[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73EXND0YC5MXCSZ4FPYDX0E":3,"skill-same:01M73EXND0YC5MXCSZ4FPYDX0E":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":58,"ownerHtmlUrl":59,"ownerBlogUrl":60,"ownerDescription":61,"updatedAt":62,"install":63,"resources":76},"01M73EXND0YC5MXCSZ4FPYDX0E","performing-scada-hmi-security-assessment",null,"Perform security assessments of SCADA Human-Machine Interface (HMI) systems to identify vulnerabilities in web-based HMIs, thin-client configurations, authentication mechanisms, and communication channels between HMI and PLCs, aligned with IEC 62443 and NIST SP 800-82 guidelines.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-scada-hmi-security-assessment\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-scada-hmi-security-assessment\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: performing-scada-hmi-security-assessment\ndescription: 'Perform security assessments of SCADA Human-Machine Interface (HMI)\n  systems to identify vulnerabilities in web-based HMIs, thin-client configurations,\n  authentication mechanisms, and communication channels between HMI and PLCs, aligned\n  with IEC 62443 and NIST SP 800-82 guidelines.\n\n  '\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- scada\n- hmi\n- security-assessment\n- vulnerability\n- iec62443\n- nist-800-82\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T0816\n- T0836\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\nnote: \"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.\"\n---\n\n# Performing SCADA HMI Security Assessment\n\n## When to Use\n\n- When assessing the security posture of HMI systems in SCADA\u002FDCS environments\n- When evaluating web-based HMI interfaces for common web vulnerabilities\n- When auditing HMI authentication, authorization, and session management\n- When testing communication security between HMIs and PLCs\u002FRTUs\n- When preparing for IEC 62443 or NERC CIP compliance assessments\n\n**Do not use** for testing HMIs in active production without a maintenance window and rollback plan, for PLC-level protocol analysis (see performing-s7comm-protocol-security-analysis), or for general web application testing on non-OT systems.\n\n## Prerequisites\n\n- HMI system inventory with vendor, version, and network configuration details\n- Lab or test environment mirroring production HMI setup (preferred for active testing)\n- Authorization from plant operations for testing during maintenance windows\n- NIST SP 800-82 and IEC 62443 security requirements documentation\n- Network capture capability on HMI-to-PLC communication segment\n\n## Workflow\n\n### Step 1: Assess HMI Attack Surface\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"SCADA HMI Security Assessment Tool.\n\nEvaluates HMI security across authentication, communication,\nconfiguration, and web interface categories aligned with\nIEC 62443 and NIST SP 800-82 requirements.\n\"\"\"\n\nimport json\nimport sys\nfrom datetime import datetime\nfrom typing import Dict, List\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass HMISecurityAssessment:\n    \"\"\"Performs security assessment of SCADA HMI systems.\"\"\"\n\n    def __init__(self, hmi_info: dict):\n        self.hmi_info = hmi_info\n        self.findings = []\n        self.checks_run = 0\n        self.checks_passed = 0\n\n    def check_authentication(self):\n        \"\"\"Assess HMI authentication mechanisms.\"\"\"\n        checks = [\n            {\n                \"id\": \"AUTH-01\",\n                \"name\": \"Password complexity enforcement\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.7\",\n                \"description\": \"HMI must enforce minimum password complexity requirements\",\n                \"test\": \"Verify minimum length >= 8, complexity rules, history >= 5\",\n            },\n            {\n                \"id\": \"AUTH-02\",\n                \"name\": \"Account lockout policy\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.11\",\n                \"description\": \"HMI must lock accounts after failed login attempts\",\n                \"test\": \"Verify lockout after 5 failed attempts, lockout duration >= 15 min\",\n            },\n            {\n                \"id\": \"AUTH-03\",\n                \"name\": \"Default credentials changed\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.5\",\n                \"description\": \"All