[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70FS485G8PEF021ESQJVV8E":3,"skill-same:01M70FS485G8PEF021ESQJVV8E":91},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":54,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M70FS485G8PEF021ESQJVV8E","iot-security-reviewer",null,"Expert IoT security review covering network security, authentication, encryption, secure boot, and attack surface analysis. Use when reviewing device security, implementing authentication, hardening firmware, conducting security audits, or analyzing embedded systems for vulnerabilities. Particularly valuable for ESP32\u002FRP2350 projects, BLE\u002FWiFi devices, MQTT systems, and mobile IoT applications.","shengdabai\u002FTony-Claude-Code-Skills","shengdabai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F116417419?v=4","01M70F6D2WY5PQV5A92BKYJQEW","Tony Sheng","01M70F6D3GAAAYZ5H4CC1G8VXM",3,"MIT","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fdot_claude\u002Fskills\u002Fiot-security-reviewer\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security reviewer","security","iot","reviewer","iot security reviewer","applications","devices","for","mqtt","mobile","secure","security review","encryption","embedded systems","implementing","authentication","expert","wifi","projects","secure boot","2026-11-10 10:12:30",false,"---\nname: iot-security-reviewer\ndescription: Expert IoT security review covering network security, authentication, encryption, secure boot, and attack surface analysis. Use when reviewing device security, implementing authentication, hardening firmware, conducting security audits, or analyzing embedded systems for vulnerabilities. Particularly valuable for ESP32\u002FRP2350 projects, BLE\u002FWiFi devices, MQTT systems, and mobile IoT applications.\n---\n\n# IoT Security Reviewer\n\n## Overview\n\nConduct comprehensive security reviews of IoT devices and embedded systems with focus on confidentiality, integrity, availability, authentication, and authorization. Apply industry best practices, OWASP IoT Top 10 guidelines, and platform-specific hardening techniques for ESP32, RP2350, Android, and MQTT-based systems.\n\n## When to Use This Skill\n\nTrigger this skill for:\n- Security audits of IoT firmware and embedded code\n- Implementing secure authentication mechanisms (BLE, MQTT, API)\n- Reviewing network security configurations (WiFi, TLS, certificates)\n- Analyzing secure boot, OTA updates, and firmware integrity\n- Hardening production deployments and removing vulnerabilities\n- Evaluating data protection (encryption at rest and in transit)\n- Conducting threat modeling and attack surface analysis\n- Reviewing Argus system components or similar IoT architectures\n\n## Security Review Workflow\n\n### 1. Initial Assessment\n\n**Understand the System:**\n- Identify all components (devices, gateways, apps, servers)\n- Map communication channels and protocols\n- Document trust boundaries and data flows\n- Catalog sensitive data and assets\n\n**Quick Security Scan:**\n- Check for hardcoded credentials in source code\n- Verify TLS\u002Fencryption is used for network communication\n- Confirm secure boot and flash encryption are enabled\n- Review authentication mechanisms\n- Identify exposed services and open ports\n\n### 2. Apply Security Checklist\n\nReference the comprehensive checklist in `references\u002Fsecurity_checklist.md` covering:\n\n**Confidentiality** - Data encryption, secure storage, log sanitization\n**Integrity** - Firmware signing, secure boot, message authentication\n**Availability** - DoS protection, resilience, monitoring\n**Authentication** - Device identity, user auth, network auth\n**Authorization** - Access control, privilege separation, RBAC\n**Network Security** - WiFi, MQTT, protocols, segmentation\n**Physical Security** - Debug interfaces, tamper detection\n**Compliance** - OWASP IoT Top 10, privacy regulations\n\nWork through each section systematically, checking off items as verified or identifying gaps.