菜单
Inspect the local tailnet via the Tailscale CLI. Use when the user asks about tailscale, tailnet peers, exit nodes, MagicDNS, who's online over Tailscale, or wants to ping/whois a Tailscale host. Read-only — no mutations to tailnet state.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Run two heterogeneous fresh-context Herdr reviewers against both code quality and a governing plan, then synthesize evidence-backed feedback. Use when the user asks for a dual or adversarial review, code-versus-plan verification, or independent Claude and Pi reviewers before deciding whether a PR needs changes.
Control herdr from Codex. Use when the user says "use Herder" or asks to inspect, focus, prompt, spawn, or manage herdr workspaces, tabs, panes, or agents from a Codex session, without deciding whether they are inside or outside herdr.
Use when the user explicitly asks Codex Desktop or another shell outside Herdr to create, inspect, prompt, follow up with, or monitor Herdr agent tabs, or when the `codex-herdr` router skill hands off external control.
Fan out a user-provided task list into one reviewed PR per task through Herdr, then shepherd the PR fleet through CI and review without merging. Use when the user asks to fan out PRs, parallelize backlog items into separate PRs, or autonomously drive multiple agent-owned PRs to green.
Inspect and import content into my self-hosted AutoCaliWeb library. Use for catalog status, search, recent imports, shelves, metadata, or importing an ebook, comic, PDF, or audiobook.
Correct-by-construction TypeScript standards. Use for TypeScript engineering or when another skill needs the user's coding standards.
| name | tailscale |
| description | Inspect the local tailnet via the Tailscale CLI. Use when the user asks about tailscale, tailnet peers, exit nodes, MagicDNS, who's online over Tailscale, or wants to ping/whois a Tailscale host. Read-only — no mutations to tailnet state. |
| allowed-tools | Bash |
Wraps the local Tailscale daemon on framework13. All operations are read-only: list peers, see which exit nodes are advertised, inspect MagicDNS, look up an IP, ping a host. No tailnet state changes.
No secrets, no env vars. The installed tailscale CLI is a garage wrapper that
uses the system Tailscale binary (/run/current-system/sw/bin/tailscale) and
whichever tailnet the local daemon is logged in to. tailscale status --json
from the system binary returns the full peer list, so we do not need to call the
remote Tailscale API for reads.
Use the installed tailscale CLI for common operations. It always emits a
single JSON envelope with ok, command, result or error, and
next_actions. scripts/tailscale.sh remains as a compatibility shim for
older workflows.
tailscale status --limit 25 # compact peer summary (hostname/ip/online/exit)
tailscale peers --limit 50 # peers with hostname, IP, OS, online
tailscale exit-nodes --limit 25 # peers advertising as exit nodes
tailscale current-exit-node # which exit node we're routing through
tailscale dns # MagicDNS + DNS config
tailscale ip # this machine's v4 and v6
tailscale whois 100.x.y.z # identify a tailnet IP
tailscale ping host # system tailscale ping --c 3
For raw Tailscale commands not covered by the garage wrapper, call
/run/current-system/sw/bin/tailscale explicitly. See
references/quick-reference.md and references/api-endpoints.md for the status
JSON shape.
tailscaled.Out of scope. up, down, logout, set --exit-node, funnel, serve,
file cp and similar are not exposed here because they either require
interactive auth or change tailnet state. If the user wants one, surface the raw
/run/current-system/sw/bin/tailscale ... command and let them run it manually.
references/api-endpoints.md — schema of tailscale status --jsonreferences/quick-reference.md — copy-paste recipesreferences/troubleshooting.md — daemon down, peer offline, exit node not
advertising, MagicDNS issues