Agent skill

Nftables Allow Source

Add a source IP or CIDR to nftables using the working method from this repo session: live top-of-input insertion with nft -a verification first, then persistent config update and reload.

Apache-2.0Auto-check: notesBusiness, Finance & HR

Install Nftables Allow Source

skills CLI

$ npx skills add SpecterOps/skills --skill nftables-allow-source -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install SpecterOps/skills nftables-allow-source --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/ops-infrastructure/skills/nftables-allow-source .claude/skills/nftables-allow-source && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "nftables-allow-source" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-infrastructure/skills/nftables-allow-source into .claude/skills/nftables-allow-source/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nftables-allow-source", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/SpecterOps/skills/tree/main/plugins/ops-infrastructure/skills/nftables-allow-source

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add SpecterOps/skills --skill nftables-allow-source -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install SpecterOps/skills nftables-allow-source --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/ops-infrastructure/skills/nftables-allow-source .agents/skills/nftables-allow-source && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "nftables-allow-source" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-infrastructure/skills/nftables-allow-source into .agents/skills/nftables-allow-source/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nftables-allow-source", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add SpecterOps/skills --skill nftables-allow-source -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install SpecterOps/skills nftables-allow-source --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/ops-infrastructure/skills/nftables-allow-source .cursor/skills/nftables-allow-source && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "nftables-allow-source" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-infrastructure/skills/nftables-allow-source into .cursor/skills/nftables-allow-source/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nftables-allow-source", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/SpecterOps/skills.git --path plugins/ops-infrastructure/skills/nftables-allow-source

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add SpecterOps/skills --skill nftables-allow-source -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install SpecterOps/skills nftables-allow-source --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/ops-infrastructure/skills/nftables-allow-source .gemini/skills/nftables-allow-source && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "nftables-allow-source" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-infrastructure/skills/nftables-allow-source into .gemini/skills/nftables-allow-source/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nftables-allow-source", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install SpecterOps/skills nftables-allow-source

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add SpecterOps/skills --skill nftables-allow-source -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/ops-infrastructure/skills/nftables-allow-source .github/skills/nftables-allow-source && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "nftables-allow-source" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-infrastructure/skills/nftables-allow-source into .github/skills/nftables-allow-source/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nftables-allow-source", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add SpecterOps/skills --skill nftables-allow-source -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install SpecterOps/skills nftables-allow-source --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/ops-infrastructure/skills/nftables-allow-source .opencode/skills/nftables-allow-source && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "nftables-allow-source" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-infrastructure/skills/nftables-allow-source into .opencode/skills/nftables-allow-source/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nftables-allow-source", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: nftables-allow-source
GitHub stars: 702
Token cost: ~1.5k tokens
SKILL.md length: 711 words
Files: 4 (incl. assets)
Skills in repo: 38
Repo updated: Sep 23, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Add a source IP or CIDR to nftables using the working method from this repo session: live top-of-input insertion with nft -a verification first, then persistent config update and reload.

Works in 4 steps: Confirm the host is in scope and… → Confirm SSH or console access exists… → Confirm nft is installed and the host is… → …
Tasks that involve Crypto and DeFi analysis
SKILL.md covers Direct Triggers, Input Contract, Preconditions and Execution Workflow, plus 5 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Nftables Allow Source is an agent skill from SpecterOps/skills. Add a source IP or CIDR to nftables using the working method from this repo session: live top-of-input insertion with nft -a verification first, then persistent config update and reload.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including assets (for example `agents/openai.yaml`).

It sits in Business, Finance & HR, covering Crypto and DeFi analysis. The repository describes itself as: A marketplace for LLM skills. The licence is Apache-2.0.

When your agent uses it

Tasks that involve Crypto and DeFi analysis

Example prompts

“/nftables-allow-source”

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

Confirm the host is in scope and operator-controlled.
Confirm SSH or console access exists before changing the firewall.
Confirm nft is installed and the host is actually using nftables.
Prefer live insertion into the input chain before any persistent edit.