default vendor credentials must be changed\",\n                \"test\": \"Attempt login with known vendor defaults (admin\u002Fadmin, operator\u002Foperator)\",\n            },\n            {\n                \"id\": \"AUTH-04\",\n                \"name\": \"Role-based access control\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 2.1\",\n                \"description\": \"HMI must separate operator, engineer, and admin roles\",\n                \"test\": \"Verify operator role cannot access engineering functions\",\n            },\n            {\n                \"id\": \"AUTH-05\",\n                \"name\": \"Session timeout enforcement\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.12\",\n                \"description\": \"HMI sessions must time out after inactivity\",\n                \"test\": \"Verify session timeout \u003C= 15 minutes for operator, \u003C= 5 for admin\",\n            },\n            {\n                \"id\": \"AUTH-06\",\n                \"name\": \"Multi-factor authentication for remote access\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.13\",\n                \"description\": \"Remote HMI access requires MFA\",\n                \"test\": \"Verify MFA is enforced for all non-local HMI connections\",\n            },\n        ]\n\n        print(f\"\\n--- AUTHENTICATION ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Ref: {check['iec62443_ref']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_communication_security(self):\n        \"\"\"Assess HMI-to-PLC communication security.\"\"\"\n        checks = [\n            {\n                \"id\": \"COMM-01\",\n                \"name\": \"Encrypted HMI-PLC communication\",\n                \"description\": \"Traffic between HMI and PLCs should use encrypted protocols (OPC UA with TLS)\",\n                \"test\": \"Capture HMI-PLC traffic and verify encryption (Wireshark TLS handshake)\",\n            },\n            {\n                \"id\": \"COMM-02\",\n                \"name\": \"HMI write command authentication\",\n                \"description\": \"Write commands from HMI to PLC should be authenticated\",\n                \"test\": \"Verify that write operations require operator confirmation\u002Fauthentication\",\n            },\n            {\n                \"id\": \"COMM-03\",\n                \"name\": \"Web HMI uses HTTPS\",\n                \"description\": \"Web-based HMI interfaces must use TLS 1.2+ with valid certificates\",\n                \"test\": \"Check TLS version, cipher suites, certificate validity\",\n            },\n            {\n                \"id\": \"COMM-04\",\n                \"name\": \"No cleartext protocols in use\",\n                \"description\": \"Telnet, FTP, HTTP must not be used for HMI access or management\",\n                \"test\": \"Port scan HMI for cleartext protocol services\",\n            },\n        ]\n\n        print(f\"\\n--- COMMUNICATION SECURITY ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_web_hmi_security(self):\n        \"\"\"Assess web-based HMI for common web vulnerabilities.\"\"\"\n        hmi_url = self.hmi_info.get(\"url\", \"\")\n        if not hmi_url:\n            print(f\"\\n  [SKIP] No web HMI URL provided\")\n            return\n\n        checks = [\n            {\n                \"id\": \"WEB-01\",\n                \"name\": \"Cross-Site Scripting (XSS)\",\n                \"owasp\": \"A7:2017\",\n                \"test\": \"Test input fields with XSS payloads in tag names, alarm messages\",\n            },\n            {\n                \"id\": \"WEB-02\",\n                \"name\": \"Cross-Site Request Forgery (CSRF)\",\n                \"owasp\": \"A8:2013\",\n                \"test\": \"Verify CSRF tokens on state-changing operations (setpoint changes)\",\n            },\n            {\n                \"id\": \"WEB-03\",\n                \"name\": \"Insecure Direct Object References\",\n                \"owasp\": \"A4:2013\",\n                \"test\": \"Manipulate URL parameters to access other users HMI views\",\n            },\n            {\n                \"id\": \"WEB-04\",\n                \"name\": \"Security Headers\",\n                \"test\": \"Verify X-Frame-Options, CSP, X-Content-Type-Options headers\",\n            },\n            {\n                \"id\": \"WEB-05\",\n                \"name\": \"Privileged file system access (CVE-2025-0921)\",\n                \"test\": \"Check Ignition SCADA for privileged file system vulnerability via project files\",\n            },\n        ]\n\n        print(f\"\\n--- WEB HMI SECURITY ASSESSMENT ---\")\n        print(f\"  Target: {hmi_url}\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_hardening(self):\n        \"\"\"Assess HMI operating system and application hardening.