\n\n### 3. Vulnerability Analysis\n\n**Review Against OWASP IoT Top 10:**\n\nLoad `references\u002Fcommon_vulnerabilities.md` for detailed coverage of:\n1. Weak, guessable, or hardcoded passwords\n2. Insecure network services\n3. Insecure ecosystem interfaces\n4. Lack of secure update mechanism\n5. Use of insecure or outdated components\n6. Insufficient privacy protection\n7. Insecure data transfer and storage\n8. Lack of device management\n9. Insecure default settings\n10. Lack of physical hardening\n\n**Additional Vulnerability Classes:**\n- Side-channel attacks\n- Buffer overflow and memory corruption\n- Command injection\n- Replay attacks\n- Man-in-the-middle attacks\n- Denial of service\n\nFor each vulnerability category:\n- Check if the system is susceptible\n- Assess severity and exploitability\n- Recommend specific mitigations\n- Prioritize fixes based on risk\n\n### 4. Code Review and Implementation Guidance\n\n**Secure Implementation Examples:**\n\nWhen implementing security features or reviewing code, reference `references\u002Fsecure_examples.md` for proven patterns:\n\n- **WiFi Security**: NVS storage with encryption, flash encryption configuration\n- **MQTT TLS**: Certificate validation, mutual TLS, cipher suite selection\n- **BLE Security**: Secure Simple Pairing, bonding, passkey implementation\n- **OTA Updates**: Signature verification, secure boot integration, rollback protection\n- **API Keys**: Rotation strategies, secure storage, grace period handling\n\n**Code Review Focus Areas:**\n- Memory safety (bounds checking, zero after use)\n- Cryptographic implementation (use proven libraries)\n- Input validation (sanitization, length checks)\n- Error handling (secure failure, no info leakage)\n- Privilege separation (least privilege principle)\n\n### 5. Architecture-Specific Reviews\n\n**For Argus or Similar Systems:**\n\nLoad `references\u002Fargus_security.md` for system-specific guidance:\n\n- **Network segmentation**: VLAN configuration, firewall rules\n- **Trust model**: Multi-tier authentication and encryption\n- **Component security**: T-Embed (ESP32-S3), Presto (RP2350), Android app\n- **MQTT broker**: Mosquitto configuration, ACL, TLS setup\n- **Threat scenarios**: Specific attack vectors and mitigations\n- **Incident response**: Detection, response, recovery procedures\n\n**Apply to Your System:**\n- Adapt the trust model to your architecture\n- Customize ACL rules for your topic structure\n- Implement appropriate certificate pinning\n- Configure network segmentation\n- Define incident response procedures\n\n### 6. Testing and Validation\n\n**Static Analysis:**\n- Run cppcheck or clang-tidy on C\u002FC++ code\n- Use SonarQube for multi-language projects\n- Scan dependencies with OWASP Dependency-Check\n\n**Dynamic Testing:**\n- Test authentication bypass attempts\n- Verify certificate validation\n- Attempt replay attacks\n- Test rate limiting and DoS protection\n- Validate input sanitization\n\n**Network Analysis:**\n- Capture traffic with Wireshark\n- Verify all communication is encrypted\n- Check for certificate validation\n- Scan for open ports with nmap\n- Test for MITM vulnerabilities\n\n**Penetration Testing:**\n- Attempt to extract credentials from device\n- Test physical security (debug ports, JTAG)\n- Try firmware downgrade attacks\n- Test BLE pairing security\n- Attempt privilege escalation\n\n### 7. Documentation and Reporting\n\n**Security Report Structure:**\n1. **Executive Summary**: High-level findings and risk assessment\n2. **System Overview**: Components, architecture, data flows\n3. **Findings**: Vulnerabilities discovered with severity ratings\n4. **Recommendations**: Prioritized remediation steps\n5. **Compliance**: OWASP IoT Top 10 coverage, regulatory compliance\n6. **Testing Results**: Static analysis, penetration testing outcomes\n7. **Action Items**: Specific tasks with assignees and timelines\n\n**Risk Rating:**\n- **Critical**: Hardcoded credentials, no encryption, exposed debug ports\n- **High**: Weak authentication, missing OTA security, no input validation\n- **Medium**: Outdated libraries, verbose logging, weak cipher suites\n- **Low**: Missing monitoring, incomplete documentation, minor hardening\n\n## Security Implementation Guidelines\n\n### Quick Wins (Implement First)\n\n1. **Enable Flash Encryption** (ESP32)\n   ```c\n   #define CONFIG_SECURE_FLASH_ENC_ENABLED 1\n   ```\n\n2. **Enable Secure