What it can do on your machine

Read from SKILL.md and the folder at commit e655f93. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Nftables Allow Source loads about 1.5k tokens when it runs. Until then it costs about 53 tokens; SKILL.md has 711 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~53
When it runs · the whole SKILL.md, loaded when a task matches: ~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

NoteRuns commands with sudoSKILL.md:55

sudo nft -a list chain inet filter input

NoteRuns commands with sudoSKILL.md:72

sudo nft insert rule inet filter input position 0 ip saddr <SOURCE> accept

NoteRuns commands with sudoSKILL.md:80

sudo nft -a list chain inet filter input

NoteRuns commands with sudoSKILL.md:94
```
- `sudo nft -f /etc/nftables.conf`
```

NoteRuns commands with sudoSKILL.md:96

- `sudo sed -n '/chain input {/,/}/p' /etc/nftables.conf`

NoteRuns commands with sudoSKILL.md:97

- `sudo nft -a list chain inet filter input`

NoteRuns commands with sudoSKILL.md:105

sudo nft -a list chain inet filter input

NoteRuns commands with sudoSKILL.md:111

sudo nft insert rule inet filter input position 0 ip saddr 203.0.113.42 accept

NoteRuns commands with sudoSKILL.md:117

sudo cp /etc/nftables.conf /etc/nftables.conf.bak-$(date +%Y%m%d%H%M%S)

NoteRuns commands with sudoSKILL.md:123

sudo sed -i '/type filter hook input priority filter; policy drop;/a\        ip saddr 203.0.113.42 accept comment "Autho

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from SpecterOps/skills at commit e655f93, republished under its Apache-2.0 licence (© SpecterOps). 711 words, ~1,474 tokens.

Download SKILL.mdSave it as .claude/skills/nftables-allow-source/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.

name: nftables-allow-source
description: Add a source IP or CIDR to nftables using the working method from this repo session: live top-of-`input` insertion with `nft -a` verification first, then persistent config update and reload.
metadata.author: GhostWorks

Nftables Allow Source

Use this skill to add a source IP or CIDR to nftables using the method that worked in this repo session:

inspect the live input chain with nft -a
insert a source allow rule at the top of the live input chain
verify the live rule immediately
add the same source allow rule to /etc/nftables.conf in the input chain
reload the ruleset and verify config and live state match

Do not use a config-first workflow here. The working method is live input insertion first, persistence second.

Direct Triggers

Use this skill when the task mentions any of the following:

add an nftables allow rule
allow inbound from an IP
whitelist an IP in nftables
add a source address to the firewall
insert an nft rule at the top
use nft -a handles

Input Contract

Accept input as: HOST SOURCE [MODE]

Mode:

plan: produce the command sequence only
execute (default): inspect, insert, and verify the live rule

Examples:

$nftables-allow-source bastion 203.0.113.42 execute
$nftables-allow-source 198.51.100.25 203.0.113.42/32 plan
$nftables-allow-source edge-firewall 198.51.100.0/24 execute

Preconditions

Confirm the host is in scope and operator-controlled.
Confirm SSH or console access exists before changing the firewall.
Confirm nft is installed and the host is actually using nftables.
Prefer live insertion into the input chain before any persistent edit.

Execution Workflow

Inspect the live input chain with handles.

bash

sudo nft -a list chain inet filter input

Use this to:

confirm the chain exists
see current rule order
identify whether a matching source rule already exists

Verify whether the source is already allowed.

If already present in the live chain, do not insert a duplicate.
Record existing handle and position if present.

Insert the allow rule at the top of the live input chain.

Preferred live insertion pattern:

bash

sudo nft insert rule inet filter input position 0 ip saddr <SOURCE> accept

This is the working method and should be preferred over editing /etc/nftables.conf first.

Verify the live input chain immediately.

bash

sudo nft -a list chain inet filter input

Success means the new ip saddr <SOURCE> accept rule appears at the top of the input chain before the rest of the policy logic.

