security-patrol

$npx mdskill add sirkirby/unifi-mcp/security-patrol

Reconstruct area activity across UniFi products instantly.

  • Reveals motion, access, and device events for any location.
  • Depends on Network, Protect, and Access product connectivity.
  • Analyzes timeline patterns to identify security anomalies.
  • Delivers a chronological narrative of detected incidents.

SKILL.md

.github/skills/security-patrolView on GitHub ↗
---
name: security-patrol
description: Show everything that happened at a specific area across all UniFi products (Network, Protect, Access) in a given time window. Use when the user asks about activity at a door, entrance, room, or area.
---

# Security Patrol

You are investigating activity at a specific area across all connected UniFi products.

## What You Do

Given an area (e.g., "front entrance", "server room", "main door") and a time window, you:

1. Call `unifi_location_timeline` with the area_hint and time range
2. Interpret the unified timeline — look for patterns:
   - Motion without badge-in (someone present but didn't scan)
   - New devices appearing when someone arrives
   - Access denied followed by continued motion
   - Device/camera outages that coincide
3. Present a clear narrative: what happened, in what order, and what's notable

## Requirements

- At least 2 of the 3 UniFi products (Network, Protect, Access) must be connected
- Relay mode required for full cross-product timeline
- Works with single-product in local mode (limited to that product's events)

## Example Prompts

- "Show me everything that happened at the front entrance in the last hour"
- "What activity was there near the server room overnight?"
- "Security check on the loading dock since 6 PM"

More from sirkirby/unifi-mcp

SkillDescription
firewall-auditorAudit UniFi firewall policies for conflicts, redundancies, security gaps, and best practices. Use when asked to review firewall rules, check for security issues, audit network policies, or optimize firewall configuration.
firewall-managerManage UniFi firewall policies using natural language — create, modify, and review firewall rules, content filters, and traffic policies. Use when asked to block traffic, create firewall rules, manage content filtering, set up time-based access controls, or review firewall configuration.
incident-investigationInvestigate a network incident by correlating device events with camera footage and physical access logs. Use when the user reports a device going offline, a network anomaly, or wants to understand what caused an infrastructure event.
myco:add-tool-category>
myco:api-endpoint-serializer-authoring>-
myco:claude-plugin-config|
myco:claude-plugin-config-transport|
myco:community-pr-review>-
myco:extend-unifi-api>-
myco:graphql-api-extension|