[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG1BC2Y9JS9TA4JBK8B2GP":3,"skill-same:01M6AG1BC2Y9JS9TA4JBK8B2GP":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AG1BC2Y9JS9TA4JBK8B2GP","performing-scada-hmi-security-assessment",null,"Perform security assessments of SCADA Human-Machine Interface (HMI) systems to identify vulnerabilities in web-based HMIs, thin-client configurations, authentication mechanisms, and communication channels between HMI and PLCs, aligned with IEC 62443 and NIST SP 800-82 guidelines.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-scada-hmi-security-assessment\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing scada hmi security assessment","assessment","security","scada","ics","hmi","security-assessment","vulnerability","ICS-security","t1059","t1078","iec62443","ot-security","NIST","communication","authentication","guidelines","pr","web","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-scada-hmi-security-assessment\ndescription: 'Perform security assessments of SCADA Human-Machine Interface (HMI)\n  systems to identify vulnerabilities in web-based HMIs, thin-client configurations,\n  authentication mechanisms, and communication channels between HMI and PLCs, aligned\n  with IEC 62443 and NIST SP 800-82 guidelines.\n\n  '\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- scada\n- hmi\n- security-assessment\n- vulnerability\n- iec62443\n- nist-800-82\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T0816\n- T0836\n---\n\n# Performing SCADA HMI Security Assessment\n\n## When to Use\n\n- When assessing the security posture of HMI systems in SCADA\u002FDCS environments\n- When evaluating web-based HMI interfaces for common web vulnerabilities\n- When auditing HMI authentication, authorization, and session management\n- When testing communication security between HMIs and PLCs\u002FRTUs\n- When preparing for IEC 62443 or NERC CIP compliance assessments\n\n**Do not use** for testing HMIs in active production without a maintenance window and rollback plan, for PLC-level protocol analysis (see performing-s7comm-protocol-security-analysis), or for general web application testing on non-OT systems.\n\n## Prerequisites\n\n- HMI system inventory with vendor, version, and network configuration details\n- Lab or test environment mirroring production HMI setup (preferred for active testing)\n- Authorization from plant operations for testing during maintenance windows\n- NIST SP 800-82 and IEC 62443 security requirements documentation\n- Network capture capability on HMI-to-PLC communication segment\n\n## Workflow\n\n### Step 1: Assess HMI Attack Surface\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"SCADA HMI Security Assessment Tool.\n\nEvaluates HMI security across authentication, communication,\nconfiguration, and web interface categories aligned with\nIEC 62443 and NIST SP 800-82 requirements.\n\"\"\"\n\nimport json\nimport sys\nfrom datetime import datetime\nfrom typing import Dict, List\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass HMISecurityAssessment:\n    \"\"\"Performs security assessment of SCADA HMI systems.\"\"\"\n\n    def __init__(self, hmi_info: dict):\n        self.hmi_info = hmi_info\n        self.findings = []\n        self.checks_run = 0\n        self.checks_passed = 0\n\n    def check_authentication(self):\n        \"\"\"Assess HMI authentication mechanisms.\"\"\"\n        checks = [\n            {\n                \"id\": \"AUTH-01\",\n                \"name\": \"Password complexity enforcement\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.7\",\n                \"description\": \"HMI must enforce minimum password complexity requirements\",\n                \"test\": \"Verify minimum length >= 8, complexity rules, history >= 5\",\n            },\n            {\n                \"id\": \"AUTH-02\",\n                \"name\": \"Account lockout policy\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.11\",\n                \"description\": \"HMI must lock accounts after failed login attempts\",\n                \"test\": \"Verify lockout after 5 failed attempts, lockout duration >= 15 min\",\n            },\n            {\n                \"id\": \"AUTH-03\",\n                \"name\": \"Default credentials changed\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.5\",\n                \"description\": \"All default vendor credentials must be changed\",\n                \"test\": \"Attempt login with