Guide · Agent skill
How to use the Software-Defined Perimeter Deployment agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the deploying-software-defined-perimeter agent skill: what it makes an AI agent do, how to install it, how to ask for its help, and what to check before running its scripts. It is written for readers who have not used agent skills before. By the end you will be able to install the skill, request an SDP deployment plan or validation step, and understand the safety limits of its two Python scripts.
Software-Defined Perimeter Deploymentmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page and unzip it. Confirm the folder is named deploying-software-defined-perimeter and contains SKILL.md.
- 2Choose an install location. Place the folder in ~/.claude/skills/ for personal use, or in a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
- 3Install the script dependency. If you plan to run the scripts, make sure Python 3.8 or later is available and run pip install requests.
- 4Describe your task. Ask in plain language, for example for an SDP deployment plan for a lab, and state your environment and goal.
- 5Review the output. Check the plan or checklist against your architecture and your organisation's policies before acting on it.
- 6Run checks only when authorized. Run the port-probe or mTLS-check scripts only against hosts you are authorized to test, in a lab or agreed window.
- 7Record evidence. Save the validation results against the checklist items for your compliance or review file.
What the skill makes the agent do
An agent skill is a folder of instructions, reference files, templates and optional scripts that an AI agent loads when your request matches the skill's description. This one covers deploying a Software-Defined Perimeter (SDP), a zero-trust design in which services stay hidden until a user is authenticated and authorized. It follows the Cloud Security Alliance (CSA) SDP v2.0 specification and refers to NIST SP 800-207 for validation.
With the skill loaded, the agent works from a structured playbook: deploying the SDP controller, configuring authentication, defining access policies, deploying gateways (Accepting Hosts) and clients (Initiating Hosts), and then validating the result. The validation steps include checking that the gateway looks closed to a port scan, that connections without a valid Single Packet Authorization (SPA) packet fail silently, and that a revoked client certificate is denied.
- SPA: the gateway drops packets by default and opens a port only after a valid signed packet arrives.
- Mutual TLS (mTLS): client and server each verify the other's X.509 certificate.
- A deployment plan template with tables for applications, controller settings, gateways and access policy.
- Two Python scripts that can probe a host's ports and check TLS mutual authentication.
Install the skill
Download the ZIP for this skill from this page and unzip it. The folder must be named deploying-software-defined-perimeter and contain SKILL.md at its top level. You can then install it in one of two ways.
For a personal install across all your projects, unzip the folder into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
- Personal: ~/.claude/skills/deploying-software-defined-perimeter/
- Project: .claude/skills/deploying-software-defined-perimeter/ inside your project folder
- Claude apps: Settings → Capabilities → Skills → upload
~/.claude/skills/deploying-software-defined-perimeter/SKILL.mdTrigger the skill with natural requests
You do not need a special command. The skill's description tells the agent when to use it, so ask in plain language about the task. Requests that match the skill's stated use cases work best: building or hardening zero-trust network architecture, setting up SPA so services are invisible to unauthenticated scanning, or preparing for a zero-trust network access compliance review.
Name the environment and the goal. A request that says what you are building and whether it is a lab or production system gives the agent what it needs to choose the right parts of the playbook.
- Draft an SDP deployment plan for three internal apps in a lab, using the plan template.
- Walk me through configuring single packet authorization and mTLS for an SDP gateway.
- Create a validation checklist for proving our SDP gateway is invisible to port scans.
- Check whether a revoked client certificate would be refused in our test SDP setup.
Use the audit scripts safely
The skill includes scripts/agent.py and scripts/process.py. Its metadata states that the skill runs scripts and uses the network. The port-probe and mTLS-check scripts send traffic to hosts, so only run them against systems you own or are explicitly authorized to test, and only in a lab or agreed test window. Scanning production hosts without written permission can be illegal or disruptive.
The scripts need Python 3.8 or later and the requests library, installed with pip install requests. Live mTLS checks also need access to SDP components or PKI certificates. Without those, the agent can still help you plan and document the work.
- Confirm written authorization and a defined scope before any scan.
- Start with a non-production gateway.
- Review the script source before running it, since it is part of the skill folder you installed.
- Keep the output as audit evidence, but do not treat it as a full security assessment.
pip install requestsTips for better results
Give the agent your actual inputs. The plan template asks for an SDP solution, identity provider, PKI backend, certificate lifetime and audit destination. The more of these you supply, the less generic the output will be.
Ask for one phase at a time. The workflow is split into controller deployment, gateway deployment, client deployment and operational validation. Asking for one phase keeps the answer specific and easier to review.
- Name your SDP product if you have one; the template lists options such as Appgate SDP, Zscaler, open-source or other.
- Ask the agent to map results to the validation checklist so gaps are visible.
- Check any vendor-specific API calls against your vendor's own documentation before use.
What people use it for
- Drafting an SDP deployment plan for internal applications using the included plan template.
- Planning gateway default-drop firewall rules and SPA listener configuration for a lab.
- Building a validation checklist that tests gateway invisibility, rejected SPA attempts and revoked certificates.
- Preparing zero-trust network access evidence for a compliance review, mapped to the NIST and CSA references in the skill.
- Teaching how SDP, single packet authorization and mutual TLS fit together.
Frequently asked questions
How do I install the deploying-software-defined-perimeter skill?
Download the ZIP from this page and unzip it so the folder is named deploying-software-defined-perimeter with SKILL.md at its top level. Put it in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder, or upload it in the Claude apps under Settings → Capabilities → Skills.
What do I need to run the skill's scripts?
The skill lists Python 3.8 or later and the requests library, installed with pip install requests. Live mutual TLS checks also need access to SDP components or PKI certificates. Port checks require a test or lab environment and authorization.
Is the skill free to use?
The skill is licensed under Apache-2.0, as listed on this page. Check the licence file in the skill folder for the full terms.
Is this an SDP product I can install?
No. The skill provides guidance, a deployment plan template and basic audit scripts. It does not include a working SDP controller or gateway, so you need your own SDP solution or components.
Are the port scanning scripts safe to run on a production network?
Only with written authorization for the specific systems and scope. The scripts scan ports and connect to hosts, which can be illegal or disruptive if used without permission, so start in a lab.
How does this compare with a normal SDP vendor deployment guide?
A vendor guide covers its own product in detail. This skill is a generic, vendor-neutral playbook based on the CSA SDP specification, with a checklist and simple audit scripts. Its workflow text is general, so use it alongside vendor documentation.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security engineer, student or team planning or hardening a zero-trust network access design in a lab or authorized test environment, or preparing evidence for a compliance review. Pick a vendor's own deployment guide or a full assessment service if you need a turnkey SDP product or a complete security assessment.
Download the skill