Skip to content
Get packs

Guide · Agent skill

How to use the LoRaWAN & Sub-GHz Attacks agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The offensive-lorawan-sub-ghz skill is a methodology file that gives an AI agent a structured offensive-security playbook for LoRaWAN and sub-GHz (433, 868 and 915 MHz) radio devices. It is written for authorized penetration testers and security researchers, so it describes how to assess these systems, not how to protect them. After this guide you will know what the skill does, how to install it, how to ask for its help with plain requests, and what safety limits apply.

LoRaWAN & Sub-GHz AttacksSnailSploit/Claude-Red · MIT

Quick start

  1. 1Download the ZIP. Download the skill ZIP from this page. Keep the offensive-lorawan-sub-ghz folder with its SKILL.md file intact.
  2. 2Install it. Unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder, or upload the ZIP in Settings, then Capabilities, then Skills.
  3. 3Confirm your authorization. Make sure you have written permission to test the specific devices or LoRaWAN network you plan to assess.
  4. 4Ask with a clear request. Describe the band, device type, goal and your authorized scope in plain language so the agent loads the skill.
  5. 5Capture and analyse. Use the hardware and tools the agent recommends, such as rtl_433 for passive monitoring, then analyse modulation and packet format.
  6. 6Document findings. Record frequency, modulation, packet format, crypto state and replay viability for each device, as the reporting section describes.

What is an agent skill and what does this one do?

An agent skill is a folder containing a SKILL.md file with instructions. When a skill is installed, an AI agent that supports skills can load those instructions when a request matches the skill's description, and follow its workflow.

This skill covers LoRaWAN key and session weaknesses such as ABP and OTAA join attacks, key reuse, frame counter replay and downlink injection on TTN or Helium-style networks. For sub-GHz devices it covers capture and replay of fixed-code remotes, KeeLoq garage door remotes, TPMS spoofing and smart plug telemetry. It also covers reconstruction of unknown proprietary packet formats.

  • Hardware and tools named in the file: HackRF One, RTL-SDR, Flipper Zero, LimeSDR or BladeRF, YARD Stick One, and LoRa gateways from RAK or Heltec.
  • Signal analysis tools: rtl_433, gqrx, Inspectrum and Universal Radio Hacker (URH).
  • Research repositories it points to, such as LoRaMac-node, loraserver-attack-tools and RollingPwn.

How do you install the skill?

Download the ZIP file for the skill from this page. Unzip it so that the offensive-lorawan-sub-ghz folder, containing SKILL.md, sits in your personal skills folder at ~/.claude/skills/. To make it available only inside one project, place the folder in that project's .claude/skills/ directory instead.

You can also upload the skill through the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the ZIP there.

  • Personal install: ~/.claude/skills/offensive-lorawan-sub-ghz/
  • Project install: .claude/skills/offensive-lorawan-sub-ghz/ inside your project
  • Claude apps: Settings, then Capabilities, then Skills, then upload

How do you trigger the skill with natural requests?

You do not need a special command. Describe the task in plain language that matches the skill's scope, and the agent will load it when relevant. Name the band, the device type and the goal. State that you have authorization, because the skill is built for authorized engagements.

Good requests name a specific target you are permitted to test, such as a lab garage opener you own or a LoRaWAN deployment under contract. Vague requests about hacking devices in general are less likely to match what the skill is for.

  • Ask for a plan: 'I am under contract to test the LoRaWAN sensors at our depot. Walk me through identifying the join method and key storage.'
  • Ask for triage: 'I have a 433.92 MHz remote I own in my lab. Help me identify the modulation and document whether it uses fixed codes.'
  • Ask for reporting: 'Write up the frequency, modulation and crypto state for these captured devices using the reporting checklist.'
rtl_433 -f 433.92M -A

What does a typical engagement look like?

The skill's quick workflow has four stages: identify the band and modulation, capture transmissions with suitable hardware, analyse the capture for LoRaWAN key handling or sub-GHz packet structure, and then document the findings. Passive monitoring with rtl_433 is the first step it suggests for many devices, since it auto-decodes many known protocols.

