How do I install the Iot Overview skill?

Run npx skillmds@latest add purpleailab/iot-overview in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Iot Overview safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Iot Overview?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Iot Overview free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Iot Overview?

purpleailab (@purpleailab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Iot Overview by purpleailab — Agent Skill

Name: Iot Overview
Author: purpleailab

Iot Overview

Use when the engagement target is IoT, embedded Linux, RTOS, or any device reachable via UART/JTAG/SWD or by extracting its firmware. Covers firmware acquisition, binwalk extraction, filesystem mounting, default-credential hunting, bootloader attacks, wireless protocol sidebands (BLE, Zigbee, Z-Wave, LoRaWAN, sub-GHz).

purpleailab b16f90b 3.1 KB Updated Sep 17, 2026

File contents

IoT / Embedded Operator Skill Catalog

This catalog covers the surface area between hardware reconnaissance and runtime exploitation of IoT and embedded targets. Wireless sidebands (BLE / Zigbee / Z-Wave / LoRaWAN / sub-GHz) live alongside firmware-level attacks because IoT engagements routinely chain across both.

Playbooks

Skill	Use for
`/skills/standard/iot/firmware-acquisition/SKILL.md`	Vendor portals, OTA capture, SPI flash dump, eMMC chip-off
`/skills/standard/iot/binwalk-extract/SKILL.md`	binwalk + firmware-mod-kit extraction; squashfs / jffs2 mount
`/skills/standard/iot/hardcoded-creds/SKILL.md`	Strings, shadow, busybox httpd, telnet logs
`/skills/standard/iot/bootloader-uboot/SKILL.md`	U-Boot console interrupt; environment variables; secure-boot bypass
`/skills/standard/iot/dev-mem/SKILL.md`	/dev/mem, /dev/kmem, MTD writes on embedded Linux
`/skills/standard/iot/ble-gatt/SKILL.md`	GATT enumeration, characteristic read/write without auth, pairing downgrade
`/skills/standard/iot/zigbee-touchlink/SKILL.md`	Touchlink commissioning abuse, well-known transport key, ZCL command abuse
`/skills/standard/iot/z-wave/SKILL.md`	S0 derivation flaw, S2 ECDH analysis, replay on unauthenticated nodes
`/skills/standard/iot/lorawan-otaa/SKILL.md`	OTAA join, frame-counter replay, downlink injection
`/skills/standard/iot/sub-ghz/SKILL.md`	433/868/915 MHz capture + replay (HackRF, Flipper Zero, RTL-SDR)

Workflow

Inventory hardware: photograph PCB; identify SoC, flash, debug pads (UART = 4-pin pattern; JTAG = TAP; SWD = 2-pin SWDIO/SWCLK).
Acquire firmware: vendor update portal first; OTA proxy capture second; SPI flash dump third; eMMC chip-off last.
Extract: binwalk -eM <fw.bin>, then mount squashfs / jffs2 / ubifs.
Triage: search strings for credentials, AWS keys, MQTT topics, hardcoded IPs; identify backdoor accounts (busybox /etc/passwd, telnet/SSH stanzas).
Wireless co-channels: if the device speaks BLE / Zigbee / Z-Wave / LoRaWAN, capture commissioning, replay, attempt key extraction.
Cloud-IoT: if the device backhauls to a vendor cloud, pivot to the mobile companion app and the cloud API.

Hardware bench tools (sandbox tools)

Logic analyzer: Saleae Pro 8 / Sigrok PulseView.
Flash interface: ch341a + SOIC clip.
Debug interface: BusPirate v5, J-Link, Black Magic Probe.
Glitching: ChipWhisperer-Nano / Pico.
Wireless: HackRF One, Sonoff Zigbee 3.0 Dongle E, RTL-SDR Blog v4.