Persist the same rule in /etc/nftables.conf.

insert ip saddr <SOURCE> accept comment "Authorized External IP" immediately after:
- type filter hook input priority filter; policy drop;
do not rely on a broad grep for the source IP elsewhere in the file; check the input chain specifically
if /etc/nftables.conf is empty or corrupted, restore from the latest backup before editing
back up the file before changing it

Reload and verify.

reload with:
- sudo nft -f /etc/nftables.conf
verify both:
- sudo sed -n '/chain input {/,/}/p' /etc/nftables.conf
- sudo nft -a list chain inet filter input
confirm the persistent and live rules both contain the source allow at the top of the input chain

Show full SKILL.md (266 more words)Show less

Command Patterns

Live chain inspection

bash

sudo nft -a list chain inet filter input

Live top-of-chain insertion

bash

sudo nft insert rule inet filter input position 0 ip saddr 203.0.113.42 accept

Persistent config backup

bash

sudo cp /etc/nftables.conf /etc/nftables.conf.bak-$(date +%Y%m%d%H%M%S)

Persistent input-chain insertion

bash

sudo sed -i '/type filter hook input priority filter; policy drop;/a\        ip saddr 203.0.113.42 accept comment "Authorized External IP"' /etc/nftables.conf

Persistent config reload

bash

sudo nft -f /etc/nftables.conf

Post-reload verification

bash

sudo sed -n '/chain input {/,/}/p' /etc/nftables.conf
sudo nft -a list chain inet filter input

Prohibited Method

Do not use these approaches as the default workflow for this skill:

editing /etc/nftables.conf first and assuming reload will be safe
checking only whether the source IP exists somewhere in the file instead of in the input chain
adding the exception only to the management chain when the operator wants a host-wide source exception
broad text-rewrite methods that can blank or corrupt /etc/nftables.conf

OPSEC Gate

Require explicit operator confirmation before:

broad rules such as 0.0.0.0/0
wide CIDR additions that materially expand exposure
deleting or reordering existing firewall controls
reloading or restarting nftables on production-like hosts when access risk is non-trivial

Before requesting approval, include:

exact rule change
objective
expected impact
rollback plan
possible connectivity risk

Reporting Requirements

For each run, include:

target host
live chain modified: inet filter input
source IP/CIDR added
exact commands used
pre-change live chain output
post-change live chain output
persistent input-chain config snippet after edit
whether the rule is live only or also persistent
any remaining follow-up needed to reconcile config and runtime state

Troubleshooting Note

If a service is still unreachable after the source allow rule is added:

verify the service is actually listening on the destination host
compare reachability of the blocked port against a temporary listener on an alternate port on the same host
if the alternate port succeeds while the original port fails, do not attribute the failure to nftables alone
report that the environment or path may specifically disallow the original port

Files

SKILL.md and 3 other files (assets) in plugins/ops-infrastructure/skills/nftables-allow-source of SpecterOps/skills.

SKILL.md
agents/openai.yaml
assets/icon.png
assets/icon.svg

Open the folder on GitHubat commit e655f93

Compare with similar skills

Nftables Allow Source next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Nftables Allow Source compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Nftables Allow Source this skillSpecterOps/skills	702	—	~1.5k	Automated safety check: Notes	Apache-2.0	14 days ago
Technical Analysttradermonty/claude-trading-skills	3k	5 repos	~4.6k	Automated safety check: Pass	MIT	yesterday
Polyclawchainstacklabs/polyclaw	360	1 repos	~2k	Automated safety check: Pass	Apache-2.0	5 mo ago
Longbridge Researchhelsome/folio	269	3 repos	~2.1k	Automated safety check: Pass	MIT	4 days ago
Stock Analysis24mlight/StockClaw	101	2 repos	~2k	Automated safety check: Notes	MIT	6 mo ago
Swapper Depositswapperfinance/swapper-toolkit	852	—	~1.8k	Automated safety check: Pass	MIT	6 mo ago

