offensive-lorawan-sub-ghz

LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz protocol replay (KeeLoq garage doors, fixed-code remotes, TPMS spoofing, smart plug telemetry), HackRF / RTL-SDR / Flipper Zero workflows, signal analysis with Inspectrum / Universal Radio Hacker, and reconstruction of proprietary packet formats. Use for LoRaWAN deployments (smart cities, asset tracking, industrial telemetry), or any wireless device using the unlicensed 433/868/915 MHz bands (garage openers, doorbells, IoT sensors, RC equipment).

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable offensive-wireless methodology with strong concrete command coverage and clear sequencing. Its main weakness is the absence of explicit validation/verification checkpoints for destructive operations, which caps workflow clarity.

Suggestions

Add explicit validation/verification steps to the workflow (e.g., 'Verify the injected downlink was accepted by checking the device's next uplink' or 'Confirm a replayed frame is processed as fresh via server-side logs') before destructive actions like downlink injection or TPMS spoofing.

Replace placeholder code such as 'python -c "import rflib; …"' and the comment-only HackRF modulator with complete, executable examples or explicitly mark them as left-to-the-operator.

Trim background prose like 'LoRaWAN provides long-range low-bitrate communication for IoT…' and de-duplicate the Engagement Cheatsheet against the Quick Workflow to tighten token efficiency.

Convert the Key References URLs into markdown links for clearer navigation signaling.

Dimension	Reasoning	Score
Conciseness	Mostly lean and code-driven with sectioned structure, but includes minor background prose that could be trimmed (e.g., 'LoRaWAN provides long-range low-bitrate communication for IoT — common in smart cities…') and a Cheatsheet that partially restates the Quick Workflow.	4 / 5
Actionability	Provides many concrete executable commands (hackrf_transfer, rtl_433, git clone, python lora_inject.py, urh), but a few placeholders are not copy-paste ready — 'python -c "import rflib; …"' and the comment-only 'Synthesize crafted alerts (custom modulator with HackRF)'.	4 / 5
Workflow Clarity	A clear sequenced Quick Workflow and numbered Engagement Cheatsheet exist, but destructive/batch operations (downlink injection, TPMS spoofing, replay) lack explicit validation/verification checkpoints, which caps this dimension at 3 per the rubric guidance.	3 / 5
Progressive Disclosure	Well-organized single-file methodology with clear section headers and a one-level-deep Key References list; minor gaps include references given as plain-text URLs rather than navigable links and inlined per-protocol detail that is otherwise appropriately placed.	4 / 5
	Total	15 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-triggered description that explicitly states both the concrete attack capabilities and the deployment contexts in which to use it. It is comprehensive, uses natural vocabulary with synonyms, and carves out a distinct niche with low conflict risk.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete attack actions — 'ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection', 'KeeLoq garage doors, fixed-code remotes, TPMS spoofing', 'reconstruction of proprietary packet formats' — with comprehensive coverage across LoRaWAN and sub-GHz.	5 / 5
Completeness	Explicitly answers both: what ('LoRaWAN and sub-GHz … attack methodology — [attacks]') and when ('Use for LoRaWAN deployments (smart cities, asset tracking, industrial telemetry), or any wireless device using the unlicensed 433/868/915 MHz bands (garage openers, doorbells, IoT sensors, RC equipment)').	5 / 5
Trigger Term Quality	Comprehensive natural terms with synonyms users would say — 'LoRaWAN', 'sub-GHz', '433/868/915 MHz', 'garage doors/openers', 'doorbells', 'IoT sensors', 'TPMS', 'RC equipment' — covering both the protocol and device vocabulary.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear specialized niche (LoRaWAN + sub-GHz ISM-band offensive wireless) with distinct triggers like specific frequency bands and device classes, giving minimal overlap risk with other skills.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: SnailSploit/Claude-Red
Path: Skills/wireless/offensive-lorawan-sub-ghz/SKILL.md
Commit: 24d7968

Reviewed: ~6 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.