Boot**\n   ```c\n   #define CONFIG_SECURE_BOOT_V2_ENABLED 1\n   ```\n\n3. **Use TLS for All Network Communication**\n   - MQTT: Use mqtts:\u002F\u002F on port 8883\n   - HTTP: Use https:\u002F\u002F only\n   - Validate certificates, don't skip verification\n\n4. **Store Credentials Securely**\n   - Use encrypted NVS on ESP32\n   - Android Keystore for mobile apps\n   - Never hardcode in source code\n\n5. **Implement API Key Rotation**\n   - Generate strong, random keys\n   - Rotate every 90 days\n   - Support key grace period\n\n### Platform-Specific Hardening\n\n**ESP32\u002FESP32-S3:**\n- Enable flash encryption and secure boot\n- Disable JTAG and UART console in production\n- Use hardware RNG for key generation\n- Implement watchdog timer\n- Clear sensitive data from memory after use\n\n**RP2350 (MicroPython):**\n- Hash validation for uploaded scripts\n- Whitelist allowed modules\n- Restrict filesystem access\n- Secure BLE bonding storage\n- Disable dangerous built-ins in production\n\n**Android:**\n- Use Android Keystore for secrets\n- Implement certificate pinning\n- Enable ProGuard\u002FR8 obfuscation\n- Remove debug logs in release builds\n- Network security configuration with cleartext disabled\n\n**MQTT Broker:**\n- Require TLS on port 8883\n- Enforce client authentication\n- Implement topic-based ACL\n- Use strong cipher suites (TLS 1.2+)\n- Monitor failed authentication attempts\n\n### Defense in Depth Strategy\n\nApply multiple layers of security:\n\n1. **Network Layer**: TLS encryption, certificate validation, network segmentation\n2. **Application Layer**: Authentication, authorization, input validation\n3. **Device Layer**: Secure boot, flash encryption, physical hardening\n4. **Monitoring Layer**: Logging, anomaly detection, alerting\n5. **Operational Layer**: Update mechanism, incident response, key rotation\n\n## Using the References\n\n### Quick Reference Guide\n\n- **Conducting a security audit?** → Start with `references\u002Fsecurity_checklist.md`\n- **Reviewing for specific vulnerabilities?** → Use `references\u002Fcommon_vulnerabilities.md`\n- **Implementing secure features?** → Reference `references\u002Fsecure_examples.md`\n- **Reviewing Argus system?** → Load `references\u002Fargus_security.md`\n\n### Search Patterns for Large References\n\nIf reference files are extensive, use these grep patterns:\n\n```bash\n# Find specific vulnerability information\ngrep -i \"hardcoded\" references\u002Fcommon_vulnerabilities.md\n\n# Locate implementation examples\ngrep -B5 -A20 \"esp_mqtt_client_config_t\" references\u002Fsecure_examples.md\n\n# Find checklist items\ngrep \"\\[ \\]\" references\u002Fsecurity_checklist.md\n\n# Search for Argus-specific guidance\ngrep -i \"t-embed\\|presto\" references\u002Fargus_security.md\n```\n\n## Common Security Patterns\n\n### Secure By Default\n\n- Deny by default, allow explicitly\n- Fail securely (deny on error)\n- Minimum necessary privileges\n- Encrypted by default\n- Strong authentication required\n\n### Security Anti-Patterns to Avoid\n\n❌ Hardcoded credentials or API keys\n❌ Disabled certificate validation (\"to make it work\")\n❌ HTTP instead of HTTPS\n❌ Admin\u002Fadmin default credentials\n❌ Debug code left in production\n❌ Sensitive data in logs\n❌ Unsigned firmware updates\n❌ No input validation\n❌ Weak encryption (WEP, MD5, SHA1)\n❌ Exposed debug ports (JTAG, UART)\n\n### Security Best Practices\n\n✅ Use proven crypto libraries (mbedTLS, OpenSSL)\n✅ Validate all inputs (length, type, range)\n✅ Use constant-time comparisons for secrets\n✅ Zero sensitive data after use\n✅ Implement rate limiting\n✅ Log security events\n✅ Keep dependencies updated\n✅ Enable all security features\n✅ Regular security audits\n✅ Incident response plan\n\n## Tools and Techniques\n\n### Static Analysis\n- **cppcheck**: `cppcheck --enable=all src\u002F`\n- **clang-tidy**: `clang-tidy src\u002F*.cpp`\n- **SonarQube**: Multi-language code quality\n\n### Dependency Scanning\n- **OWASP Dependency-Check**: Identify vulnerable libraries\n- **npm audit** \u002F **pip-audit**: Language-specific scanners\n\n### Network Analysis\n- **Wireshark**: Packet capture and protocol analysis\n- **nmap**: Port scanning and