known vendor defaults (admin\u002Fadmin, operator\u002Foperator)\",\n            },\n            {\n                \"id\": \"AUTH-04\",\n                \"name\": \"Role-based access control\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 2.1\",\n                \"description\": \"HMI must separate operator, engineer, and admin roles\",\n                \"test\": \"Verify operator role cannot access engineering functions\",\n            },\n            {\n                \"id\": \"AUTH-05\",\n                \"name\": \"Session timeout enforcement\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.12\",\n                \"description\": \"HMI sessions must time out after inactivity\",\n                \"test\": \"Verify session timeout \u003C= 15 minutes for operator, \u003C= 5 for admin\",\n            },\n            {\n                \"id\": \"AUTH-06\",\n                \"name\": \"Multi-factor authentication for remote access\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.13\",\n                \"description\": \"Remote HMI access requires MFA\",\n                \"test\": \"Verify MFA is enforced for all non-local HMI connections\",\n            },\n        ]\n\n        print(f\"\\n--- AUTHENTICATION ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Ref: {check['iec62443_ref']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_communication_security(self):\n        \"\"\"Assess HMI-to-PLC communication security.\"\"\"\n        checks = [\n            {\n                \"id\": \"COMM-01\",\n                \"name\": \"Encrypted HMI-PLC communication\",\n                \"description\": \"Traffic between HMI and PLCs should use encrypted protocols (OPC UA with TLS)\",\n                \"test\": \"Capture HMI-PLC traffic and verify encryption (Wireshark TLS handshake)\",\n            },\n            {\n                \"id\": \"COMM-02\",\n                \"name\": \"HMI write command authentication\",\n                \"description\": \"Write commands from HMI to PLC should be authenticated\",\n                \"test\": \"Verify that write operations require operator confirmation\u002Fauthentication\",\n            },\n            {\n                \"id\": \"COMM-03\",\n                \"name\": \"Web HMI uses HTTPS\",\n                \"description\": \"Web-based HMI interfaces must use TLS 1.2+ with valid certificates\",\n                \"test\": \"Check TLS version, cipher suites, certificate validity\",\n            },\n            {\n                \"id\": \"COMM-04\",\n                \"name\": \"No cleartext protocols in use\",\n                \"description\": \"Telnet, FTP, HTTP must not be used for HMI access or management\",\n                \"test\": \"Port scan HMI for cleartext protocol services\",\n            },\n        ]\n\n        print(f\"\\n--- COMMUNICATION SECURITY ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_web_hmi_security(self):\n        \"\"\"Assess web-based HMI for common web vulnerabilities.\"\"\"\n        hmi_url = self.hmi_info.get(\"url\", \"\")\n        if not hmi_url:\n            print(f\"\\n  [SKIP] No web HMI URL provided\")\n            return\n\n        checks = [\n            {\n                \"id\": \"WEB-01\",\n                \"name\": \"Cross-Site Scripting (XSS)\",\n                \"owasp\": \"A7:2017\",\n                \"test\": \"Test input fields with XSS payloads in tag names, alarm messages\",\n            },\n            {\n                \"id\": \"WEB-02\",\n                \"name\": \"Cross-Site Request Forgery (CSRF)\",\n                \"owasp\": \"A8:2013\",\n                \"test\": \"Verify CSRF tokens on state-changing operations (setpoint changes)\",\n            },\n            {\n                \"id\": \"WEB-03\",\n                \"name\": \"Insecure Direct Object References\",\n                \"owasp\": \"A4:2013\",\n                \"test\": \"Manipulate URL parameters to access other users HMI views\",\n            },\n            {\n                \"id\": \"WEB-04\",\n                \"name\": \"Security Headers\",\n                \"test\": \"Verify X-Frame-Options, CSP, X-Content-Type-Options headers\",\n            },\n            {\n                \"id\": \"WEB-05\",\n                \"name\": \"Privileged file system access (CVE-2025-0921)\",\n                \"test\": \"Check Ignition SCADA for privileged file system vulnerability via project files\",\n            },\n        ]\n\n        print(f\"\\n--- WEB HMI SECURITY ASSESSMENT ---\")\n        print(f\"  Target: {hmi_url}\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_hardening(self):\n        \"\"\"Assess HMI operating system and application hardening.