For a proprietary sub-GHz device, the file recommends capturing with HackRF or RTL-SDR, visualising the signal in Inspectrum or URH, and then deciding whether a capture can be replayed or whether frames must be crafted. For LoRaWAN, it recommends capturing joins and uplinks, and checking how keys are stored in device firmware, with a cross-reference to a separate offensive-iot skill for key extraction.

  • Identify band and modulation (LoRa chirp spread spectrum or simple OOK/FSK)
  • Capture with the appropriate hardware
  • Analyse keys (LoRaWAN) or packet format (sub-GHz)
  • Document frequency, modulation, packet format and replay viability

What do you need before you start?

The skill itself is a text file and does not run scripts. You need the hardware and software that your task calls for. SDR hardware is optional depending on the task, and a Flipper Zero alone can cover some sub-GHz work. Git and Python are needed for the cloned research tools the file references.

The skill assumes existing RF and security knowledge and uses terse commands. It is not a beginner's introduction to wireless. Its network use is for cloning and reaching the tools and references it names.

  • SDR or radio hardware such as HackRF One, RTL-SDR or Flipper Zero, depending on the task
  • Inspectrum, Universal Radio Hacker, rtl_433 and gqrx
  • Git and Python for cloned research tools
  • Written authorization for every device you test

What safety limits should you know?

The skill tells the agent how to break these systems. Replaying or spoofing garage doors, cars, TPMS sensors or IoT devices you do not own or have written permission to test can be illegal and can be dangerous. Only use it against devices and networks you are contracted or permitted to assess, and keep test transmissions within the rules that apply where you are.

The skill is also not a defensive guide. If your goal is hardening devices, it will not focus on mitigation, so use a defensive resource for that work. The skill uses network access, so review what it fetches and keep your lab or test environment isolated.

  • Test only devices you own or have written permission to test
  • Do not use it on garage doors, vehicles, TPMS or IoT devices you do not control
  • Expect exploitation focus, not mitigation advice
  • Review network activity, since the skill uses the network

What people use it for

  • Scoping a LoRaWAN assessment by checking whether devices use ABP or OTAA and how keys are stored.
  • Reviewing a lab garage opener you own to see whether it uses fixed codes or rolling codes.
  • Reverse engineering an unknown proprietary sub-GHz packet format with Universal Radio Hacker.
  • Writing a structured report on the radio findings from a contracted smart-city or industrial telemetry test.

Frequently asked questions

How do I install the offensive-lorawan-sub-ghz skill?

Download the ZIP from this page and unzip it so the offensive-lorawan-sub-ghz folder sits in ~/.claude/skills/ for personal use, or in a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.

What hardware do I need to use this skill?

It depends on the task. The skill lists RTL-SDR for cheap reception, HackRF One for full transmit and receive, and Flipper Zero for quick sub-GHz work, with LimeSDR, BladeRF, YARD Stick One and LoRa gateways as other options. Some tasks need only one of these.

Is this skill free to use?

The skill is published under the MIT licence, as stated on this page. Check the licence file in the repository for the full terms. Any SDR hardware and paid tools you choose to buy are separate costs.

Is this a good alternative to other wireless security tools?

This skill is a methodology for an AI agent focused on offensive testing of LoRaWAN and sub-GHz devices. If you want a general wireless learning path, or a defensive hardening guide, it is not designed for that and you should choose a resource built for those goals.

Why does the agent say it cannot help with my garage door?

The skill is intended for authorized testing. Requests to attack a device you do not own or lack written permission to test are outside its scope and can be illegal. Ask about a device you own in a lab or one covered by a written engagement.

Does the skill run scripts on my computer?

No. The skill is a SKILL.md text file and does not run scripts. It does use the network, and the tools and repositories it names must be installed and cloned separately, which requires Git and Python.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits authorized wireless penetration testers, security researchers working on fixed-code or rolling-code remotes in their own lab, and red teams testing smart-city or industrial telemetry they are permitted to assess. It assumes solid RF and security knowledge and gives terse commands, so beginners and anyone wanting defensive hardening advice should choose a different resource.

Download the skill