offensive-iot

IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, command-dense methodology that assumes expertise and rarely wastes tokens. Its weaknesses are structural: destructive operations lack validation feedback loops, and the long monolithic body would benefit from splitting into reference files.

Suggestions

Add explicit validation/feedback checkpoints to destructive workflows — e.g. verify a flash dump matches the chip size before desoldering, and confirm an MTD backup is intact before `mtd_debug erase`/`write`.

Split the larger domains (Wireless Protocols, ICS/OT Protocols, Companion/Cloud API) into one-level-deep reference files under ./references/ and link to them from SKILL.md so the top-level body stays a concise overview.

Tighten the few prose commentary lines (e.g. the GoAhead/Boa/mini_httpd sentence) into terse pattern bullets to push conciseness toward the top anchor.

Dimension	Reasoning	Score
Conciseness	The body is dense and largely assumes Claude's competence — commands, tool tables, and attack patterns dominate with little basic-concept padding — but a few commentary lines ('abandoned codebases, command injection on every other CGI parameter') could be trimmed.	4 / 5
Actionability	Nearly every section gives copy-paste-ready, executable commands — `flashrom -p ch341a_spi -r firmware.bin`, `binwalk -Me firmware.bin`, bettercap/Modbus Python snippets — covering the common cases concretely.	5 / 5
Workflow Clarity	A clear Quick Workflow sequence and an Engagement Checklist provide ordering, and one verify step exists (`file firmware.bin && binwalk firmware.bin`), but destructive operations (chip-off, MTD erase/write, re-flash) lack explicit validation/feedback checkpoints, capping the score per the destructive-operations rule.	3 / 5
Progressive Disclosure	Section headers and tables give good in-page structure, but at ~430 lines the body is monolithic with no bundle files and no one-level-deep references; substantial domains (wireless, ICS/OT, cloud) that could live in separate reference files are inlined.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An unusually dense, specific description that clearly states both capability and trigger conditions in third person. Minor room for more natural-language trigger synonyms keeps trigger_term_quality just shy of perfect.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions across the full IoT kill chain — 'hardware reconnaissance (UART, JTAG, SWD...)', 'firmware acquisition', 'bootloader attacks', 'wireless protocol attacks', 'MQTT/CoAP/Modbus... exploitation' — with comprehensive coverage and no significant gaps.	5 / 5
Completeness	Explicitly answers both 'what' (a testing methodology enumerating every phase) and 'when' ('Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.'), matching the top anchor.	5 / 5
Trigger Term Quality	The 'Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research' clause supplies strong natural trigger phrases and synonyms, though a few common variations (e.g. 'firmware analysis', 'hardware hacking') are absent.	4 / 5
Distinctiveness Conflict Risk	The IoT/embedded offensive-testing niche is highly specific with distinct triggers, posing minimal overlap risk against other skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: SnailSploit/Claude-Red
Path: Skills/iot/offensive-iot/SKILL.md
Commit: 24d7968

Reviewed: ~6 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.