AI Skill and Agent Workflows#

rauto ships with the rauto-usage Skill so an AI coding agent can work with the current CLI, Web console, JSON models, and safety rules instead of guessing commands from generic network knowledge.

The Skill is useful when you want an agent to:

• inspect saved devices, credentials, groups, labels, profiles, and show objects
• run safe read-only checks with rauto show
• discover SSH devices and save selected results
• author complete transaction, workflow, or orchestration JSON
• validate generated plans against the installed rauto binary
• start the local Web console or a managed Agent when explicitly requested
• summarize results and point to session records for replay

#Install the Skill

Install from the rauto repository with the Skills CLI:

npx skills add demohiiiii/rauto --skill rauto-usage

Use --global for a user-level installation:

npx skills add demohiiiii/rauto --skill rauto-usage --global

The CLI detects supported AI agents and manages their Skill directories. Use --agent <agent> when you need to target one supported agent explicitly.

The Skill source is available at skills/rauto-usage/. It includes operator runbooks, current JSON templates, discovery guidance, troubleshooting notes, and a CLI-backed plan validator.

#Skill versus Agent mode

These two uses of "agent" solve different problems:

Installing the Skill does not expose an API or start a service. Starting rauto agent does not automatically give an AI assistant the Skill instructions.

#Prepare rauto for AI-assisted work

Keep authentication and target identity in rauto instead of placing secrets in prompts.

rauto credential add network-admin

rauto device add core-01 \
  --host 192.168.1.10 \
  --credential network-admin \
  --device-profile autodetect

rauto device test --connection core-01

An AI agent can then refer to core-01 and network-admin by name. Credential list/show output contains metadata, not plaintext secrets.

For group operations, create saved-device groups or labels first. This lets the AI express scope with --group, --label, target_groups, or target_tags without inventing inline credentials.

#Ask the AI to inspect before acting

In Codex, name the Skill explicitly when you want the workflow applied:

Use $rauto-usage. List the saved devices and available show objects, then run
a read-only version check against the access group. Do not change configuration.
Return the exact commands and a concise per-device summary.

The Skill directs the agent to prefer stable show objects over raw commands:

rauto device list --json
rauto show --list --device-profile cisco_ios
rauto show version --group access --max-parallel 4

Use rauto exec only when no built-in or custom show object fits the read operation.

#Generate a safe configuration change

For configuration changes, ask the AI to stop before execution:

Use $rauto-usage to create a rollback-aware workflow for VLAN 120 on the saved
access-switch group. Include a read-only precheck, bound concurrency, and a
rollback command. Validate the complete JSON and run the native dry-run, but do
not execute the change until I approve the final scope and plan.

The expected workflow is:

1. Inspect saved devices, groups, profiles, and available modes.
2. Generate a complete tx-workflow or orchestrate JSON document.
3. Validate it with the Skill's validate_json_plans.py script.
4. Run rauto tx-workflow ... --dry-run or rauto orchestrate ... --dry-run.
5. Present target scope, concurrency, failure policy, commands, and rollback behavior.
6. Wait for explicit approval before executing the real change.
7. Summarize results and preserve the session record for review or replay.

When working from a rauto source checkout, plan validation can be run directly:

python3 skills/rauto-usage/scripts/validate_json_plans.py \
  --kind orchestration \
  --file ./campus-rollout.json

rauto orchestrate ./campus-rollout.json --dry-run

The validator delegates to the current rauto CLI, so generated JSON is checked against the installed runtime model instead of a copied schema.

#Useful prompt patterns

#Discover devices without importing everything

Use $rauto-usage to scan 192.168.60.0/24 with the saved network-admin
credential. Show only newly identified SSH devices. Do not auto-save; let me
review the result before importing selected devices.

#Diagnose configuration drift

Use $rauto-usage to fetch running configuration from the core group with
normalized content and SHA-256 hashes. Compare the results and report drift.
This is read-only; do not run configuration commands.

#Start the local Web console

Use $rauto-usage to start rauto web on its loopback default, keep the process
running, and tell me the local URL and how the Web password is handled.

#Safety rules worth keeping

• Keep passwords, private keys, and Enable secrets out of prompts; use saved credential names.
• Prefer show and config fetch for reads, and rollback-aware transaction commands for changes.
• Require explicit approval for ambiguous or destructive changes and restore operations using --replace.
• Review target groups, labels, max_parallel, fail_fast, and rollback behavior before execution.
• Do not enable session retries for non-idempotent configuration changes; retries have at-least-once semantics.
• Keep rauto web on 127.0.0.1 unless network exposure is explicitly required.
• Treat AI-generated output as a plan until current-runtime validation and dry-run both pass.

#Where to go next

• Device Credentials
• Command Selection and CLI
• Transactions and Orchestration
• Runtime Data and Configuration