service detection\n\n### Penetration Testing\n- **Metasploit**: Exploit framework\n- **Aircrack-ng**: WiFi security testing\n- **Burp Suite**: Web application testing\n\n## Output Format\n\nWhen completing a security review, provide:\n\n1. **Summary**: Overall security posture (Strong\u002FModerate\u002FWeak)\n2. **Critical Findings**: Issues requiring immediate attention\n3. **Compliance Status**: OWASP IoT Top 10 coverage\n4. **Recommendations**: Prioritized action items with code examples\n5. **Risk Assessment**: Likelihood and impact of identified vulnerabilities\n6. **Remediation Timeline**: Suggested timeline for fixes\n\nUse code examples from the references to demonstrate secure implementations for identified issues.\n\n## Continuous Security\n\nSecurity is not a one-time review but an ongoing process:\n\n- **Regular audits**: Quarterly security reviews\n- **Dependency updates**: Monitor and patch vulnerabilities\n- **Threat modeling**: Update as architecture evolves\n- **Penetration testing**: Annual third-party testing\n- **Incident response drills**: Test response procedures\n- **Security training**: Keep team updated on best practices\n\n---\n\nThis skill provides comprehensive IoT security review capabilities. Load the reference files as needed for detailed checklists, vulnerability information, implementation examples, and system-specific guidance.\n","# IoT Security Reviewer\n\n## Overview\n\nConduct comprehensive security reviews of IoT devices and embedded systems with focus on confidentiality, integrity, availability, authentication, and authorization. Apply industry best practices, OWASP IoT Top 10 guidelines, and platform-specific hardening techniques for ESP32, RP2350, Android, and MQTT-based systems.\n\n## When to Use This Skill\n\nTrigger this skill for:\n- Security audits of IoT firmware and embedded code\n- Implementing secure authentication mechanisms (BLE, MQTT, API)\n- Reviewing network security configurations (WiFi, TLS, certificates)\n- Analyzing secure boot, OTA updates, and firmware integrity\n- Hardening production deployments and removing vulnerabilities\n- Evaluating data protection (encryption at rest and in transit)\n- Conducting threat modeling and attack surface analysis\n- Reviewing Argus system components or similar IoT architectures\n\n## Security Review Workflow\n\n### 1. Initial Assessment\n\n**Understand the System:**\n- Identify all components (devices, gateways, apps, servers)\n- Map communication channels and protocols\n- Document trust boundaries and data flows\n- Catalog sensitive data and assets\n\n**Quick Security Scan:**\n- Check for hardcoded credentials in source code\n- Verify TLS\u002Fencryption is used for network communication\n- Confirm secure boot and flash encryption are enabled\n- Review authentication mechanisms\n- Identify exposed services and open ports\n\n### 2. Apply Security Checklist\n\nReference the comprehensive checklist in `references\u002Fsecurity_checklist.md` covering:\n\n**Confidentiality** - Data encryption, secure storage, log sanitization\n**Integrity** - Firmware signing, secure boot, message authentication\n**Availability** - DoS protection, resilience, monitoring\n**Authentication** - Device identity, user auth, network auth\n**Authorization** - Access control, privilege separation, RBAC\n**Network Security** - WiFi, MQTT, protocols, segmentation\n**Physical Security** - Debug interfaces, tamper detection\n**Compliance** - OWASP IoT Top 10, privacy regulations\n\nWork through each section systematically, checking off items as verified or identifying gaps.