\"\"\"\n        checks = [\n            {\n                \"id\": \"HARD-01\",\n                \"name\": \"OS patch level\",\n                \"test\": \"Verify HMI OS is patched within SLA (typically 90 days for OT)\",\n            },\n            {\n                \"id\": \"HARD-02\",\n                \"name\": \"Unnecessary services disabled\",\n                \"test\": \"Verify no unnecessary network services running (RDP if not needed, SMB, etc)\",\n            },\n            {\n                \"id\": \"HARD-03\",\n                \"name\": \"USB port restrictions\",\n                \"test\": \"Verify USB mass storage is blocked on HMI terminals\",\n            },\n            {\n                \"id\": \"HARD-04\",\n                \"name\": \"Application whitelisting\",\n                \"test\": \"Verify only authorized HMI applications can execute\",\n            },\n            {\n                \"id\": \"HARD-05\",\n                \"name\": \"Audit logging enabled\",\n                \"test\": \"Verify operator actions, login events, and setpoint changes are logged\",\n            },\n        ]\n\n        print(f\"\\n--- HMI HARDENING ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def generate_report(self):\n        \"\"\"Generate assessment report.\"\"\"\n        self.check_authentication()\n        self.check_communication_security()\n        self.check_web_hmi_security()\n        self.check_hardening()\n\n        print(f\"\\n{'='*70}\")\n        print(\"SCADA HMI SECURITY ASSESSMENT SUMMARY\")\n        print(f\"{'='*70}\")\n        print(f\"Date: {datetime.now().isoformat()}\")\n        print(f\"HMI: {self.hmi_info.get('name', 'Unknown')}\")\n        print(f\"Vendor: {self.hmi_info.get('vendor', 'Unknown')}\")\n        print(f\"Version: {self.hmi_info.get('version', 'Unknown')}\")\n        print(f\"Total Checks: {self.checks_run}\")\n        print(f\"Findings: {len(self.findings)}\")\n\n\nif __name__ == \"__main__\":\n    assessment = HMISecurityAssessment(hmi_info={\n        \"name\": \"Plant-HMI-01\",\n        \"vendor\": \"Siemens WinCC\",\n        \"version\": \"7.5 SP2\",\n        \"ip\": \"10.10.2.10\",\n        \"url\": \"https:\u002F\u002F10.10.2.10:8080\",\n        \"os\": \"Windows 10 LTSC 2021\",\n    })\n    assessment.generate_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| HMI | Human-Machine Interface providing operators visual representation and control of industrial processes |\n| Web HMI | Browser-based HMI interface accessible via HTTP\u002FHTTPS, subject to standard web vulnerabilities |\n| Setpoint | Target value for a process variable that operators can change through the HMI; unauthorized changes can cause process upset |\n| Alarm Suppression | Attacker technique of disabling or hiding HMI alarms to mask malicious process manipulation |\n| WinCC | Siemens SCADA\u002FHMI software widely deployed in manufacturing and process industries |\n| CVE-2025-0921 | Ignition SCADA privileged file system vulnerability exploitable through malicious project uploads |\n\n## Output Format\n\n```\nHMI SECURITY ASSESSMENT REPORT\n=================================\nDate: YYYY-MM-DD\nHMI: [name] | Vendor: [vendor] | Version: [version]\n\nFINDINGS BY CATEGORY:\n  Authentication: [pass\u002Ffail count]\n  Communication: [pass\u002Ffail count]\n  Web Security: [pass\u002Ffail count]\n  Hardening: [pass\u002Ffail count]\n\nCRITICAL FINDINGS:\n  1. [finding with remediation]\n\nCOMPLIANCE STATUS:\n  IEC 62443 SL-T: [target level]\n  IEC 62443 SL-A: [achieved level]\n```\n","# Performing SCADA HMI Security Assessment\n\n## When to Use\n\n- When assessing the security posture of HMI systems in SCADA\u002FDCS environments\n- When evaluating web-based HMI interfaces for common web vulnerabilities\n- When auditing HMI authentication, authorization, and session management\n- When testing communication security between HMIs and PLCs\u002FRTUs\n- When preparing for IEC 62443 or NERC CIP compliance assessments\n\n**Do not use** for testing HMIs in active production without a maintenance window and rollback plan, for PLC-level protocol analysis (see performing-s7comm-protocol-security-analysis), or for general web application testing on non-OT systems.