How to use the Offensive Bluetooth LE Testing agent skill

What the skill makes the agent do

Agent skills are folders of instructions that an AI agent loads when a task matches them. This skill's main file, SKILL.md, is a BLE attack methodology and command reference. Once it is loaded, the agent knows how to map a device's GATT services and characteristics, test whether characteristics accept reads or writes without authentication, identify the pairing method, and explain how sniffing or relay tools could be used against weak pairing.

The skill covers discovery and GATT enumeration, characteristic read/write checks, pairing method identification, sniffing the pairing exchange, active MITM during pairing, companion app reverse engineering, and device-class notes for smart locks, cars, medical devices and beacons. It is a methodology, not a standalone product, and it assumes you already have security knowledge and the tools installed.

Install the skill (ZIP download or Claude app upload)

Download the ZIP from the skill's page on this site and unzip it. To make it available for your user account, unzip it into ~/.claude/skills/. To scope it to one project, unzip it into that project's .claude/skills/ folder.

You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills

Set up the tools it expects

The skill assumes a Linux environment and several security tools. Its listed requirements are bluetoothctl and gatttool (BlueZ), bettercap, Sniffle with a TI CC1352 dongle or Ubertooth hardware, crackle, jadx and adb for companion app analysis, and btproxy cloned from GitHub for MITM testing.

The skill does not install these for you. If a tool is missing, the agent can only describe the commands that would use it.

• Linux with bluetoothctl and gatttool (BlueZ)
• bettercap
• Sniffle with a TI CC1352 dongle, or Ubertooth hardware
• crackle
• jadx and adb (companion app analysis)
• btproxy, cloned from GitHub (MITM testing)

Trigger the skill with natural requests

You do not need special syntax. Describe the device and the job in plain language, and mention Bluetooth Low Energy or BLE so the agent matches the skill. Name the device type and say that you own it or have written permission to test it.

Good requests state the goal and the scope, for example asking the agent to enumerate the GATT tree of a device you own, or to check whether a lock's characteristics accept writes without authentication.

• Map the GATT services and characteristics of my BLE fitness tracker, which I own.
• Test whether any characteristic on this smart lock accepts a write without authentication. I have written permission.
• Identify the pairing method used by this BLE beacon and explain what it means for security.
• Help me decode a BLE pairing capture from my own lab device with crackle.

Example commands the skill references

The skill lists concrete commands. The examples below are taken from its methodology. Replace the placeholder MAC address and handles with values from your own test device.

Discovery with bettercap and enumeration with bluetoothctl and gatttool are the starting point. Use these only against devices you are authorized to test.

Safety notes: scripts and network access

This skill runs scripts and uses the network. Its commands include sudo bettercap, sudo Sniffle, and cloning btproxy from GitHub, and they interact with real radio hardware. Read each command before the agent runs it and confirm the target is a device you are authorized to test.

Do not use the skill on devices you do not own or have written permission to test. Unauthorized access to locks, cars or medical devices can be illegal and dangerous. The skill itself warns that medical implants such as insulin pumps and pacemakers need carefully coordinated disclosure, and live testing can harm patients. Leave those out of live testing.

• Confirm written authorization or ownership before any live test.
• Review every sudo command and script before running it.
• Do not test medical implants such as insulin pumps or pacemakers live.

Tips for better results

Start with the discovery and enumeration steps, then move to characteristic testing only after you have a clear map of the device. Give the agent the device's MAC address and the tool outputs you already have, so it can reason from real data rather than guessing.

Expect the agent to explain results in terms of the skill's pairing table. Just Works offers no MITM protection, while LE Secure Connections is strong if Just Works is not forced. Use that distinction to decide what to test next.

• Provide the MAC address and any existing gatttool or bluetoothctl output.
• Work through the Quick Workflow in order.
• Ask the agent to explain each finding before moving on.