\"\"\"\n        checks = [\n            {\n                \"id\": \"HARD-01\",\n                \"name\": \"OS patch level\",\n                \"test\": \"Verify HMI OS is patched within SLA (typically 90 days for OT)\",\n            },\n            {\n                \"id\": \"HARD-02\",\n                \"name\": \"Unnecessary services disabled\",\n                \"test\": \"Verify no unnecessary network services running (RDP if not needed, SMB, etc)\",\n            },\n            {\n                \"id\": \"HARD-03\",\n                \"name\": \"USB port restrictions\",\n                \"test\": \"Verify USB mass storage is blocked on HMI terminals\",\n            },\n            {\n                \"id\": \"HARD-04\",\n                \"name\": \"Application whitelisting\",\n                \"test\": \"Verify only authorized HMI applications can execute\",\n            },\n            {\n                \"id\": \"HARD-05\",\n                \"name\": \"Audit logging enabled\",\n                \"test\": \"Verify operator actions, login events, and setpoint changes are logged\",\n            },\n        ]\n\n        print(f\"\\n--- HMI HARDENING ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def generate_report(self):\n        \"\"\"Generate assessment report.\"\"\"\n        self.check_authentication()\n        self.check_communication_security()\n        self.check_web_hmi_security()\n        self.check_hardening()\n\n        print(f\"\\n{'='*70}\")\n        print(\"SCADA HMI SECURITY ASSESSMENT SUMMARY\")\n        print(f\"{'='*70}\")\n        print(f\"Date: {datetime.now().isoformat()}\")\n        print(f\"HMI: {self.hmi_info.get('name', 'Unknown')}\")\n        print(f\"Vendor: {self.hmi_info.get('vendor', 'Unknown')}\")\n        print(f\"Version: {self.hmi_info.get('version', 'Unknown')}\")\n        print(f\"Total Checks: {self.checks_run}\")\n        print(f\"Findings: {len(self.findings)}\")\n\n\nif __name__ == \"__main__\":\n    assessment = HMISecurityAssessment(hmi_info={\n        \"name\": \"Plant-HMI-01\",\n        \"vendor\": \"Siemens WinCC\",\n        \"version\": \"7.5 SP2\",\n        \"ip\": \"10.10.2.10\",\n        \"url\": \"https:\u002F\u002F10.10.2.10:8080\",\n        \"os\": \"Windows 10 LTSC 2021\",\n    })\n    assessment.generate_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| HMI | Human-Machine Interface providing operators visual representation and control of industrial processes |\n| Web HMI | Browser-based HMI interface accessible via HTTP\u002FHTTPS, subject to standard web vulnerabilities |\n| Setpoint | Target value for a process variable that operators can change through the HMI; unauthorized changes can cause process upset |\n| Alarm Suppression | Attacker technique of disabling or hiding HMI alarms to mask malicious process manipulation |\n| WinCC | Siemens SCADA\u002FHMI software widely deployed in manufacturing and process industries |\n| CVE-2025-0921 | Ignition SCADA privileged file system vulnerability exploitable through malicious project uploads |\n\n## Output Format\n\n```\nHMI SECURITY ASSESSMENT REPORT\n=================================\nDate: YYYY-MM-DD\nHMI: [name] | Vendor: [vendor] | Version: [version]\n\nFINDINGS BY CATEGORY:\n  Authentication: [pass\u002Ffail count]\n  Communication: [pass\u002Ffail count]\n  Web Security: [pass\u002Ffail count]\n  Hardening: [pass\u002Ffail count]\n\nCRITICAL FINDINGS:\n  1. [finding with remediation]\n\nCOMPLIANCE STATUS:\n  IEC 62443 SL-T: [target level]\n  IEC 62443 SL-A: [achieved level]\n```\n","# Performing SCADA HMI Security Assessment\n\n## When to Use\n\n- When assessing the security posture of HMI systems in SCADA\u002FDCS environments\n- When evaluating web-based HMI interfaces for common web vulnerabilities\n- When auditing HMI authentication, authorization, and session management\n- When testing communication security between HMIs and PLCs\u002FRTUs\n- When preparing for IEC 62443 or NERC CIP compliance assessments\n\n**Do not use** for testing HMIs in active production without a maintenance window and rollback plan, for PLC-level protocol analysis (see performing-s7comm-protocol-security-analysis), or for general web application testing on non-OT systems.