How do I install the Router Reverse Skill Router Ot Ics skill?

Run npx skillmds@latest add netvar1337/router-reverse-skill-router-ot-ics in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Router Reverse Skill Router Ot Ics safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Router Reverse Skill Router Ot Ics?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Router Reverse Skill Router Ot Ics free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Router Reverse Skill Router Ot Ics?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Router Reverse Skill Router Ot Ics by netvar1337

Name: Router Reverse Skill Router Ot Ics
Author: netvar1337

File contents

OT / ICS Security

ACTION REQUIRED (execute immediately after reading)

NOW: read ../field-journal/precedent-pentest.md — mistakes in OT environments can cause physical harm
NOW: written authorization must state clearly: sites, network segments, whether active scanning/register writes are allowed
NOW: case-init; passive-first by default; no PLC write operations before ready_for_act
NEXT: tool-index; most OT tools need manual setup and an isolated lab network
ACT: asset and zone identification → exposure surface → read-only verification

Applicable Scenarios

OT/SCADA/DCS security assessment (authorized)
Purdue model zoning and cross-zone channels
Modbus/DNP3/S7/EtherNet/IP protocol exposure
Engineering stations, HMIs, historians, jump hosts
IT/OT convergence boundaries (firewall rules, unidirectional gateways)

Safety Iron Rules (MUST)

MUST NOT, without explicit permission:
- Write coils/registers to PLCs
- High-rate full-network scans of production OT
- Interrupt safety instrumented system (SIS) related paths
Prefer: read-only identification, traffic mirroring, offline firmware/config analysis

Workflow

Phase 1 — Zones and Assets

□ Sketch Purdue L0–L5: field devices → control → supervisory → site DMZ → enterprise
□ Asset inventory: PLC/RTU/HMI/engineering station/historian/jump host
□ Protocol and port baseline (authorized segments only)

Phase 2 — Passive and Read-Only

□ SPAN/mirrored PCAP → protocol-reverse / Wireshark OT dissectors
□ Offline audit of configuration and project files (TIA/RSLogix exports etc.)
□ Record default passwords and cleartext protocols (Modbus has no auth) as Findings; do not write to disk or change values

Phase 3 — Restricted Active (authorized only)

□ Low-rate identification, during maintenance windows
□ Read-only function codes first
□ Evidence at every step; stop immediately and report on any anomaly

Phase 4 — Firmware/Patch Surface

□ Controller firmware versions → CVE mapping (do not blindly flash firmware)
□ Combine with firmware-pentest for offline image analysis

Toolchain

Tool	Purpose	Note
Wireshark OT dissectors	Passive parsing	Mirrored traffic
Nmap NSE (restricted)	Identification	Rate and time window
Claroty/Nozomi etc.	Asset discovery	Commercial/on-site
PLC vendor engineering software	Config auditing	Offline preferred
binwalk / Ghidra	Firmware	Offline

References

references/ot-safe-assessment.md
../firmware-pentest/ ../protocol-reverse/ ../network via pentest-tools

Routing Context

Upstream: MASTER R28
Downstream: deep firmware digging firmware-pentest; protocols protocol-reverse; IT lateral movement windows-ad/attack-chain
Peers: do not hit OT with default web-scan parameters

Task Completion Self-Check

Passive/read-only by default with authorization boundaries recorded?
Avoided write operations to control loops (unless explicitly allowed)?
Findings include physical/process impact notes?
Checklist / journal?

---name: router-reverse-skill-router-ot-icsdescription: Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.---# OT / ICS Security## ACTION REQUIRED (execute immediately after reading)1. `NOW`: read `../field-journal/precedent-pentest.md` — **mistakes in OT environments can cause physical harm**2. `NOW`: written authorization must state clearly: sites, network segments, whether active scanning/register writes are allowed3. `NOW`: case-init; **passive-first** by default; no PLC write operations before `ready_for_act`4. `NEXT`: tool-index; most OT tools need manual setup and an isolated lab network5. `ACT`: asset and zone identification → exposure surface → read-only verification## Applicable Scenarios- OT/SCADA/DCS security assessment (authorized)- Purdue model zoning and cross-zone channels- Modbus/DNP3/S7/EtherNet/IP protocol exposure- Engineering stations, HMIs, historians, jump hosts- IT/OT convergence boundaries (firewall rules, unidirectional gateways)## Safety Iron Rules (MUST)```textMUST NOT, without explicit permission:- Write coils/registers to PLCs- High-rate full-network scans of production OT- Interrupt safety instrumented system (SIS) related pathsPrefer: read-only identification, traffic mirroring, offline firmware/config analysis```## Workflow### Phase 1 — Zones and Assets```text□ Sketch Purdue L0–L5: field devices → control → supervisory → site DMZ → enterprise□ Asset inventory: PLC/RTU/HMI/engineering station/historian/jump host□ Protocol and port baseline (authorized segments only)```### Phase 2 — Passive and Read-Only```text□ SPAN/mirrored PCAP → protocol-reverse / Wireshark OT dissectors□ Offline audit of configuration and project files (TIA/RSLogix exports etc.)□ Record default passwords and cleartext protocols (Modbus has no auth) as Findings; do not write to disk or change values```### Phase 3 — Restricted Active (authorized only)```text□ Low-rate identification, during maintenance windows□ Read-only function codes first□ Evidence at every step; stop immediately and report on any anomaly```### Phase 4 — Firmware/Patch Surface```text□ Controller firmware versions → CVE mapping (do not blindly flash firmware)□ Combine with firmware-pentest for offline image analysis```## Toolchain| Tool | Purpose | Note ||------|------|------|| Wireshark OT dissectors | Passive parsing | Mirrored traffic || Nmap NSE (restricted) | Identification | Rate and time window || Claroty/Nozomi etc. | Asset discovery | Commercial/on-site || PLC vendor engineering software | Config auditing | Offline preferred || binwalk / Ghidra | Firmware | Offline |## References- `references/ot-safe-assessment.md`- `../firmware-pentest/` `../protocol-reverse/` `../network` via pentest-tools## Routing Context**Upstream**: MASTER R28 **Downstream**: deep firmware digging `firmware-pentest`; protocols `protocol-reverse`; IT lateral movement `windows-ad`/`attack-chain` **Peers**: do not hit OT with default web-scan parameters## Task Completion Self-Check- [ ] Passive/read-only by default with authorization boundaries recorded?- [ ] Avoided write operations to control loops (unless explicitly allowed)?- [ ] Findings include physical/process impact notes?- [ ] Checklist / journal?

Frequently asked questions

Router Reverse Skill Router Ot Ics