\n\n### 3. Vulnerability Analysis\n\n**Review Against OWASP IoT Top 10:**\n\nLoad `references\u002Fcommon_vulnerabilities.md` for detailed coverage of:\n1. Weak, guessable, or hardcoded passwords\n2. Insecure network services\n3. Insecure ecosystem interfaces\n4. Lack of secure update mechanism\n5. Use of insecure or outdated components\n6. Insufficient privacy protection\n7. Insecure data transfer and storage\n8. Lack of device management\n9. Insecure default settings\n10. Lack of physical hardening\n\n**Additional Vulnerability Classes:**\n- Side-channel attacks\n- Buffer overflow and memory corruption\n- Command injection\n- Replay attacks\n- Man-in-the-middle attacks\n- Denial of service\n\nFor each vulnerability category:\n- Check if the system is susceptible\n- Assess severity and exploitability\n- Recommend specific mitigations\n- Prioritize fixes based on risk\n\n### 4. Code Review and Implementation Guidance\n\n**Secure Implementation Examples:**\n\nWhen implementing security features or reviewing code, reference `references\u002Fsecure_examples.md` for proven patterns:\n\n- **WiFi Security**: NVS storage with encryption, flash encryption configuration\n- **MQTT TLS**: Certificate validation, mutual TLS, cipher suite selection\n- **BLE Security**: Secure Simple Pairing, bonding, passkey implementation\n- **OTA Updates**: Signature verification, secure boot integration, rollback protection\n- **API Keys**: Rotation strategies, secure storage, grace period handling\n\n**Code Review Focus Areas:**\n- Memory safety (bounds checking, zero after use)\n- Cryptographic implementation (use proven libraries)\n- Input validation (sanitization, length checks)\n- Error handling (secure failure, no info leakage)\n- Privilege separation (least privilege principle)\n\n### 5. Architecture-Specific Reviews\n\n**For Argus or Similar Systems:**\n\nLoad `references\u002Fargus_security.md` for system-specific guidance:\n\n- **Network segmentation**: VLAN configuration, firewall rules\n- **Trust model**: Multi-tier authentication and encryption\n- **Component security**: T-Embed (ESP32-S3), Presto (RP2350), Android app\n- **MQTT broker**: Mosquitto configuration, ACL, TLS setup\n- **Threat scenarios**: Specific attack vectors and mitigations\n- **Incident response**: Detection, response, recovery procedures\n\n**Apply to Your System:**\n- Adapt the trust model to your architecture\n- Customize ACL rules for your topic structure\n- Implement appropriate certificate pinning\n- Configure network segmentation\n- Define incident response procedures\n\n### 6. Testing and Validation\n\n**Static Analysis:**\n- Run cppcheck or clang-tidy on C\u002FC++ code\n- Use SonarQube for multi-language projects\n- Scan dependencies with OWASP Dependency-Check\n\n**Dynamic Testing:**\n- Test authentication bypass attempts\n- Verify certificate validation\n- Attempt replay attacks\n- Test rate limiting and DoS protection\n- Validate input sanitization\n\n**Network Analysis:**\n- Capture traffic with Wireshark\n- Verify all communication is encrypted\n- Check for certificate validation\n- Scan for open ports with nmap\n- Test for MITM vulnerabilities\n\n**Penetration Testing:**\n- Attempt to extract credentials from device\n- Test physical security (debug ports, JTAG)\n- Try firmware downgrade attacks\n- Test BLE pairing security\n- Attempt privilege escalation\n\n### 7. Documentation and Reporting\n\n**Security Report Structure:**\n1. **Executive Summary**: High-level findings and risk assessment\n2. **System Overview**: Components, architecture, data flows\n3. **Findings**: Vulnerabilities discovered with severity ratings\n4. **Recommendations**: Prioritized remediation steps\n5. **Compliance**: OWASP IoT Top 10 coverage, regulatory compliance\n6. **Testing Results**: Static analysis, penetration testing outcomes\n7. **Action Items**: Specific tasks with assignees and timelines\n\n**Risk Rating:**\n- **Critical**: Hardcoded credentials, no encryption, exposed debug ports\n- **High**: Weak authentication, missing OTA security, no input validation\n- **Medium**: Outdated libraries, verbose logging, weak cipher suites\n- **Low**: Missing monitoring, incomplete documentation, minor hardening\n\n## Security Implementation Guidelines\n\n### Quick Wins (Implement First)\n\n1. **Enable Flash Encryption** (ESP32)\n   ```c\n   #define CONFIG_SECURE_FLASH_ENC_ENABLED 1\n   ```\n\n2. **Enable Secure Boot**\n   ```c\n   #define CONFIG_SECURE_BOOT_V2_ENABLED 1\n   ```\n\n3. **Use TLS for All Network Communication**\n   - MQTT: Use mqtts:\u002F\u002F on port 8883\n   - HTTP: Use https:\u002F\u002F only\n   - Validate certificates, don't skip verification\n\n4. **Store Credentials Securely**\n   - Use encrypted NVS on ESP32\n   - Android Keystore for mobile apps\n   - Never hardcode in source code\n\n5. **Implement