Install a skill and let AI get Tailscale right for you

What a skill is and how it relates to Tailscale

A skill is a working handbook written for an AI agent: one folder, one SKILL.md, which the agent opens and follows whenever it hits a matching situation. Ask it to "change my tailnet policy" with no skill installed and it can only read the documents you paste in; install the matching skill and the agent gets its own SOP, its own tool allowlist and its own safety rules.

• Network automation skills: wrap Tailscale/Headscale REST API calls, hard-code the read-before-you-write flow, and build ACL policy validation into the steps.
• DevOps/SRE skills: SSH policy management, network topology diagrams, certificate management — not Tailscale-specific, but used every day.
• Home-lab skills: they package up the operations knowledge for personal setups such as Home Assistant, Proxmox and NAS boxes, which makes them a close cousin for HA + Tailscale users.

How skills work — how they are scanned, how they reach the system prompt, how the AI decides whether to use one — is covered in full in the official Anthropic Skills docs. This handbook focuses on which ones to pick for Tailscale and how to install them.

How to install (the 3-minute version)

Skills work on agent platforms such as Claude Code, Cursor, Cline, Codex and pi-web. This walkthrough uses Claude Code:

1. Choose where to put it

   Three common places: user scope (~/.claude/skills/), project scope (.claude/skills/) and plugin scope (through claude plugin install). Put network skills in user scope so they work across projects.

2. Clone it or install it

   The simplest way: cd ~/.claude/skills && git clone <repo>. With the plugin system (from Claude Code v2 on), use:

   claude plugin install <marketplace>/<plugin>
   # Example:
   claude plugin install obra/superpowers
   claude plugin install mattpocock/skills

3. Restart the agent or open a new session

   Skills are scanned when a session starts. After installing a new one, always open a new session and ask "which skills do you have loaded right now?" to confirm it appears.

4. Test the trigger with one sentence

   Phrase a request that matches the skill's description. For example, once the tailscale skill is in, say "list every subnet router on my tailnet right now" and see whether it reaches for the skill.

Featured skills (Tailscale and network automation)

Picked from GitHub trending and community recommendations: the skills that fit Tailscale, Home Assistant and home-lab users best. Network automation is a niche where the number of skills is still growing, so this section lists both kinds honestly: the dedicated ones and the general ones that are genuinely useful.

Catalog of popular collections

To install a whole bundle at once, or to browse and pick your own, start from these entry points. All figures are a 2026-08-20 snapshot.

git:github.com/anthropics/skills

claude plugin install obra/superpowers

claude plugin install mattpocock/skills

git clone https://github.com/HugoWisers/aurora-smart-home

# Use as a list; do not install the whole bundle
https://github.com/ComposioHQ/awesome-claude-skills

# Index only; install each source repo from its link
https://github.com/VoltAgent/awesome-agent-skills

Seen but not listed: K-Dense-AI/scientific-agent-skills (research-oriented, nothing to do with networking), mukul975/Anthropic-Cybersecurity-Skills (security-oriented; some red-team skills help with a tailnet audit, but use them carefully), calesthio/OpenMontage (video production; note the AGPL license).

Compatibility notes

The SKILL.md spec has been adopted by Claude Code, Codex, Gemini CLI, Cursor, Cline, Continue, OpenCode and others; a pure-Markdown skill runs almost anywhere. Where it degrades:

• It depends on Claude Code-specific machinery (hooks, the plugin marketplace, dispatching subagents) — the skill text is still readable, but the automatic triggering may be incomplete.
• It depends on the tailscale CLI or an API token — without them it does nothing. Before installing, confirm your agent is allowed to run a shell, or that TAILSCALE_API_KEY is already set in the environment.
• scripts/ needs a runtime the container does not have — watch for this in an HA add-on or a Docker container. Pure-Markdown skills are the most compatible.
• The Tailscale API version — some skills mix the old 2024 acls format with the newer 2024+ grants format; check which one a skill supports before you run it.

Safety rules

• Read it before you install it: open the SKILL.md and read it through first. Pay particular attention to fields such as allowed-tools and metadata.dangerous — anything that will DELETE /api/v2/device or PUT /api/v2/tailnet/{tailnet}/acl needs a close look.
• Anything that touches the policy or keys goes into a test tailnet first: Tailscale lets you run more than one tailnet, so make the first run in a test tailnet and switch to the real one once you are confident.
• Give the API token least privilege: a Tailscale OAuth client can be limited by scope (devices:read, acl, keys and so on) — grant only what the skill needs, never a wide-open admin token.
• Pin a version in production: pin it with a git @tag or @commit so an upstream change does not upgrade you without your noticing.
• Put policy changes through a PR: for a real production tailnet policy, use tailscale acl with a GitHub Actions PR flow — the agent only produces the diff, it never PUTs directly. A skill earns its place by generating the right diff, not by pressing apply.
• Stars mean popularity, not safety: even the popular collections have had cases of quietly exporting environment variables.

SKILL.md spec quick reference · with a homemade tailscale-cli example

The minimum skeleton of a skill:

tailscale-cli/
└── SKILL.md          ← the only required file

# SKILL.md contents
---
name: tailscale-cli
description: Triggers when the user mentions tailnet, tailscale status,
  subnet router, DERP, magic DNS, tailscale serve, tailscale ssh, tailscale ping
  or tailscale netcheck. Uses the local tailscale CLI for queries and settings;
  for changes to the tailnet policy or keys, use the tailscale-api skill instead.
allowed-tools: ["Bash"]
---

# tailscale CLI handbook

## Common commands
- `tailscale status --json` — list current tailnet nodes and connection state
- `tailscale ping <host>` — test the P2P connection (direct vs DERP)
- `tailscale up --advertise-routes=192.168.1.0/24 --reset` — advertise a subnet router
- `tailscale serve https://ha-home / http://localhost:8123` — HTTPS reverse proxy for HA

## Safety rules
- `tailscale up --reset` overwrites the existing flags; run `tailscale up --json` first to save the current settings
- Do not run `tailscale logout` without confirming first (it removes the device from the tailnet)

Put it at ~/.claude/skills/tailscale-cli/SKILL.md and it loads the next time you open a session. This kind of homemade skill is the most useful sort for Tailscale users: write in your own tailnet naming convention, the subnet CIDRs you use most and your DERP preference, and the agent stops having to ask.

Convention: keep SKILL.md short (< 5000 characters), put attachments in references/, scripts/ and assets/, and read them only when they are needed, so the context does not blow up.

FAQ

Take this handbook with you

The whole handbook is a self-contained single HTML file, and it opens offline once downloaded. Collection details go stale, so before an important decision go back to the Resource Hub and read the online version.

Download this handbook (HTML) Back to the Resource Hub