\n\n## Prerequisites\n\n- HMI system inventory with vendor, version, and network configuration details\n- Lab or test environment mirroring production HMI setup (preferred for active testing)\n- Authorization from plant operations for testing during maintenance windows\n- NIST SP 800-82 and IEC 62443 security requirements documentation\n- Network capture capability on HMI-to-PLC communication segment\n\n## Workflow\n\n### Step 1: Assess HMI Attack Surface\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"SCADA HMI Security Assessment Tool.\n\nEvaluates HMI security across authentication, communication,\nconfiguration, and web interface categories aligned with\nIEC 62443 and NIST SP 800-82 requirements.\n\"\"\"\n\nimport json\nimport sys\nfrom datetime import datetime\nfrom typing import Dict, List\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass HMISecurityAssessment:\n    \"\"\"Performs security assessment of SCADA HMI systems.\"\"\"\n\n    def __init__(self, hmi_info: dict):\n        self.hmi_info = hmi_info\n        self.findings = []\n        self.checks_run = 0\n        self.checks_passed = 0\n\n    def check_authentication(self):\n        \"\"\"Assess HMI authentication mechanisms.\"\"\"\n        checks = [\n            {\n                \"id\": \"AUTH-01\",\n                \"name\": \"Password complexity enforcement\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.7\",\n                \"description\": \"HMI must enforce minimum password complexity requirements\",\n                \"test\": \"Verify minimum length >= 8, complexity rules, history >= 5\",\n            },\n            {\n                \"id\": \"AUTH-02\",\n                \"name\": \"Account lockout policy\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.11\",\n                \"description\": \"HMI must lock accounts after failed login attempts\",\n                \"test\": \"Verify lockout after 5 failed attempts, lockout duration >= 15 min\",\n            },\n            {\n                \"id\": \"AUTH-03\",\n                \"name\": \"Default credentials changed\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.5\",\n                \"description\": \"All default vendor credentials must be changed\",\n                \"test\": \"Attempt login with known vendor defaults (admin\u002Fadmin, operator\u002Foperator)\",\n            },\n            {\n                \"id\": \"AUTH-04\",\n                \"name\": \"Role-based access control\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 2.1\",\n                \"description\": \"HMI must separate operator, engineer, and admin roles\",\n                \"test\": \"Verify operator role cannot access engineering functions\",\n            },\n            {\n                \"id\": \"AUTH-05\",\n                \"name\": \"Session timeout enforcement\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.12\",\n                \"description\": \"HMI sessions must time out after inactivity\",\n                \"test\": \"Verify session timeout \u003C= 15 minutes for operator, \u003C= 5 for admin\",\n            },\n            {\n                \"id\": \"AUTH-06\",\n                \"name\": \"Multi-factor authentication for remote access\",\n                \"iec62443_ref\": \"ISA-62443-3-3 SR 1.13\",\n                \"description\": \"Remote HMI access requires MFA\",\n                \"test\": \"Verify MFA is enforced for all non-local HMI connections\",\n            },\n        ]\n\n        print(f\"\\n--- AUTHENTICATION ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Ref: {check['iec62443_ref']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_communication_security(self):\n        \"\"\"Assess HMI-to-PLC communication security.