API Key Rotation**\n   - Generate strong, random keys\n   - Rotate every 90 days\n   - Support key grace period\n\n### Platform-Specific Hardening\n\n**ESP32\u002FESP32-S3:**\n- Enable flash encryption and secure boot\n- Disable JTAG and UART console in production\n- Use hardware RNG for key generation\n- Implement watchdog timer\n- Clear sensitive data from memory after use\n\n**RP2350 (MicroPython):**\n- Hash validation for uploaded scripts\n- Whitelist allowed modules\n- Restrict filesystem access\n- Secure BLE bonding storage\n- Disable dangerous built-ins in production\n\n**Android:**\n- Use Android Keystore for secrets\n- Implement certificate pinning\n- Enable ProGuard\u002FR8 obfuscation\n- Remove debug logs in release builds\n- Network security configuration with cleartext disabled\n\n**MQTT Broker:**\n- Require TLS on port 8883\n- Enforce client authentication\n- Implement topic-based ACL\n- Use strong cipher suites (TLS 1.2+)\n- Monitor failed authentication attempts\n\n### Defense in Depth Strategy\n\nApply multiple layers of security:\n\n1. **Network Layer**: TLS encryption, certificate validation, network segmentation\n2. **Application Layer**: Authentication, authorization, input validation\n3. **Device Layer**: Secure boot, flash encryption, physical hardening\n4. **Monitoring Layer**: Logging, anomaly detection, alerting\n5. **Operational Layer**: Update mechanism, incident response, key rotation\n\n## Using the References\n\n### Quick Reference Guide\n\n- **Conducting a security audit?** → Start with `references\u002Fsecurity_checklist.md`\n- **Reviewing for specific vulnerabilities?** → Use `references\u002Fcommon_vulnerabilities.md`\n- **Implementing secure features?** → Reference `references\u002Fsecure_examples.md`\n- **Reviewing Argus system?** → Load `references\u002Fargus_security.md`\n\n### Search Patterns for Large References\n\nIf reference files are extensive, use these grep patterns:\n\n```bash\n# Find specific vulnerability information\ngrep -i \"hardcoded\" references\u002Fcommon_vulnerabilities.md\n\n# Locate implementation examples\ngrep -B5 -A20 \"esp_mqtt_client_config_t\" references\u002Fsecure_examples.md\n\n# Find checklist items\ngrep \"\\[ \\]\" references\u002Fsecurity_checklist.md\n\n# Search for Argus-specific guidance\ngrep -i \"t-embed\\|presto\" references\u002Fargus_security.md\n```\n\n## Common Security Patterns\n\n### Secure By Default\n\n- Deny by default, allow explicitly\n- Fail securely (deny on error)\n- Minimum necessary privileges\n- Encrypted by default\n- Strong authentication required\n\n### Security Anti-Patterns to Avoid\n\n❌ Hardcoded credentials or API keys\n❌ Disabled certificate validation (\"to make it work\")\n❌ HTTP instead of HTTPS\n❌ Admin\u002Fadmin default credentials\n❌ Debug code left in production\n❌ Sensitive data in logs\n❌ Unsigned firmware updates\n❌ No input validation\n❌ Weak encryption (WEP, MD5, SHA1)\n❌ Exposed debug ports (JTAG, UART)\n\n### Security Best Practices\n\n✅ Use proven crypto libraries (mbedTLS, OpenSSL)\n✅ Validate all inputs (length, type, range)\n✅ Use constant-time comparisons for secrets\n✅ Zero sensitive data after use\n✅ Implement rate limiting\n✅ Log security events\n✅ Keep dependencies updated\n✅ Enable all security features\n✅ Regular security audits\n✅ Incident response plan\n\n## Tools and Techniques\n\n### Static Analysis\n- **cppcheck**: `cppcheck --enable=all src\u002F`\n- **clang-tidy**: `clang-tidy src\u002F*.cpp`\n- **SonarQube**: Multi-language code quality\n\n### Dependency Scanning\n- **OWASP Dependency-Check**: Identify vulnerable libraries\n- **npm audit** \u002F **pip-audit**: Language-specific scanners\n\n### Network Analysis\n- **Wireshark**: Packet capture and protocol analysis\n- **nmap**: Port scanning and service detection\n\n### Penetration Testing\n- **Metasploit**: Exploit framework\n- **Aircrack-ng**: WiFi security testing\n- **Burp Suite**: Web application testing\n\n## Output Format\n\nWhen completing a security review, provide:\n\n1. **Summary**: Overall security posture (Strong\u002FModerate\u002FWeak)\n2. **Critical Findings**: Issues requiring immediate attention\n3. **Compliance Status**: OWASP IoT Top 10 coverage\n4. **Recommendations**: Prioritized action items with code examples\n5. **Risk Assessment**: Likelihood and impact of identified vulnerabilities\n6. **Remediation Timeline**: Suggested timeline for fixes\n\nUse code examples from the references to demonstrate secure implementations for identified issues.