\n\n## Prerequisites\n\n- HMI system inventory with vendor, version, and network configuration details\n- Lab or test environment mirroring production HMI setup (preferred for active testing)\n- Authorization from plant operations for testing during maintenance windows\n- NIST SP 800-82 and IEC 62443 security requirements documentation\n- Network capture capability on HMI-to-PLC communication segment\n\n## Workflow\n\n### Step 1: Assess HMI Attack Surface\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"SCADA HMI Security Assessment Tool.\n\nEvaluates HMI security across authentication, communication,\nconfiguration, and web interface categories aligned with\nIEC 62443 and NIST SP 800-82 requirements.\n\"\"\"\n\nimport json\nimport sys\nfrom datetime import datetime\nfrom typing import Dict, List\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass HMISecurityAssessment:\n    \"\"\"Performs security assessment of SCADA HMI systems.\"\"\"\n\n    def __init__(self, hmi_info: dict):\n        self.hmi_info = hmi_info\n        self.findings = []\n        self.checks_run = 0\n        self.checks_passed = 0\n\n    def check_authentication(self):\n        \"\"\"Assess HMI authentication mechanisms.\"\"\"\n        checks = [\n            {\n                \"id\": \"AUTH-01\",\n                \"name\": \"Password complexity enforcement\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.7\",\n                \"description\": \"HMI must enforce minimum password complexity requirements\",\n                \"test\": \"Verify minimum length >= 8, complexity rules, history >= 5\",\n            },\n            {\n                \"id\": \"AUTH-02\",\n                \"name\": \"Account lockout policy\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.11\",\n                \"description\": \"HMI must lock accounts after failed login attempts\",\n                \"test\": \"Verify lockout after 5 failed attempts, lockout duration >= 15 min\",\n            },\n            {\n                \"id\": \"AUTH-03\",\n                \"name\": \"Default credentials changed\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.5\",\n                \"description\": \"All default vendor credentials must be changed\",\n                \"test\": \"Attempt login with known vendor defaults (admin\u002Fadmin, operator\u002Foperator)\",\n            },\n            {\n                \"id\": \"AUTH-04\",\n                \"name\": \"Role-based access control\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 2.1\",\n                \"description\": \"HMI must separate operator, engineer, and admin roles\",\n                \"test\": \"Verify operator role cannot access engineering functions\",\n            },\n            {\n                \"id\": \"AUTH-05\",\n                \"name\": \"Session timeout enforcement\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.12\",\n                \"description\": \"HMI sessions must time out after inactivity\",\n                \"test\": \"Verify session timeout \u003C= 15 minutes for operator, \u003C= 5 for admin\",\n            },\n            {\n                \"id\": \"AUTH-06\",\n                \"name\": \"Multi-factor authentication for remote access\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.13\",\n                \"description\": \"Remote HMI access requires MFA\",\n                \"test\": \"Verify MFA is enforced for all non-local HMI connections\",\n            },\n        ]\n\n        print(f\"\\n--- AUTHENTICATION ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Ref: {check['iec62443_ref']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_communication_security(self):\n        \"\"\"Assess HMI-to-PLC communication security.\"\"\"\n        checks = [\n            {\n                \"id\": \"COMM-01\",\n                \"name\": \"Encrypted HMI-PLC communication\",\n                \"description\": \"Traffic between HMI and PLCs should use encrypted protocols (OPC UA with TLS)\",\n                \"test\": \"Capture HMI-PLC traffic and verify encryption (Wireshark TLS handshake)\",\n            },\n            {\n                \"id\": \"COMM-02\",\n                \"name\": \"HMI write command authentication\",\n                \"description\": \"Write commands from HMI to PLC should be authenticated\",\n                \"test\": \"Verify that write operations require operator confirmation\u002Fauthentication\",\n            },\n            {\n                \"id\": \"COMM-03\",\n                \"name\": \"Web HMI uses HTTPS\",\n                \"description\": \"Web-based HMI interfaces must use TLS 1.2+ with valid certificates\",\n                \"test\": \"Check TLS version, cipher suites, certificate validity\",\n            },\n            {\n                \"id\": \"COMM-04\",\n                \"name\": \"No cleartext protocols in use\",\n                \"description\": \"Telnet, FTP, HTTP must not be used for HMI access or management\",\n                \"test\": \"Port scan HMI for cleartext protocol services\",\n            },\n        ]\n\n        print(f\"\\n--- COMMUNICATION SECURITY ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_web_hmi_security(self):\n        \"\"\"Assess web-based HMI for common web vulnerabilities.\"\"\"\n        hmi_url = self.hmi_info.get(\"url\", \"\")\n        if not hmi_url:\n            print(f\"\\n  [SKIP] No web HMI URL provided\")\n            return\n\n        checks = [\n            {\n                \"id\": \"WEB-01\",\n                \"name\": \"Cross-Site Scripting (XSS)\",\n                \"owasp\": \"A7:2017\",\n                \"test\": \"Test input fields with XSS payloads in tag names, alarm messages\",\n            },\n            {\n                \"id\": \"WEB-02\",\n                \"name\": \"Cross-Site Request Forgery (CSRF)\",\n                \"owasp\": \"A8:2013\",\n                \"test\": \"Verify CSRF tokens on state-changing operations (setpoint changes)\",\n            },\n            {\n                \"id\": \"WEB-03\",\n                \"name\": \"Insecure Direct Object References\",\n                \"owasp\": \"A4:2013\",\n                \"test\": \"Manipulate URL parameters to access other users HMI views\",\n            },\n            {\n                \"id\": \"WEB-04\",\n                \"name\": \"Security Headers\",\n                \"test\": \"Verify X-Frame-Options, CSP, X-Content-Type-Options headers\",\n            },\n            {\n                \"id\": \"WEB-05\",\n                \"name\": \"Privileged file system access (CVE-2025-0921)\",\n                \"test\": \"Check Ignition SCADA for privileged file system vulnerability via project files\",\n            },\n        ]\n\n        print(f\"\\n--- WEB HMI SECURITY ASSESSMENT ---\")\n        print(f\"  Target: {hmi_url}\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_hardening(self):\n        \"\"\"Assess HMI operating system and application hardening.\"\"\"\n        checks = [\n            {\n                \"id\": \"HARD-01\",\n                \"name\": \"OS patch level\",\n                \"test\": \"Verify HMI OS is patched within SLA (typically 90 days for OT)\",\n            },\n            {\n                \"id\": \"HARD-02\",\n                \"name\": \"Unnecessary services disabled\",\n                \"test\": \"Verify no unnecessary network services running (RDP if not needed, SMB, etc)\",\n            },\n            {\n                \"id\": \"HARD-03\",\n                \"name\": \"USB port restrictions\",\n                \"test\": \"Verify USB mass storage is blocked on HMI terminals\",\n            },\n            {\n                \"id\": \"HARD-04\",\n                \"name\": \"Application whitelisting\",\n                \"test\": \"Verify only authorized HMI applications can execute\",\n            },\n            {\n                \"id\": \"HARD-05\",\n                \"name\": \"Audit logging enabled\",\n                \"test\": \"Verify operator actions, login events, and setpoint changes are logged\",\n            },\n        ]\n\n        print(f\"\\n--- HMI HARDENING ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def generate_report(self):\n        \"\"\"Generate assessment report.