How to use the offensive-z-wave agent skill for Z-Wave testing

What the offensive-z-wave skill does

The skill gives an agent a structured attack methodology for Z-Wave, the wireless mesh protocol used by many smart home devices. It is written from an offensive point of view: it describes how a tester would assess a Z-Wave deployment, not how to configure or harden one.

The methodology covers choosing the correct radio frequency for your region (908 MHz in the US, 868 MHz in the EU), sniffing traffic, telling the older S0 security scheme apart from the newer S2 scheme, testing devices that accept unauthenticated commands, and assessing the home hub that controls the devices. It also includes a reporting checklist covering chipset and firmware revision, S0 versus S2 per node, and hub compromise paths.

• Radio frequency selection by region
• Sniffing and capture concepts, including the inclusion (pairing) phase
• Distinguishing legacy S0 from S2 security by frame format
• Assessing devices that do not enforce authentication
• Reviewing smart home hubs as part of a test
• Reporting structure for findings

Install the skill from the ZIP file

Download the ZIP for this skill from this page. The skill is a single SKILL.md file. Unzip it so that the offensive-z-wave folder, containing SKILL.md, sits inside one of the skills folders listed below.

For a personal install, place it in your user skills folder at ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder so it applies only to that codebase.

If you use the Claude apps rather than a local agent, you can upload the skill instead. Open Settings, go to Capabilities, then Skills, and upload the skill there.

• Personal install: ~/.claude/skills/offensive-z-wave/
• Project install: .claude/skills/offensive-z-wave/ inside your project
• Claude apps: Settings → Capabilities → Skills → upload

Trigger the skill with natural requests

You do not need a special command. An agent loads a skill when your request matches its description. This skill's description mentions Z-Wave, smart home devices such as door locks, sensors and garage controllers, and the attack topics it covers. So a request that names Z-Wave and a security assessment goal will normally load it.

State your authorisation and scope in the request. A good request names the device types, the lab or equipment you own, and the outcome you want, such as a report on which nodes use S0 versus S2.

• Walk me through assessing the Z-Wave devices on my own lab test bench and tell me which nodes still use S0 security.
• Help me map the S0 versus S2 status of each node in my authorised test deployment and draft the findings.
• I have written permission to test a building's Z-Wave sensors. What order should I work through the methodology in?
• Explain how the skill's frequency selection works for a 868 MHz EU setup before I buy any radio hardware.
• Summarise the hub compromise section so I can scope a red team engagement report.

What you need before you start

The skill lists its requirements but does not supply most of them. You need your own radio hardware, your own software tools, and a Python environment. Some tools named in the skill are not included with it.

Hardware named in the skill includes HackRF or RTL-SDR software-defined radio hardware, or a Z-Force or EZ-Wave compatible adapter. An Aeotec Z-Stick is listed as optional, for use as a legitimate controller node. Software named includes Wireshark with a Z-Wave dissector and Python with scapy (a community Z-Wave fork).

• HackRF or RTL-SDR hardware, or a Z-Force/EZ-Wave compatible adapter
• Optional: Aeotec Z-Stick as a legitimate controller node
• Wireshark with a Z-Wave dissector
• Python with scapy (community Z-Wave fork)
• Command-line tools referred to as ezwave-sniff and ezwave-test, which are not included in the skill

Safety, authorisation and what the skill does not verify

Use this skill only on Z-Wave devices you own, in a lab, or in a deployment where you have written permission to test. The skill targets live devices, and applying its guidance to someone else's locks, alarms or hubs without authorisation is illegal.

The skill runs no scripts and makes no network calls itself. The commands it shows are written inside the document and are not verified. Some command and tool names, such as ezwave-sniff and scapy-zwave, may not exist or may not work as written. Check every command against the tool's own documentation before you run it, and never run anything against a device you are not authorised to test.

• Test only your own equipment or systems with written authorisation
• Do not treat commands in the file as verified or copy-paste ready
• The skill runs no scripts and uses no network access itself
• The skill contains no configuration or defensive hardening steps
• Keep captures and findings within the scope you were given

Tips for getting useful results

Give the agent the region first, because the radio frequency must match it. Then ask it to classify each device as S0 or S2 before going deeper, since the two schemes lead to different lines of inquiry. Asking for a written findings list early makes the output easier to check.

Because the skill is an attack playbook and not a verified reference, ask the agent to explain its reasoning and to flag any step it cannot confirm. Use the reporting section to structure notes by device, chipset, firmware revision and security scheme.

• State the region (US or EU) before asking about frequency
• Ask for the S0 versus S2 classification as a separate step
• Request a per-device table for the report
• Ask the agent to flag unverified commands or tool names