Similar skills

Technical Analyst
tradermonty/claude-trading-skills
This skill should be used when analyzing weekly price charts for stocks, stock indices, cryptocurrencies, or forex pairs.
3k GitHub starsUsed in 5 repos~4.6k tokens
Business, Finance & HRAuto-check passed
Polyclaw
chainstacklabs/polyclaw
Trade on Polymarket via split + CLOB execution. An agent skill from chainstacklabs/polyclaw.
360 GitHub starsUsed in 1 repo~2k tokens
Business, Finance & HRAuto-check passed
Longbridge Research
helsome/folio
Institution ratings, consensus price targets, EPS/revenue forecasts, finance calendar, shareholder data, fund holders, insider trades (SEC Form 4), short interest, industry rankings, peer group…
269 GitHub starsUsed in 3 repos~2.1k tokens
Business, Finance & HRAuto-check passed
Stock Analysis
24mlight/StockClaw
Analyze stocks and cryptocurrencies using Yahoo Finance data.
101 GitHub starsUsed in 2 repos~2k tokens
Business, Finance & HRAuto-check: notes
Swapper Deposit
swapperfinance/swapper-toolkit
Deposit and bridge funds into a wallet or protocol using Swapper Finance.
852 GitHub stars~1.8k tokensUpdated 6 mo ago
Business, Finance & HRAuto-check passed
Okx Cex Earn
okx/agent-skills
Manages OKX Simple Earn (flexible savings/lending), Flash Earn, On-chain Earn (staking/DeFi), Dual Investment (DCD/双币赢), and AutoEarn (自动赚币) via the okx CLI.
185 GitHub starsUsed in 2 repos~3.3k tokens
Business, Finance & HRAuto-check passed

Questions about Nftables Allow Source

What does Nftables Allow Source do?

Add a source IP or CIDR to nftables using the working method from this repo session: live top-of-input insertion with nft -a verification first, then persistent config update and reload. Nftables Allow Source is an agent skill from SpecterOps/skills. Add a source IP or CIDR to nftables using the working method from this repo session: live top-of-input insertion with nft -a verification first, then persistent config update and reload.

When should I use Nftables Allow Source?

Nftables Allow Source fits situations like: tasks that involve Crypto and DeFi analysis.

How do I install Nftables Allow Source in Claude Code?

Run `npx skills add SpecterOps/skills --skill nftables-allow-source -a claude-code`. Or copy the skill folder (plugins/ops-infrastructure/skills/nftables-allow-source in SpecterOps/skills) into .claude/skills/nftables-allow-source in your project. Claude Code loads it when a task matches its description.

How do I install Nftables Allow Source in Codex?

Run `npx skills add SpecterOps/skills --skill nftables-allow-source -a codex`. Or copy the skill folder (plugins/ops-infrastructure/skills/nftables-allow-source in SpecterOps/skills) into .agents/skills/nftables-allow-source in your project. Codex loads it when a task matches its description.

Can I use Nftables Allow Source in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add SpecterOps/skills --skill nftables-allow-source -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/nftables-allow-source, .gemini/skills/nftables-allow-source, .github/skills/nftables-allow-source and .opencode/skills/nftables-allow-source in your project.

What does Nftables Allow Source need to run?

SKILL.md names no scripts, command-line tools or credentials: Nftables Allow Source is instructions for the agent only.

Does Nftables Allow Source access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Nftables Allow Source safe to install?

Our automated static check of SKILL.md found notes only (runs commands with sudo), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Nftables Allow Source use?

Nftables Allow Source is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Nftables Allow Source use?

About 1.5k tokens (SKILL.md is roughly 5.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Nftables Allow Source?

Skills that share tags, products or a category with Nftables Allow Source: Technical Analyst (tradermonty/claude-trading-skills, 3k stars), Polyclaw (chainstacklabs/polyclaw, 360 stars), Longbridge Research (helsome/folio, 269 stars) and Stock Analysis (24mlight/StockClaw, 101 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Nftables Allow Source?

SpecterOps (a GitHub organization) maintains it in SpecterOps/skills, which has 702 GitHub stars. The repository holds 38 skills in this directory. The repository was last updated on September 23, 2026.

Source: SpecterOps/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Nftables Allow Source

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Nftables Allow Source

Direct Triggers

Input Contract

Preconditions

Execution Workflow

Command Patterns

Live chain inspection

Live top-of-chain insertion

Persistent config backup

Persistent input-chain insertion

Persistent config reload

Post-reload verification

Prohibited Method

OPSEC Gate

Reporting Requirements

Troubleshooting Note

Files

Compare with similar skills

Similar skills

More from SpecterOps/skills

Related

Questions about Nftables Allow Source