Guide · Agent skill
How to use the Palo Alto Prisma Access Zero Trust agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This skill is a set of instructions and reference material that teaches an AI agent how to help you deploy Palo Alto Networks Prisma Access, a cloud service that gives remote users and branch offices secure access to company applications in place of a traditional VPN. It is written for network and security engineers planning a move to SASE with ZTNA, and for anyone who already runs Palo Alto firewalls and wants to add cloud ZTNA through Strata Cloud Manager. By the end of this guide you will know what the skill covers, how to install it, how to ask for help with natural requests, and what you must have in place before using it.
Palo Alto Prisma Access Zero Trustmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 2Confirm the prerequisites. Check that you have a Prisma Access license, a Strata Cloud Manager tenant, a SAML 2.0 identity provider, and Cortex Data Lake for logs.
- 3Ask for the infrastructure plan. Describe your user count and identity provider, then ask the agent to walk you through mobile user and remote network setup in Strata Cloud Manager.
- 4Build device posture checks. Ask for HIP objects and profiles that match your requirements, such as disk encryption or a running security agent, and review them against your device fleet.
- 5Deploy ZTNA Connectors and applications. Ask for the connector deployment steps and application definitions for your internal apps, replacing every placeholder hostname and ID with your own values.
- 6Write and review security rules. Ask for rules that combine user groups, applications and HIP profiles, then check the default deny rule and logging before applying anything.
- 7Run the audit script carefully. Read scripts/agent.py, test it against a non-production tenant with least-privilege API credentials, and only then use it to list configuration for auditing.
What the skill makes the agent do
Once installed, the agent can walk you through deploying Prisma Access step by step. The skill's workflow covers configuring infrastructure for mobile user and remote network connections in Strata Cloud Manager, deploying ZTNA Connectors for private applications, writing security policies, defining Host Information Profile (HIP) device posture checks, rolling out the GlobalProtect agent to endpoints, and setting up logging and monitoring.
The skill also includes a Python script, scripts/agent.py, that connects to the Prisma Access API with OAuth credentials and lists configuration items for auditing. A reference file, references/api-reference.md, lists the authentication details and the SASE configuration API endpoints the script works with.
- Mobile user and remote network connection setup
- ZTNA Connector deployment for internal applications
- Security policy rules tied to user groups and device posture
- HIP objects and profiles, such as requiring disk encryption or a security agent
- GlobalProtect rollout and connection checks
- Logging to Cortex Data Lake and SIEM forwarding
Install the skill (ZIP download or Claude app upload)
Download the skill ZIP from this page. There are two ways to install it. For Claude Code, unzip the archive into your user skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only inside that project. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
After installing, the skill folder should contain SKILL.md, scripts/agent.py and references/api-reference.md. If the agent does not seem to know about the skill, check that these files sit directly inside the skill folder rather than inside an extra nested folder.
- User-wide install: ~/.claude/skills/
- Project-only install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Check what you need before you start
The skill assumes a working enterprise environment. You need a Prisma Access license (the skill names Business Premium or equivalent), a Strata Cloud Manager tenant, a GlobalProtect agent for endpoints, and a ZTNA Connector VM sized at 4 vCPU, 8GB RAM and 128GB disk. The source lists VMware, AWS, Azure or GCP as deployment targets for the connector. You also need an identity provider that supports SAML 2.0 (Okta, Entra ID or Ping Identity) and Palo Alto Cortex Data Lake for log storage.
For the scripts and the CloudFormation example, you need Python with the requests library, the AWS CLI, and Prisma Access API credentials: a client ID, a client secret and your tenant service group (TSG) ID.
- Prisma Access license and Strata Cloud Manager tenant
- GlobalProtect agent and ZTNA Connector VM (4 vCPU, 8GB RAM, 128GB disk)
- SAML 2.0 identity provider: Okta, Entra ID or Ping Identity
- Cortex Data Lake for logs
- Python with requests, AWS CLI for the CloudFormation example
- Prisma Access API client ID, client secret and TSG ID
Trigger the skill with natural requests
You do not need special syntax. Describe the outcome you want in plain language and mention the platform, so the agent recognises the task. The skill's own description lists the situations it is meant for: implementing SASE with integrated ZTNA, SWG, CASB and FWaaS, replacing VPN and branch firewalls with cloud-delivered security, or integrating ZTNA with an existing Palo Alto NGFW estate.
Name the step you need help with, and say whether you are planning or auditing. Good requests give the agent something concrete to work from.
- Help me plan a move from our VPN to Prisma Access for 1,500 mobile users.
- Write a HIP profile that requires BitLocker and a running CrowdStrike sensor.
- Walk me through deploying a second ZTNA Connector for our Git server.