\n\n## Continuous Security\n\nSecurity is not a one-time review but an ongoing process:\n\n- **Regular audits**: Quarterly security reviews\n- **Dependency updates**: Monitor and patch vulnerabilities\n- **Threat modeling**: Update as architecture evolves\n- **Penetration testing**: Annual third-party testing\n- **Incident response drills**: Test response procedures\n- **Security training**: Keep team updated on best practices\n\n---\n\nThis skill provides comprehensive IoT security review capabilities. Load the reference files as needed for detailed checklists, vulnerability information, implementation examples, and system-specific guidance.\n",{"name":5,"description":7},"main","7850740bd837adb32f0a109ab2af82482196c6f2","skills\u002F_collections\u002Fdot_claude\u002Fskills\u002Fiot-security-reviewer",1,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills","https:\u002F\u002Fzturnsgo.com","https:\u002F\u002Fgithub.com\u002Fshengdabai","https:\u002F\u002Fzturnsgo.com\u002F","AI × education creator — producer, not consumer. Taught 6,000+ learners; shipping learning tools & daily essays with Claude Code, practicing @xiaolai's way 🥋","2026-11-01 21:28:23",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add shengdabai\u002FTony-Claude-Code-Skills --skill iot-security-reviewer",{"tool":65,"command":66},"bunx","bunx skills add shengdabai\u002FTony-Claude-Code-Skills --skill iot-security-reviewer",{"tool":68,"command":69},"pnpm","pnpm dlx skills add shengdabai\u002FTony-Claude-Code-Skills --skill iot-security-reviewer","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fdot_claude\u002Fskills\u002Fiot-security-reviewer\u002FSKILL.md",true,[73,79,83,87],{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fargus_security.md","REFERENCE","参考文档",12371,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fdot_claude\u002Fskills\u002Fiot-security-reviewer\u002Freferences\u002Fargus_security.md",{"path":80,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fcommon_vulnerabilities.md",8461,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fdot_claude\u002Fskills\u002Fiot-security-reviewer\u002Freferences\u002Fcommon_vulnerabilities.md",{"path":84,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fsecure_examples.md",18096,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fdot_claude\u002Fskills\u002Fiot-security-reviewer\u002Freferences\u002Fsecure_examples.md",{"path":88,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fsecurity_checklist.md",6331,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fdot_claude\u002Fskills\u002Fiot-security-reviewer\u002Freferences\u002Fsecurity_checklist.md",[92,109,141,168,190,210],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":101,"publishedAt":44},"01M70P17DAD4C1C47NPH6A96EM","xiaolai-methodology","以李笑来(Li Xiaolai)的思考方式、方法论与表达风格,为用户做全方位 1-on-1 教练指导,覆盖创业、赚钱、投资、学习、自学、读书写作、用 AI、以及人生心态与自我管理。当用户提到 \"李笑来\"、\"笑来\"、\"笑来老师\"、\"扮演李笑来\"、\"找笑来聊聊\"、\"笑来怎么看\"、\"xiaolai\"、\"把时间当作朋友\"、\"通往财富自由之路\"、\"定投改变命运\"、\"韭菜的自我修养\"、\"自学是门手艺\"、\"让时间陪你慢慢变富\"、\"七年就是一辈子\"、\"元认知\"、\"活在未来\"、\"复利\u002F长期主义\"、\"践行\"、\"痴迷改进\"、\"个人商业模式\u002F出售时间\"、\"睡后收入\"、\"定投\"、\"财富自由\"、\"操作系统升级\"、\"最少必要知识\"、\"北极星提示词\"、\"用 AI 该怎么学\u002F思考\" 等任一触发词,或当用户带着关于创业\u002F赚钱\u002F投资\u002F学习\u002F职业\u002F重大人生决策的困惑、希望被人用笑来式的「逻辑 + 大白话 + 类比 + 重新定义 + 践行导向」来点醒和指导时,自动进入李笑来教练模式。","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fxiaolai-methodology\u002FSKILL.md",[98],{"categoryNo":99,"categoryName":100,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",[102,103,104,105,106,107,108],"methodology","xiaolai","xiaolai methodology","朋友","投资","writing","收入",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":121,"publishedAt":44},"01M70P13NB9YP7ACJR1S861CDS","zread","Produce and consume a wiki-style knowledge base for a code repository via the `zread` CLI and its on-disk output under `.