Runs home and multi-site UniFi end to end: Protect, Network, Access, Fabrics and Site Manager, with optional single-home Home Assistant. It inspects first, makes reversible changes, and tells you what to finish in the mobile app.
Query this catalog from Claude, Cursor, or Grok via MCP.
Skills16Playbooks it can run
unifi-admin-hardening
Hardens UniFi control-plane access: account MFA, admin inventory, least-privilege roles, local credentials, and API key hygiene. Use when the user asks to lock down UniFi admins, enable MFA, rotate console passwords, or audit who can change the network. Do NOT use for family Camera View / Identity Users alone (unifi-fabric-iam) or Protect Arm/Disarm.
unifi-api-onboard
First-time UniFi Umpire / Site Manager API key setup and first authenticated hosts call. Use on first install or when the user asks to set up the Official UniFi API. Do NOT use for day-to-day ops (use unifi-api-workflow) or Protect Arm/Disarm.
unifi-api-workflow
Day-to-day UniFi ops via Official Site Manager API (api.ui.com), connector/local Integration APIs, or browser fallback. Use when listing hosts/sites/devices or changing UniFi via API. Do NOT use for first-time key setup alone (use unifi-api-onboard) or Arm/Disarm without a clear ask.
unifi-apple-lan
Fixes Apple TV remotes, AirPlay, AirPrint, HomeKit, or iMazing across Trusted/IoT/Kids VLANs (multicast, mDNS, Private Wi-Fi Address, narrow firewall). Use when remotes/AirPlay break after VLANs. Do NOT use to move TVs onto Trusted or for Kids DNS/VPN alone (use unifi-kids-vlan).
unifi-backup-upgrade
Safe UniFi backup-then-firmware upgrade path (console, network, Protect). Use when the user asks to upgrade UniFi firmware, take a backup, or plan a maintenance window. Do NOT use for Arm/Disarm, WAN changes, or health-only audits (use unifi-health-audit).
unifi-fabric-iam
Audits or cleans UniFi Site Manager People/Roles on a fabric: fewer Full Admins, more Identity Users, Camera/Network View and Family patterns. Use when too many admins or family needs camera view only. Do NOT strip Owner or owner-kept site Full Admins; do not open Access/Identity product work unless asked.
unifi-fabrics-change
Changes multi-site UniFi Network settings Fabrics-first (Canvas/Blueprint), site-local only when a house differs. Use when editing VLANs, Wi-Fi, firewall, DNS, NAT, or DHCP across a fabric. Do NOT use for WAN/broad firewall without a clear ask, or Kids SSID/PPSK unless the owner wants that tradeoff.
unifi-guest-wifi
Configures UniFi Guest Wi‑Fi: isolated SSID, client isolation, bandwidth caps, optional portal/expire timers, and Guest VLAN firewall. Use when the user asks to set up guest Wi‑Fi, visitor access, guest portal, or guest bandwidth limits. Do NOT use for Kids/Quarantine hardening (unifi-kids-vlan) or general VLAN design alone (unifi-vlan-baseline).
unifi-health-audit
Read-only UniFi estate health pass: offline gear, firmware drift, DHCP, Protect storage, policy smell. Use when the user asks for a UniFi health check, what's offline, or estate audit. Do NOT use to Arm/Disarm Protect or run firmware upgrades (use unifi-backup-upgrade).
unifi-iot-hardening
Isolates UniFi IoT (cameras, TVs, printers, smart home) while keeping Trusted→IoT casting/discovery working. Use when the user asks to harden IoT, isolate cameras, or fix casting after VLANs. Do NOT use for Kids DNS/VPN (unifi-kids-vlan) or WAN changes.
unifi-kids-vlan
Hardens Kids/Quarantine VLANs: NextDNS (or similar), Private Relay denylist, VPN port blocks, Quarantine SSID + overrides, Kids isolation. Use when locking down kids devices or Quarantine defaults. Do NOT use for general IoT cameras/TVs (use unifi-iot-hardening) or WAN changes without a clear ask.
unifi-protect-alarms
Reviews or changes UniFi Protect Alarm Manager, arm profiles (Disarmed/Home/Away), PTZ presets, zones, and Protect safety rails. Use when tuning Protect alarms or PTZ. Do NOT Arm/Disarm without a clear owner ask; do not invent mobile Spatial click-paths.
unifi-secure-baseline
Day-0 / new-estate secure UniFi checklist: API onboard, VLAN zones, Guest Wi‑Fi, IoT isolation, admin MFA, then health pass. Use when the user asks to harden a new UniFi install, secure the home network from scratch, or run a full safety baseline. Do NOT use for a single-topic tweak (call the specific skill) or Protect Arm/Disarm.
unifi-vlan-baseline
Designs or reviews UniFi Trusted/IoT/Guest/Management/Quarantine VLAN segmentation and inter-VLAN defaults. Use when the user asks to review VLANs, set up Trusted vs IoT, segment the LAN, or Quarantine defaults. Do NOT use for Kids DNS/VPN hardening alone (use unifi-kids-vlan) or Protect arming.
unifi-wifi-rf
Tunes UniFi Wi-Fi SSID design, band steering, 6 GHz, channels, power, and Network Override vs Quarantine. Use when the user asks to fix sticky clients, slow Wi-Fi, SSID design, or Quarantine landing. Do NOT use for VLAN firewall design alone (use unifi-vlan-baseline) or Protect alarms.
getting-started
Use this when a newly imported UniFi Umpire template starts its first conversation with the owner — ask setup questions one at a time, then write memories and enable matching routines.
Routines2Jobs that run on their own
UniFi weekly release check
Every Monday morning, scan Ubiquiti/UniFi releases and recommend whether this estate should update or adjust anything.
UniFi monthly health
On the 1st of each month, run a read-only UniFi estate health pass and recommend fixes only when something is material.
Hands-on helper that actually does the work on your Windows PC and home network: tune-ups, drivers, cleanup, clean uninstalls, network fixes, and mic and voice…
Backs up your bots and their files every few hours, warns you if anything has quietly been reset or lost, and restores everything in one step. It proves your b…
A read-only Tailscale safety auditor. It checks your tailnet's devices, features, and access rules against current Tailscale security bulletins and CVEs, then…
An active security guard for your Linux machines. It runs daily health and threat checks, watches advisories and X for threats to the software you run, applies…
Tells you whether a vulnerability really affects your own computers, sites and code, using real installed versions instead of headlines, and flags missing OS u…