Safety

IoT engagements often touch consumer devices that the operator owns but that have shared cloud accounts (vendor telemetry). RoE must enumerate which clouds may be probed. ConOps blue_team field should declare the vendor IR contact when in scope so a fail-safe trip can be reported.

---name: iot-overviewdescription: Use when the engagement target is IoT, embedded Linux, RTOS, or any device reachable via UART/JTAG/SWD or by extracting its firmware. Covers firmware acquisition, binwalk extraction, filesystem mounting, default-credential hunting, bootloader attacks, wireless protocol sidebands (BLE, Zigbee, Z-Wave, LoRaWAN, sub-GHz).---# IoT / Embedded Operator Skill CatalogThis catalog covers the surface area between hardware reconnaissance andruntime exploitation of IoT and embedded targets. Wireless sidebands(BLE / Zigbee / Z-Wave / LoRaWAN / sub-GHz) live alongside firmware-levelattacks because IoT engagements routinely chain across both.## Playbooks| Skill | Use for ||---|---|| `/skills/standard/iot/firmware-acquisition/SKILL.md` | Vendor portals, OTA capture, SPI flash dump, eMMC chip-off || `/skills/standard/iot/binwalk-extract/SKILL.md` | binwalk + firmware-mod-kit extraction; squashfs / jffs2 mount || `/skills/standard/iot/hardcoded-creds/SKILL.md` | Strings, shadow, busybox httpd, telnet logs || `/skills/standard/iot/bootloader-uboot/SKILL.md` | U-Boot console interrupt; environment variables; secure-boot bypass || `/skills/standard/iot/dev-mem/SKILL.md` | /dev/mem, /dev/kmem, MTD writes on embedded Linux || `/skills/standard/iot/ble-gatt/SKILL.md` | GATT enumeration, characteristic read/write without auth, pairing downgrade || `/skills/standard/iot/zigbee-touchlink/SKILL.md` | Touchlink commissioning abuse, well-known transport key, ZCL command abuse || `/skills/standard/iot/z-wave/SKILL.md` | S0 derivation flaw, S2 ECDH analysis, replay on unauthenticated nodes || `/skills/standard/iot/lorawan-otaa/SKILL.md` | OTAA join, frame-counter replay, downlink injection || `/skills/standard/iot/sub-ghz/SKILL.md` | 433/868/915 MHz capture + replay (HackRF, Flipper Zero, RTL-SDR) |## Workflow1. **Inventory hardware**: photograph PCB; identify SoC, flash, debug pads (UART = 4-pin pattern; JTAG = TAP; SWD = 2-pin SWDIO/SWCLK).2. **Acquire firmware**: vendor update portal first; OTA proxy capture second; SPI flash dump third; eMMC chip-off last.3. **Extract**: `binwalk -eM <fw.bin>`, then mount squashfs / jffs2 / ubifs.4. **Triage**: search strings for credentials, AWS keys, MQTT topics, hardcoded IPs; identify backdoor accounts (busybox /etc/passwd, telnet/SSH stanzas).5. **Wireless co-channels**: if the device speaks BLE / Zigbee / Z-Wave / LoRaWAN, capture commissioning, replay, attempt key extraction.6. **Cloud-IoT**: if the device backhauls to a vendor cloud, pivot to the mobile companion app and the cloud API.## Hardware bench tools (sandbox tools)- Logic analyzer: Saleae Pro 8 / Sigrok PulseView.- Flash interface: ch341a + SOIC clip.- Debug interface: BusPirate v5, J-Link, Black Magic Probe.- Glitching: ChipWhisperer-Nano / Pico.- Wireless: HackRF One, Sonoff Zigbee 3.0 Dongle E, RTL-SDR Blog v4.## SafetyIoT engagements often touch consumer devices that the operator owns butthat have shared cloud accounts (vendor telemetry). RoE must enumeratewhich clouds may be probed. ConOps `blue_team` field should declare thevendor IR contact when in scope so a fail-safe trip can be reported.

Frequently asked questions