- Write a security rule that lets the Finance group reach the ERP app only from compliant devices.
- Help me set up the audit script to list our security rules and HIP profiles.
See the example configurations
The skill includes worked examples for each step. They show how an application definition points to an internal host through a ZTNA Connector, how a security rule combines a user group, an application and a HIP profile, and how device posture checks are built from HIP objects. Use them as a template and replace every placeholder before using them.
The examples use placeholder hostnames, IP ranges and IDs such as wiki.internal.corp, portal.company.com and TSG_ID. They are not ready to deploy. The CloudFormation example also points at a template URL and a VPC and subnet ID that you must replace with your own values.
- Infrastructure: portal and gateway settings, DNS servers, IP pools
- Applications: FQDN, ports, connector assignment, health check
- Security rules: user group, HIP profile, action, logging, threat and DLP profiles
- HIP objects: CrowdStrike Falcon sensor, BitLocker, FileVault, OS patch level
aws cloudformation create-stack --stack-name prisma-ztna-connector --template-url https://prisma-access-connector-templates.s3.amazonaws.com/ztna-connector-aws.yamlSafety notes before running the scripts
The skill runs scripts and uses the network. The audit script authenticates with a client ID and client secret against the Prisma Access token URL and then sends requests to a vendor cloud API. Read scripts/agent.py before running it, and do not run it against a production tenant without review. Use credentials with the least access that does the job, and keep the client secret out of shared files and chat logs.
The API reference lists POST and PUT endpoints for creating and updating security rules as well as GET endpoints for listing configuration. Do not assume a script is read-only. Confirm what it sends, and test against a non-production tenant first.
- Review scripts/agent.py before running it
- Test in a non-production tenant first
- Store the client secret securely and never paste it into prompts
- Treat CloudFormation and connector deployments as changes to your cloud account
Tips for getting useful results
Give the agent your real context: user count, which identity provider you use, which apps are private, and which device posture tools are already deployed. Ask for one step at a time and check each result in Strata Cloud Manager before moving on. The skill's connection checks, such as the GlobalProtect status and the ZTNA Connector status showing Connected, are good points to verify each stage.
The skill's workflow also includes alerting ideas, such as emailing IT when the HIP failure rate passes 10% or sending a SOC alert on a threat detected on a mobile user. Treat these as starting points to adapt, not as settings the product applies for you.
- Name your identity provider and user groups up front
- Ask for one configuration step at a time
- Verify connector and GlobalProtect status before continuing
- Use the API reference when you need exact endpoint paths
What people use it for
- Planning a phased move from a legacy VPN to Prisma Access for remote staff and branch offices
- Writing HIP profiles that require disk encryption, a running endpoint security agent or a minimum OS patch level
- Drafting security rules that limit access to a finance or source code application to compliant devices in specific user groups
- Setting up a second ZTNA Connector for high availability on an internal application
- Listing existing security rules and HIP profiles with the audit script to review configuration drift
Frequently asked questions
How do I install the Palo Alto Prisma Access skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for all your projects, or into a project's .claude/skills/ folder for one project. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills instead.
What do I need to use the Prisma Access zero trust skill?
You need a Prisma Access license, a Strata Cloud Manager tenant, a GlobalProtect agent, a ZTNA Connector VM with 4 vCPU, 8GB RAM and 128GB disk, a SAML 2.0 identity provider and Cortex Data Lake. The scripts also need Python with the requests library and Prisma Access API credentials.
Is the Prisma Access skill free?
The skill itself is released under the Apache-2.0 licence. The skill does not include Prisma Access, which is a commercial Palo Alto Networks service that requires its own licence, so check your vendor terms for licence costs.
Is Prisma Access good for small businesses?
The skill says that for organisations under 200 users, simpler ZTNA solutions are usually enough. It also says not to use it when budget rules out enterprise SASE licensing. Small teams should compare simpler ZTNA products first.
Why does the audit script fail or not connect?
The script uses OAuth client credentials against the Prisma Access token URL with a tsg_id scope. Check that your client ID, client secret and TSG ID are correct and belong to the same tenant, and that the credentials have access to the configuration you are listing.
Can the skill deploy Prisma Access automatically?
No. The skill guides an agent through configuration steps and provides examples and an API script. The examples use placeholder values, and you still need to configure your tenant, review every change and run anything that touches production yourself.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits network and security engineers planning a move from VPN to Prisma Access, teams that already run Palo Alto firewalls and want cloud ZTNA, and architects drafting device posture and access policies. Skip it if you have fewer than about 200 users, cannot justify enterprise SASE licensing, or expect a turnkey deployment, since every example needs your own values and the audit script needs careful review before it touches a live tenant.
Download the skill