MichaelVessia/adguard
modules/programs/agents/shared/skills/adguard/SKILL.md
Inspect and manage my self-hosted AdGuard Home DNS sinkhole. Use when the user asks about AdGuard, DNS blocking, query logs, blocklists/filters, top queried or blocked domains, DNS clients, or wants to toggle protection.
$ install --global
skillsauthnpx skillsauth add MichaelVessia/nixos-config adguardInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 25, 2026, 5:47 AM119.5s6 files scanned
SKILL.md
- name:
- adguard
- description:
- Inspect and manage my self-hosted AdGuard Home DNS sinkhole. Use when the user asks about AdGuard, DNS blocking, query logs, blocklists/filters, top queried or blocked domains, DNS clients, or wants to toggle protection.
- allowed-tools:
- Bash, WebFetch
AdGuard Home
Manage my self-hosted AdGuard Home (DNS sinkhole / ad-blocker) instance. Inspect status, query logs, stats, configured clients, and filter lists. Toggle DNS protection (mutation — confirm first).
Environment
Credentials come from sops-nix (see modules/programs/shell.nix):
ADGUARD_URL— base URL (no trailing slash), e.g.http://192.168.1.109ADGUARD_USERNAME— HTTP basic auth userADGUARD_PASSWORD— HTTP basic auth password
The adguard CLI reports a JSON error envelope when they are missing. All API
calls hit the /control/ base path and pass HTTP basic auth.
CLI
Use the installed adguard CLI for common operations. It always emits a single
JSON envelope with ok, command, result or error, and next_actions.
scripts/adguard.sh remains as a compatibility shim for older workflows.
adguard status # version, running, protection, dns addrs
adguard version # just version string
adguard stats # 24h query/block counts + top domains
adguard stats-info # stats retention interval (days)
adguard query-log --limit 50 # recent querylog entries
adguard query-log-search example.com --limit 200 # search recent querylog
adguard clients # configured and auto-detected clients
adguard clients-active <ip> # lookup one client by IP
adguard filters # blocklists, allowlists, custom rule count
adguard rules # custom user_rules only
adguard dns-config # full DNS server config
adguard dhcp-status # DHCP server status (if enabled)
adguard protection-toggle on --confirm-toggle # MUTATION, confirm first
For anything not covered, call the API directly with $ADGUARD_URL plus
-u "$ADGUARD_USERNAME:$ADGUARD_PASSWORD" — see references/api-endpoints.md
and references/quick-reference.md.
Workflow: investigating a blocked domain
adguard query-log-search example.com— see when/who hit it.adguard filters— see which list flagged it (therulesfield in querylog points to filter ID + line).adguard rules— check custom user rules for overrides.
Workflow: who is querying
adguard stats— top clients by query count.adguard clients-active <ip>— resolve an IP to its configured client profile and per-client overrides.
Mutations: confirm first
Always confirm with the user before:
adguard protection-toggle on|off --confirm-toggle(disables DNS filtering globally — every device on the LAN loses ad/tracker blocking until re-enabled)- Any custom POST/PUT against
/control/*(filter add/remove, DNS config changes, DHCP changes, client edits)
References
references/api-endpoints.md— endpoints used by the CLI, with response shapes verified against the live instance (v0.107.67)references/quick-reference.md— copy-paste curl recipesreferences/troubleshooting.md— 401/403, connection, DNS-side issues
Notes
- API base path is
/control/(not/api/v1/). - HTTP basic auth only. The password is stored bcrypt-hashed in
AdGuardHome.yaml; rotating it means editing that YAML, not a UI setting. - Live instance:
http://192.168.1.109(LXC 106), v0.107.67. - Wiki: https://github.com/AdguardTeam/AdGuardHome/wiki/API
- OpenAPI spec: https://github.com/AdguardTeam/AdGuardHome/blob/master/openapi/openapi.yaml
Related Skills
MichaelVessia/stack
tools
VerifiedTrustedCommunity
User guide for the local squash-safe `stack` CLI for stacked PR/MR repair on GitHub and GitLab. Use when someone asks how to inspect, track, sync, merge, document, or undo stacked pull requests / merge requests in squash-merge repositories. Prefer this tool over GitHub's `gh stack` command for this workflow.
2SKILL.mdUpdated Jun 5, 2026
MichaelVessia/herdr
tools
VerifiedTrustedCommunity
Control herdr from inside it. Manage workspaces and tabs, split panes, spawn agents, read output, and wait for state changes — all via CLI commands that talk to the running herdr instance over a local unix socket. Use when running inside herdr (HERDR_ENV=1).
2SKILL.mdUpdated Jun 4, 2026
MichaelVessia/autocaliweb
development
VerifiedTrustedCommunity
Inspect my self-hosted AutoCaliWeb library. Use when the user asks about AutoCaliWeb, books in Calibre, OPDS status, recent imports, shelves, catalog stats, or wants to search the ebook library.
2SKILL.mdUpdated May 25, 2026
MichaelVessia/add-youtube-channel
data-ai
VerifiedTrustedCommunity
Subscribe a YouTube channel in TubeArchivist, queue its top videos by views from recent uploads, wait for the first file, scan Jellyfin, and rename + lock the channel folder to a friendly display name. Use when the user says "add a youtube channel", "subscribe to <channel>", or wants a curated TubeArchivist + Jellyfin import for a creator.
2SKILL.mdUpdated May 24, 2026