", {"HTTPS_PROXY": "http://proxy-two.example:8080"}, - Network accessline 1283
[Credential-related source omitted] - Access to secretsline 1283
[Credential-related source omitted] - Network accessline 1284
{"HTTPS_PROXY": "http://proxy-two.example:8080"}, - Network accessline 1485
"severity": "warning", "segment": "destination", "title": "[click](https://malicious.test)\n## injected", - Network accessline 1486
"segment": "destination", "title": "[click](https://malicious.test)\n## injected", "evidence": [], - Network accessline 1487
"title": "[click](https://malicious.test)\n## injected",
tests/test_secret_scan.py
- Executable scriptline 1
Executable file
tests/test_serialization_safety.py
- Executable scriptline 1
Executable file
tests/test_skill_contract.py
- Executable scriptline 1
Executable file - Network accessline 659
text.count( "git clone --branch v0.6.0 --depth 1 " "https://github.com/Con-Benksl/NetOps.git" - Network accessline 660
"git clone --branch v0.6.0 --depth 1 " "https://github.com/Con-Benksl/NetOps.git" ), - Network accessline 661
"https://github.com/Con-Benksl/NetOps.git" - Network accessline 663
2, ) self.assertIn("[LINUX DO](https://linux.do)", text) - Network accessline 664
) self.assertIn("[LINUX DO](https://linux.do)", text) self.assertNotIn( - Network accessline 665
self.assertIn("[LINUX DO](https://linux.do)", text) - Network accessline 666
self.assertNotIn( "git clone https://github.com/Con-Benksl/NetOps.git", text, - Network accessline 667
"git clone https://github.com/Con-Benksl/NetOps.git",
tests/test_sync_install_tree.py
tests/test_util.py
- Executable scriptline 1
Executable file - Access to secretsline 21
[Credential-related source omitted] - Network accessline 23
[Credential-related source omitted] - Network accessline 24
[Credential-related source omitted] - Network accessline 25
"HTTP_PROXY": "http://proxy.invalid", - Access to secretsline 41
[Credential-related source omitted] - Access to secretsline 77
[Credential-related source omitted] - Access to secretsline 85
[Credential-related source omitted]
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Declared and executed: 3 facts
- Contacts software.es.net, which SKILL.md, the README and the plugin manifest do not mentionnetops_core/external_tools.py:257High confidence
- Contacts api.ipify.org, which SKILL.md, the README and the plugin manifest do not mentionnetops_core/scanner.py:426High confidence
- Contacts www.cloudflare.com, which SKILL.md, the README and the plugin manifest do not mentionnetops_core/scanner.py:427High confidence
Signal confidence: 388 facts
- Network access in prose of documentationCHANGELOG.md:5Low confidence
- Network access in prose of documentationCHANGELOG.md:6Low confidence
- Network access in prose of documentationCHANGELOG.md:85Low confidence
- Network access in prose of documentationCHANGELOG.md:320Low confidence
- Network access in prose of documentationCHANGELOG.md:321Low confidence
- Network access in prose of documentationCHANGELOG.md:322Low confidence
- Network access in prose of documentationCHANGELOG.md:323Low confidence
- Network access in prose of documentationCHANGELOG.md:324Low confidence
- Network access in prose of documentationCHANGELOG.md:325Low confidence
- Network access in prose of documentationCHANGELOG.md:326Low confidence
- Network access in prose of documentationREADME.md:5Low confidence
- Network access in prose of documentationREADME.md:7Low confidence
- Network access in prose of documentationREADME.md:8Low confidence
- Network access in prose of documentationREADME.md:9Low confidence
- Network access in prose of documentationREADME.md:10Low confidence
- Network access in code of documentationREADME.md:51Low confidence
- Network access in code of documentationREADME.md:70Low confidence
- Network access in prose of documentationREADME.md:256Low confidence
- Network access in prose of documentationREADME.md:257Low confidence
- Dangerous shell operation in prose of documentationREADME.md:258Low confidence
- Network access in prose of documentationREADME.md:258Low confidence
- Network access in prose of documentationREADME.zh-CN.md:5Low confidence
- Network access in code of documentationREADME.zh-CN.md:56Low confidence
- Network access in code of documentationREADME.zh-CN.md:103Low confidence
- Network access in prose of documentationREADME.zh-CN.md:281Low confidence
- Network access in prose of documentationREADME.zh-CN.md:282Low confidence
- Dangerous shell operation in prose of documentationREADME.zh-CN.md:283Low confidence
- Network access in prose of documentationREADME.zh-CN.md:283Low confidence
- Network access in prose of documentationSECURITY.md:13Low confidence
- Executable script in prose of a file that runsnetops_core/__init__.py:1Low confidence
- Executable script in code of a file that runsnetops_core/bundle.py:1High confidence
- Access to secrets in code of a file that runsnetops_core/bundle.py:232High confidence
- Possible obfuscation in code of a file that runsnetops_core/bundle.py:344High confidence
- Access to secrets in code of a file that runsnetops_core/bundle.py:460High confidence
- Access to secrets in code of a file that runsnetops_core/bundle.py:465High confidence
- Access to secrets in code of a file that runsnetops_core/bundle.py:471High confidence
- Access to secrets in code of a file that runsnetops_core/bundle.py:495High confidence
- Access to secrets in code of a file that runsnetops_core/bundle.py:554High confidence
- Access to secrets in code of a file that runsnetops_core/bundle.py:566High confidence
- Access to secrets in code of a file that runsnetops_core/bundle.py:567High confidence
- Access to secrets in code of a file that runsnetops_core/bundle.py:572High confidence
- Access to secrets in code of a file that runsnetops_core/bundle.py:573High confidence
- Access to secrets in code of a file that runsnetops_core/bundle.py:578High confidence
- Executable script in code of a file that runsnetops_core/change.py:1High confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuenetops_core/change.py:1591Low confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuenetops_core/change.py:1643Low confidence
- Dangerous shell operation in code of a file that runsnetops_core/change.py:1644High confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuenetops_core/change.py:1656Low confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuenetops_core/change.py:1659Low confidence
- Dangerous shell operation in code of a file that runsnetops_core/change.py:1835High confidence
and 338 more
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Compatible | Standard SKILL.md SKILL.md | .claude/skills/<skill-name>/ |
| Codex | Native | Manifest AGENTS.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
