Menu

Individual skill

hardware-radio-sdr

Authorized RF/SDR security research on non-Wi-Fi radio signals — identify a signal's frequency and modulation receive-only, demodulate and reverse the protocol, and assess replay feasibility in a shielded lab. Load for wireless remotes, key fobs, sensors, telemetry, ISM-band devices, ADS-B, or any sub-GHz/RF protocol outside classic Wi-Fi. Signals: unknown RF device in scope, 315/433/868/915 MHz, OOK/ASK/FSK captures, RTL-SDR/HackRF work.

skills/hardware/hardware-radio-sdr/SKILL.md

Read pinned source

Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Not checked yet
Last checked
Nov 7, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
27
Repository last updated
Oct 14, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# RF / SDR signal analysis (non-Wi-Fi radio)

## When it applies
The scope includes a radio device that isn't Wi-Fi — a wireless remote, key fob, alarm sensor,
telemetry link, or ISM-band gadget — and you need to know whether an attacker can eavesdrop on,
forge, or replay its traffic. **Spectrum use and transmission are heavily regulated**: load
`tradecraft-scope-roe` and make `scope.txt` state the exact devices, frequency bands, and whether
**transmitting is permitted at all — the default is receive-only**. Classic Wi-Fi attacks belong to
the wireless domain (`wireless-wpa2-attacks`, `wireless-evil-twin`); this skill is generic SDR RF.

## Why it works
Cheap SDR hardware (RTL-SDR for receive, HackRF for transmit) turns a wide slice of spectrum into
raw I/Q samples. Most low-cost remotes and sensors use simple, unauthenticated modulation
(OOK/ASK/2-FSK) with fixed or rolling codes, so the entire protocol is recoverable from a capture: