How do I install the Wireless Overview skill?

Run npx skillmds@latest add purpleailab/wireless-overview in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Wireless Overview safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Wireless Overview?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Wireless Overview free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Wireless Overview?

purpleailab (@purpleailab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Wireless Overview by purpleailab — Agent Skill

Name: Wireless Overview
Author: purpleailab

Wireless Overview

Top-level index for the Decepticon 802.11 wireless attack suite. Routes the WirelessOperator to the correct leaf skill based on the target AP's crypto column (PSK / SAE / MGT / WPS) and engagement posture. BLE, Zigbee, Z-Wave, LoRaWAN, and sub-GHz live under iot/ by design — link provided below to prevent duplication.

purpleailab 3685c91 3.6 KB Updated Sep 17, 2026

File contents

802.11 Wireless Attack Suite — Operator Index

Load your wireless workflow (loaded into your system prompt) first on every iteration (hardware mode check, phase progression, scope rules, KG node contract). This file is the routing layer on top of it.

Playbook table

Leaf skill	Crypto column / trigger	Primary MITRE	Status
wpa2-psk	`WPA2 PSK`, `WPA PSK`	T1040, T1110.001	shipped
wpa3-sae	`WPA3 SAE`, `WPA2 WPA3` transition mode	T1557, T1040	shipped
wpa-enterprise-eap	`MGT`, `WPA-Enterprise`, `802.1X`	T1557, T1110.001	shipped
wps-pixie-dust	WPS column non-empty, `WPS` flag in wash	T1110.001, T1040	shipped
evil-twin-karma	Open / PSK, PNL probe leakage, captive portal	T1557, T1556	shipped
deauth-pmf	Any target needing client reconnect or 802.11w posture finding	T1498, T1040	shipped
krack-fragattacks	Legacy / embedded supplicant, key-reinstallation / fragmentation test	T1557, T1040	shipped

BLE GATT, Zigbee Touchlink, Z-Wave, LoRaWAN, and sub-GHz attacks are scoped to standard/iot/. Cross-reference that suite when the objective targets non-802.11 RF.

Hardware mode pointer

Leaf skills inherit the mode check from the wireless workflow:

mode = plan/roe.json:machine_enforcement.wireless.mode
  "in_sandbox"  → USB passthrough, monitor mode inside Kali
  "dropbox"     → ssh <dropbox> -- '<cmd>' for every wireless op
  "none"        → refuse, return outcome=blocked

Crypto-mode decision tree

airodump-ng --write-interval 1 --output-format csv ...
Read the ENC/CIPHER/AUTH columns:

  ENC=WPA2, AUTH=PSK          → wpa2-psk
  ENC=WPA3, AUTH=SAE          → wpa3-sae
  ENC=WPA2+WPA3, AUTH=SAE+PSK → wpa3-sae (transition-mode downgrade path)
  AUTH=MGT / 802.1X            → wpa-enterprise-eap
  WPS column non-empty          → wps-pixie-dust (run in parallel with PSK path)
  Open / no credential needed  → evil-twin-karma (KARMA/portal capture)

After selecting the primary leaf, always check:
  - deauth-pmf: needed if Path B (four-way) is chosen OR as standalone PMF finding
  - krack-fragattacks: applicable when target is legacy/embedded/poor-patch-cadence

KG node contract

All wireless leaf skills write the same node types (mirrors the wireless workflow):

Node kind	Typical props
`Network`	ssid, bssid, channel, crypto, pmf_state
`Host`	mac, oui, last_seen_bssid
`Credential`	secret_type, ssid, bssid, psk/eap_identity/eap_challenge
`Finding`	title, cve_ids (if applicable), severity, remediation

OPSEC posture cross-reference

posture	techniques permitted
`stealth`	PMKID (wpa2-psk Path A), passive PMF detect (deauth-pmf), Pixie-Dust only
`standard`	+ targeted deauth (1 frame), EAP capture, WPS Pixie-Dust
`loud`	+ broadcast deauth, evil-twin, KARMA, beacon flood, online WPS brute

Evil-twin always requires explicit permitted_actions: evil_twin in plan/roe.json regardless of posture — see the wireless workflow scope rules in your system prompt.

---name: wireless-overviewdescription: Top-level index for the Decepticon 802.11 wireless attack suite. Routes the WirelessOperator to the correct leaf skill based on the target AP's crypto column (PSK / SAE / MGT / WPS) and engagement posture. BLE, Zigbee, Z-Wave, LoRaWAN, and sub-GHz live under iot/ by design — link provided below to prevent duplication.---# 802.11 Wireless Attack Suite — Operator Index> Load your wireless workflow (loaded into your system prompt) first on every iteration (hardware mode> check, phase progression, scope rules, KG node contract). This file> is the routing layer on top of it.## Playbook table| Leaf skill | Crypto column / trigger | Primary MITRE | Status ||---|---|---|---|| [wpa2-psk](wpa2-psk/SKILL.md) | `WPA2 PSK`, `WPA PSK` | T1040, T1110.001 | shipped || [wpa3-sae](wpa3-sae/SKILL.md) | `WPA3 SAE`, `WPA2 WPA3` transition mode | T1557, T1040 | shipped || [wpa-enterprise-eap](wpa-enterprise-eap/SKILL.md) | `MGT`, `WPA-Enterprise`, `802.1X` | T1557, T1110.001 | shipped || [wps-pixie-dust](wps-pixie-dust/SKILL.md) | WPS column non-empty, `WPS` flag in wash | T1110.001, T1040 | shipped || [evil-twin-karma](evil-twin-karma/SKILL.md) | Open / PSK, PNL probe leakage, captive portal | T1557, T1556 | shipped || [deauth-pmf](deauth-pmf/SKILL.md) | Any target needing client reconnect or 802.11w posture finding | T1498, T1040 | shipped || [krack-fragattacks](krack-fragattacks/SKILL.md) | Legacy / embedded supplicant, key-reinstallation / fragmentation test | T1557, T1040 | shipped |> BLE GATT, Zigbee Touchlink, Z-Wave, LoRaWAN, and sub-GHz attacks> are scoped to `standard/iot/`. Cross-reference that suite when the> objective targets non-802.11 RF.## Hardware mode pointerLeaf skills inherit the mode check from the wireless workflow:```mode = plan/roe.json:machine_enforcement.wireless.mode "in_sandbox" → USB passthrough, monitor mode inside Kali "dropbox" → ssh <dropbox> -- '<cmd>' for every wireless op "none" → refuse, return outcome=blocked```## Crypto-mode decision tree```airodump-ng --write-interval 1 --output-format csv ...Read the ENC/CIPHER/AUTH columns: ENC=WPA2, AUTH=PSK → wpa2-psk ENC=WPA3, AUTH=SAE → wpa3-sae ENC=WPA2+WPA3, AUTH=SAE+PSK → wpa3-sae (transition-mode downgrade path) AUTH=MGT / 802.1X → wpa-enterprise-eap WPS column non-empty → wps-pixie-dust (run in parallel with PSK path) Open / no credential needed → evil-twin-karma (KARMA/portal capture)After selecting the primary leaf, always check: - deauth-pmf: needed if Path B (four-way) is chosen OR as standalone PMF finding - krack-fragattacks: applicable when target is legacy/embedded/poor-patch-cadence```## KG node contractAll wireless leaf skills write the same node types (mirrors the wireless workflow):| Node kind | Typical props ||---|---|| `Network` | ssid, bssid, channel, crypto, pmf_state || `Host` | mac, oui, last_seen_bssid || `Credential` | secret_type, ssid, bssid, psk/eap_identity/eap_challenge || `Finding` | title, cve_ids (if applicable), severity, remediation |## OPSEC posture cross-reference| posture | techniques permitted ||---|---|| `stealth` | PMKID (wpa2-psk Path A), passive PMF detect (deauth-pmf), Pixie-Dust only || `standard` | + targeted deauth (1 frame), EAP capture, WPS Pixie-Dust || `loud` | + broadcast deauth, evil-twin, KARMA, beacon flood, online WPS brute |> Evil-twin always requires explicit `permitted_actions: evil_twin` in> `plan/roe.json` regardless of posture — see the wireless workflow scope rules in your system prompt.

Frequently asked questions