\"\"\"\n        checks = [\n            {\n                \"id\": \"COMM-01\",\n                \"name\": \"Encrypted HMI-PLC communication\",\n                \"description\": \"Traffic between HMI and PLCs should use encrypted protocols (OPC UA with TLS)\",\n                \"test\": \"Capture HMI-PLC traffic and verify encryption (Wireshark TLS handshake)\",\n            },\n            {\n                \"id\": \"COMM-02\",\n                \"name\": \"HMI write command authentication\",\n                \"description\": \"Write commands from HMI to PLC should be authenticated\",\n                \"test\": \"Verify that write operations require operator confirmation\u002Fauthentication\",\n            },\n            {\n                \"id\": \"COMM-03\",\n                \"name\": \"Web HMI uses HTTPS\",\n                \"description\": \"Web-based HMI interfaces must use TLS 1.2+ with valid certificates\",\n                \"test\": \"Check TLS version, cipher suites, certificate validity\",\n            },\n            {\n                \"id\": \"COMM-04\",\n                \"name\": \"No cleartext protocols in use\",\n                \"description\": \"Telnet, FTP, HTTP must not be used for HMI access or management\",\n                \"test\": \"Port scan HMI for cleartext protocol services\",\n            },\n        ]\n\n        print(f\"\\n--- COMMUNICATION SECURITY ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_web_hmi_security(self):\n        \"\"\"Assess web-based HMI for common web vulnerabilities.\"\"\"\n        hmi_url = self.hmi_info.get(\"url\", \"\")\n        if not hmi_url:\n            print(f\"\\n  [SKIP] No web HMI URL provided\")\n            return\n\n        checks = [\n            {\n                \"id\": \"WEB-01\",\n                \"name\": \"Cross-Site Scripting (XSS)\",\n                \"owasp\": \"A7:2017\",\n                \"test\": \"Test input fields with XSS payloads in tag names, alarm messages\",\n            },\n            {\n                \"id\": \"WEB-02\",\n                \"name\": \"Cross-Site Request Forgery (CSRF)\",\n                \"owasp\": \"A8:2013\",\n                \"test\": \"Verify CSRF tokens on state-changing operations (setpoint changes)\",\n            },\n            {\n                \"id\": \"WEB-03\",\n                \"name\": \"Insecure Direct Object References\",\n                \"owasp\": \"A4:2013\",\n                \"test\": \"Manipulate URL parameters to access other users HMI views\",\n            },\n            {\n                \"id\": \"WEB-04\",\n                \"name\": \"Security Headers\",\n                \"test\": \"Verify X-Frame-Options, CSP, X-Content-Type-Options headers\",\n            },\n            {\n                \"id\": \"WEB-05\",\n                \"name\": \"Privileged file system access (CVE-2025-0921)\",\n                \"test\": \"Check Ignition SCADA for privileged file system vulnerability via project files\",\n            },\n        ]\n\n        print(f\"\\n--- WEB HMI SECURITY ASSESSMENT ---\")\n        print(f\"  Target: {hmi_url}\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def check_hardening(self):\n        \"\"\"Assess HMI operating system and application hardening.\"\"\"\n        checks = [\n            {\n                \"id\": \"HARD-01\",\n                \"name\": \"OS patch level\",\n                \"test\": \"Verify HMI OS is patched within SLA (typically 90 days for OT)\",\n            },\n            {\n                \"id\": \"HARD-02\",\n                \"name\": \"Unnecessary services disabled\",\n                \"test\": \"Verify no unnecessary network services running (RDP if not needed, SMB, etc)\",\n            },\n            {\n                \"id\": \"HARD-03\",\n                \"name\": \"USB port restrictions\",\n                \"test\": \"Verify USB mass storage is blocked on HMI terminals\",\n            },\n            {\n                \"id\": \"HARD-04\",\n                \"name\": \"Application whitelisting\",\n                \"test\": \"Verify only authorized HMI applications can execute\",\n            },\n            {\n                \"id\": \"HARD-05\",\n                \"name\": \"Audit logging enabled\",\n                \"test\": \"Verify operator actions, login events, and setpoint changes are logged\",\n            },\n        ]\n\n        print(f\"\\n--- HMI HARDENING ASSESSMENT ---\")\n        for check in checks:\n            self.checks_run += 1\n            print(f\"  [{check['id']}] {check['name']}\")\n            print(f\"    Test: {check['test']}\")\n\n    def generate_report(self):\n        \"\"\"Generate assessment report.