\u002F.zread\u002Fwiki\u002F`. Use this skill whenever the user wants to understand, onboard onto, explore, summarize, map, or get an overview of an unfamiliar codebase; asks for architecture docs, a project wiki, a repo walkthrough, module\u002Fpackage explanations, or \"what does this repo do\"; wants to generate, regenerate, resume, browse, or serve code documentation locally; or mentions zread \u002F zread.ai directly. Also use it proactively before diving into a large unknown repo — if `.\u002F.zread\u002Fwiki\u002Fcurrent` exists, read the generated pages instead of crawling source file-by-file; if it doesn't, consider offering to run `zread generate`. The trigger is the intent (understand a codebase through generated docs), not the literal word \"zread\".","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fzread\u002FSKILL.md",[115,116],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":117,"categoryName":118,"taxonomyType":119,"taxonomyTypeDesc":120},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[111,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140],"knowledge","wiki","explore","walkthrough","project","get","knowledge base","run","generate","intent","cli","map","documentation","project wiki","disk","architecture","code","unknown","generated",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":151,"publishedAt":44},"01M70P10S4SWMZQ8BJAFBFDRW3","youtube","Launch the YouTube Creator Agent to auto-generate videos.\nUse when: user types \u002Fyoutube, wants to create YouTube videos,\ngenerate video content, or upload to YouTube.\nKeywords: youtube, video, 视频, 创作视频, 发布视频","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube\u002FSKILL.md",[147,148],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":149,"categoryName":150,"taxonomyType":119,"taxonomyTypeDesc":120},"01JBSEEDCAT000000000000036","内容创作者",[143,152,153,154,155,156,157,158,130,159,160,161,162,163,164,165,166,167],"user","content","视频","creator","generate video","videos","launch","video content","create","upload","when","use","auto","types","Video","创作",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":175,"publishedAt":44},"01M70P0YE95D8BACZCGV8BK90K","youtube-script-sync","Sync, update, or optimize Tony's GetNote knowledge base `Youtube视频逐字稿` by turning each parent recording or first-person idea note into an idempotent child note containing a directly recordable YouTube long-video or Shorts script. Use when the user says “更新\u002F同步\u002F优化 Youtube视频逐字稿知识库”, or says “更新\u002F同步\u002F优化该知识库” while this knowledge base is the active context.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube-script-sync\u002FSKILL.md",[174],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[176,177,143,178,179,166,180,181,182,183,184,185,186,187,128,188,162,163,122,189],"sync","script","youtube script sync","recording","shorts","first","base","person","update","active","child","optimize","idempotent","long",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":200,"publishedAt":44},"01M70P0WMV5XT0EEC0N445PW07","writing-skills","How to write SKILL.md files that trigger reliably and teach effectively. Use when creating, improving, or reviewing Claude Code skills.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-skills\u002FSKILL.md",[196,197,198,199],{"categoryNo":99,"categoryName":100,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":117,"categoryName":118,"taxonomyType":119,"taxonomyTypeDesc":120},{"categoryNo":149,"categoryName":150,"taxonomyType":119,"taxonomyTypeDesc":120},[201,107,202,203,204,205,138,162,163,206,207,208,209],"writing skills","how","teach","write skill","write","claude code skills","files","how to","trigger",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":218,"publishedAt":44},"01M70P0SJFR4YVJQBGMHKGSKXT","writing-rules","How to write .claude\u002Frules\u002F files that Claude actually follows. Use when creating, improving, or reviewing project rules.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-rules\u002FSKILL.md",[216,217],{"categoryNo":99,"categoryName":100,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":149,"categoryName":150,"taxonomyType":119,"taxonomyTypeDesc":120},[219,107,220,126,221,207,162,202,205,163,208],"Rules","writing rules","project rules"]