\"\"\"\n        self.check_authentication()\n        self.check_communication_security()\n        self.check_web_hmi_security()\n        self.check_hardening()\n\n        print(f\"\\n{'='*70}\")\n        print(\"SCADA HMI SECURITY ASSESSMENT SUMMARY\")\n        print(f\"{'='*70}\")\n        print(f\"Date: {datetime.now().isoformat()}\")\n        print(f\"HMI: {self.hmi_info.get('name', 'Unknown')}\")\n        print(f\"Vendor: {self.hmi_info.get('vendor', 'Unknown')}\")\n        print(f\"Version: {self.hmi_info.get('version', 'Unknown')}\")\n        print(f\"Total Checks: {self.checks_run}\")\n        print(f\"Findings: {len(self.findings)}\")\n\n\nif __name__ == \"__main__\":\n    assessment = HMISecurityAssessment(hmi_info={\n        \"name\": \"Plant-HMI-01\",\n        \"vendor\": \"Siemens WinCC\",\n        \"version\": \"7.5 SP2\",\n        \"ip\": \"10.10.2.10\",\n        \"url\": \"https:\u002F\u002F10.10.2.10:8080\",\n        \"os\": \"Windows 10 LTSC 2021\",\n    })\n    assessment.generate_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| HMI | Human-Machine Interface providing operators visual representation and control of industrial processes |\n| Web HMI | Browser-based HMI interface accessible via HTTP\u002FHTTPS, subject to standard web vulnerabilities |\n| Setpoint | Target value for a process variable that operators can change through the HMI; unauthorized changes can cause process upset |\n| Alarm Suppression | Attacker technique of disabling or hiding HMI alarms to mask malicious process manipulation |\n| WinCC | Siemens SCADA\u002FHMI software widely deployed in manufacturing and process industries |\n| CVE-2025-0921 | Ignition SCADA privileged file system vulnerability exploitable through malicious project uploads |\n\n## Output Format\n\n```\nHMI SECURITY ASSESSMENT REPORT\n=================================\nDate: YYYY-MM-DD\nHMI: [name] | Vendor: [vendor] | Version: [version]\n\nFINDINGS BY CATEGORY:\n  Authentication: [pass\u002Ffail count]\n  Communication: [pass\u002Ffail count]\n  Web Security: [pass\u002Ffail count]\n  Hardening: [pass\u002Ffail count]\n\nCRITICAL FINDINGS:\n  1. [finding with remediation]\n\nCOMPLIANCE STATUS:\n  IEC 62443 SL-T: [target level]\n  IEC 62443 SL-A: [achieved level]\n```\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"nist_csf":53,"subdomain":58,"description":59,"mitre_attack":60},[36,28,27,29,30,31,35,50],"nist-800-82","mahipal","1.0",[54,55,56,57],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security","Perform security assessments of SCADA Human-Machine Interface (HMI) systems to identify vulnerabilities in web-based HMIs, thin-client configurations, authentication mechanisms, and communication channels between HMI and PLCs, aligned with IEC 62443 and NIST SP 800-82 guidelines.\n",[61,62,63,64,65],"T1078","T1190","T1059","T0816","T0836","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-scada-hmi-security-assessment",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-scada-hmi-security-assessment",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-scada-hmi-security-assessment",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-scada-hmi-security-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-scada-hmi-security-assessment\u002FSKILL.md",true,[90,95,101],{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-scada-hmi-security-assessment\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",2601,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-scada-hmi-security-assessment\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",6908,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-scada-hmi-security-assessment\u002Fscripts\u002Fagent.py",[108,133,157,184,210,236],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[114],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118,119,26,43,120,121,41,122,123,124,125,126,127,128,129,130,131,132],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[139],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,129,142,143,26,144,43,41,145,146,147,148,149,150,151,152,153,154,155,156],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[163,166],{"categoryNo":164,"categoryName":165,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[151,168,169,170,171,43,172,173,145,174,175,176,177,178,179,34,180,181,182,183],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":191,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[190],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[192,193,194,43,195,196,197,198,199,200,201,202,203,204,205,206,148,207,208,209],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[216],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[218,219,220,43,221,222,223,224,225,226,227,228,229,230,231,31,232,233,234,235],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","api","prioritization","ssvc","decision-tree",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[242],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[26,244,43,245,246,247,248,249,37,250,251,34,252,180,253,254,255,256,257,258],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]