\"\"\"\n        self.check_authentication()\n        self.check_communication_security()\n        self.check_web_hmi_security()\n        self.check_hardening()\n\n        print(f\"\\n{'='*70}\")\n        print(\"SCADA HMI SECURITY ASSESSMENT SUMMARY\")\n        print(f\"{'='*70}\")\n        print(f\"Date: {datetime.now().isoformat()}\")\n        print(f\"HMI: {self.hmi_info.get('name', 'Unknown')}\")\n        print(f\"Vendor: {self.hmi_info.get('vendor', 'Unknown')}\")\n        print(f\"Version: {self.hmi_info.get('version', 'Unknown')}\")\n        print(f\"Total Checks: {self.checks_run}\")\n        print(f\"Findings: {len(self.findings)}\")\n\n\nif __name__ == \"__main__\":\n    assessment = HMISecurityAssessment(hmi_info={\n        \"name\": \"Plant-HMI-01\",\n        \"vendor\": \"Siemens WinCC\",\n        \"version\": \"7.5 SP2\",\n        \"ip\": \"10.10.2.10\",\n        \"url\": \"https:\u002F\u002F10.10.2.10:8080\",\n        \"os\": \"Windows 10 LTSC 2021\",\n    })\n    assessment.generate_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| HMI | Human-Machine Interface providing operators visual representation and control of industrial processes |\n| Web HMI | Browser-based HMI interface accessible via HTTP\u002FHTTPS, subject to standard web vulnerabilities |\n| Setpoint | Target value for a process variable that operators can change through the HMI; unauthorized changes can cause process upset |\n| Alarm Suppression | Attacker technique of disabling or hiding HMI alarms to mask malicious process manipulation |\n| WinCC | Siemens SCADA\u002FHMI software widely deployed in manufacturing and process industries |\n| CVE-2025-0921 | Ignition SCADA privileged file system vulnerability exploitable through malicious project uploads |\n\n## Output Format\n\n```\nHMI SECURITY ASSESSMENT REPORT\n=================================\nDate: YYYY-MM-DD\nHMI: [name] | Vendor: [vendor] | Version: [version]\n\nFINDINGS BY CATEGORY:\n  Authentication: [pass\u002Ffail count]\n  Communication: [pass\u002Ffail count]\n  Web Security: [pass\u002Ffail count]\n  Hardening: [pass\u002Ffail count]\n\nCRITICAL FINDINGS:\n  1. [finding with remediation]\n\nCOMPLIANCE STATUS:\n  IEC 62443 SL-T: [target level]\n  IEC 62443 SL-A: [achieved level]\n```\n",{"name":5,"note":25,"tags":26,"author":35,"domain":36,"source":37,"license":15,"version":38,"nist_csf":39,"subdomain":44,"description":45,"mitre_attack":46,"source_commit":52},"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.",[27,28,29,30,31,32,33,34],"ot-security","ics","scada","hmi","security-assessment","vulnerability","iec62443","nist-800-82","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0",[40,41,42,43],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security","Perform security assessments of SCADA Human-Machine Interface (HMI) systems to identify vulnerabilities in web-based HMIs, thin-client configurations, authentication mechanisms, and communication channels between HMI and PLCs, aligned with IEC 62443 and NIST SP 800-82 guidelines.\n",[47,48,49,50,51],"T1078","T1190","T1059","T0816","T0836","04450304b12645cb2b974ab96d28c0664758a88d","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fperforming-scada-hmi-security-assessment",2,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-13 13:15:29",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill performing-scada-hmi-security-assessment",{"tool":69,"command":70},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill performing-scada-hmi-security-assessment",{"tool":72,"command":73},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill performing-scada-hmi-security-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-scada-hmi-security-assessment\u002FSKILL.md",true,[77,81,87],{"path":78,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fapi-reference.md","REFERENCE","参考文档",2601,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-scada-hmi-security-assessment\u002Freferences\u002Fapi-reference.md",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"scripts\u002Fagent.py","SCRIPT","脚本",6908,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-scada-hmi-security-assessment\u002Fscripts\u002Fagent.py",[94,102,109,117,125,133],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":98,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":113,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":121,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":129,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":134,"name":135,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]