Guide · Agent skill
How to use the Offensive IoT Testing Methodology agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-iot skill is a written security testing playbook that an AI agent can follow when assessing connected devices such as smart-home gadgets, routers, cameras and industrial controllers. It covers the path from physical circuit board inspection through firmware extraction, analysis and runtime access. This guide explains what the skill does, how to install it, how to ask for it in plain language, and what you need before using it.
Offensive IoT Testing MethodologySnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Download the offensive-iot skill as a ZIP from the page where you found it.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
- 4Confirm the scope. Write down the devices you own or have permission to test and the rules of engagement.
- 5Install the tools. Install the command-line tools you need, such as binwalk, unsquashfs and Ghidra, plus any hardware for physical work.
- 6Ask for one phase. Describe the device and the phase you want, such as firmware extraction or firmware triage, in plain language.
- 7Review and record. Check each command before running it on hardware and record the results for your report.
What is an agent skill, and what does this one do?
An agent skill is a folder containing a SKILL.md file that gives an AI agent specialised instructions it can load when a task matches. This skill is a methodology for offensive IoT and embedded device testing. It is written as attack technique guidance, not defensive hardening advice.
Once installed, the agent can walk through a structured workflow: recon the device physically, get the firmware, unpack and analyze it, establish runtime access, and pivot to companion apps, cloud APIs or neighbouring devices.
- Hardware reconnaissance: identifying the SoC and flash chip, and locating UART, JTAG and SWD debug headers and test points.
- Firmware acquisition: vendor downloads, OTA capture, flash dumps and chip-off reading.
- Firmware analysis: extracting filesystems with binwalk, triaging binaries, hunting hardcoded secrets and default credentials.
- Bootloader and runtime topics: U-Boot console access, secure-boot concepts, fault injection basics, and embedded Linux checks such as setuid binaries and MTD writes.
- Wireless, protocol and app topics: Zigbee, BLE, Z-Wave, MQTT, Modbus, companion apps and cloud IoT APIs.
How do you install the offensive-iot skill?
Download the skill as a ZIP from the page where you found it, then unzip it into a skills folder. For a personal setup, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project. The skill folder should contain SKILL.md.
Alternatively, if you use the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/ so it is available across your projects.
- Project install: unzip into .claude/skills/ inside the project folder so it applies only there.
- Claude apps: upload the ZIP under Settings → Capabilities → Skills.
~/.claude/skills/How do you trigger the skill with natural requests?
You do not need a special command. Describe the task in plain language and mention the device type or the kind of work. The agent matches your request against the skill's description, which covers IoT pentest, smart-home assessment, ICS/OT testing and embedded vulnerability research.
State your authorisation and scope in the request. The skill targets live systems, so a clear scope helps the agent keep its work within what you are permitted to test.
- "Using the offensive-iot skill, help me plan a firmware extraction for this SPI flash chip on a smart plug I own."
- "Walk me through the IoT attack surface checklist for this router under our signed pentest scope."
- "Help me find the baud rate of the UART on this board and identify whether it shows a U-Boot console."
- "Triage this extracted rootfs for hardcoded credentials, setuid binaries and outdated busybox versions."
- "Review the CGI binaries in this web admin filesystem for command injection patterns."
What do you need before you start?
The skill is a playbook, so it does not run anything itself. You install the command-line tools and, for physical work, the hardware. The source lists binwalk, strings, unsquashfs, jefferson, ubireader, flashrom, mitmproxy, bettercap and Ghidra as examples of tools you install yourself.
Physical tasks need hardware such as USB-UART adapters, SPI programmers (the source names CH341A and XGecu T48) and logic analyzers. Software-only tasks such as firmware triage need only the analysis tools.
- Command-line tools installed by you: binwalk, strings, unsquashfs, jefferson, ubireader, flashrom, mitmproxy, bettercap, Ghidra.
- Hardware for physical work: USB-UART adapter, SPI programmer, logic analyzer, multimeter.
- Written authorisation for any device you test.
What safety points should you know?
The skill runs no scripts and makes no network calls itself. Its commands, such as flashing, MTD writes, fault injection and bus-level writes, are run by you or by the agent on your machine against real hardware, so the risks are real.
Flashing, glitching and bus-level writes can brick equipment or cause physical harm. Do not use the methodology on production industrial or medical systems without a safety-aware plan. Only test devices you own or have written permission to test.
- Test only devices you own or have signed permission to assess.
- Keep a backup of any original firmware before writing to flash.
- Do not apply the techniques to production industrial or medical systems without a safety plan.
- The skill is attack-focused; it is not a guide to fixing or configuring your own device.
What tips help you get better results?
Give the agent concrete inputs: photos or descriptions of the board markings, the chip package type, the extracted filesystem, or the log output from a UART session. The methodology's checklists work best when the agent can match them against real artifacts.
Work in the order the skill suggests. Physical recon and firmware acquisition usually come before runtime or wireless testing, and each step's output informs the next.
- Name the SoC and flash package if you can read the markings, such as 8-pin SOIC for SPI NOR or BGA for eMMC.
- Share command output rather than paraphrasing it.
- Ask for one phase at a time, such as firmware triage, before moving to runtime access.
- Keep a record of each step for your report.
What people use it for
- Planning a firmware extraction from an SPI NOR flash on a device you own.
- Triaging an extracted embedded Linux filesystem for hardcoded secrets and setuid binaries.
- Reviewing a router's web admin CGI binaries for command injection patterns during an authorised pentest.
- Building a structured attack-surface checklist for a smart-home or ICS/OT assessment.
- Mapping which wireless or companion app surfaces to test for a connected camera under signed scope.
Frequently asked questions
Is the offensive-iot skill free to use?
The source lists the skill under the MIT licence. Check the licence file in the download for the terms that apply to you.
What do I need to install to use the offensive-iot skill?
The skill itself is a SKILL.md file. The source says you must install command-line tools such as binwalk, strings, unsquashfs, jefferson, ubireader, flashrom, mitmproxy, bettercap and Ghidra, plus hardware like USB-UART adapters and SPI programmers for physical work.
Where do I put the skill folder?
Unzip the downloaded ZIP into ~/.claude/skills/ for personal use, or into .claude/skills/ in a project folder. You can also upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
Does the skill run scripts or access the network?
According to the listing, the skill runs no scripts and makes no network calls. Commands in the methodology are executed by you or the agent on your own machine against the target.
Can I use this skill to test a device I do not own?
No. The skill is for devices you own or have written permission to test, because the techniques target live systems and may be illegal without authorisation.
Is this skill useful for fixing or hardening my own smart device?
Not really. The methodology is offensive and describes attack techniques rather than defensive hardening or configuration, so pick a hardening guide for that job.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits professional penetration testers under a signed scope, security researchers working on their own hardware, and smart-home or ICS/OT assessors who want a structured attack-surface checklist. It is a poor fit for anyone testing devices they do not own or lack permission for, for people who want to harden or configure a device, or for production industrial or medical systems without a safety-aware plan.
Download the skill