[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7B8TPNJA981ZC8G9CSAPRTM":3,"skill-same:01M7B8TPNJA981ZC8G9CSAPRTM":84},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":15,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":13,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":53,"install":54,"resources":67},"01M7B8TPNJA981ZC8G9CSAPRTM","performing-plc-firmware-security-analysis",null,"This skill covers analyzing Programmable Logic Controller (PLC) firmware for security vulnerabilities including hardcoded credentials, insecure update mechanisms, backdoor functions, memory corruption flaws, and undocumented debug interfaces. It addresses firmware extraction from common PLC platforms (Siemens S7, Allen-Bradley, Schneider Modicon), static analysis of firmware images, dynamic analysis in emulated environments, and comparison against known-good baselines to detect tampering.","vikasvardhanv\u002Fjerry_skills","vikasvardhanv","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F99010657?v=4","01M7B2B0VN78W7529RQX5BR6DZ","01M7B2B0WDNTXJHRK3QNPNWRP6",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fperforming-plc-firmware-security-analysis\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fperforming-plc-firmware-security-analysis\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: performing-plc-firmware-security-analysis\ndescription: 'This skill covers analyzing Programmable Logic Controller (PLC) firmware\n  for security vulnerabilities including hardcoded credentials, insecure update mechanisms,\n  backdoor functions, memory corruption flaws, and undocumented debug interfaces.\n  It addresses firmware extraction from common PLC platforms (Siemens S7, Allen-Bradley,\n  Schneider Modicon), static analysis of firmware images, dynamic analysis in emulated\n  environments, and comparison against known-good baselines to detect tampering.\n\n  '\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- scada\n- industrial-control\n- iec62443\n- firmware-analysis\n- plc-security\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1003\n- T1110\n---\n\n# Performing PLC Firmware Security Analysis\n\n## When to Use\n\n- When assessing PLC security as part of an IEC 62443 component security evaluation (IEC 62443-4-2)\n- When validating firmware integrity after a suspected compromise or supply chain attack\n- When evaluating the security of a new PLC platform before deployment in critical infrastructure\n- When performing vulnerability research on industrial control system devices in an authorized lab\n- When responding to an incident where PLC logic or firmware tampering is suspected\n\n**Do not use** on live production PLCs without explicit authorization and safety controls in place. Firmware extraction and analysis should be performed on lab devices or offline backups. Never upload PLC firmware to public analysis services. See performing-ics-penetration-testing for authorized live testing procedures.\n\n## Prerequisites\n\n- Isolated lab environment with the target PLC hardware or an emulated environment\n- PLC programming software for the target platform (Siemens TIA Portal, Rockwell Studio 5000, Schneider EcoStruxure)\n- Firmware extraction tools (binwalk, firmware-mod-kit, JTAG\u002FSWD debugger)\n- Static analysis tools (Ghidra, IDA Pro, Binary Ninja with ARM\u002FMIPS\u002FPowerPC support)\n- Understanding of PLC architecture (real-time OS, ladder logic execution, I\u002FO scanning)\n- Reference copy of known-good firmware for integrity comparison\n\n## Workflow\n\n### Step 1: Acquire PLC Firmware for Analysis\n\nExtract or obtain PLC firmware through authorized methods. This can be done by downloading from the vendor, extracting from a lab device, or obtaining from a project backup.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"PLC Firmware Acquisition and Integrity Verification.\n\nSupports firmware extraction from project files, network downloads,\nand binary image comparison against known-good baselines.\n\"\"\"\n\nimport hashlib\nimport json\nimport os\nimport struct\nimport sys\nimport zipfile\nfrom datetime import datetime\nfrom pathlib import Path\n\n\nclass PLCFirmwareAcquisition:\n    \"\"\"Handles PLC firmware acquisition from various sources.\"\"\"\n\n    def __init__(self, output_dir=\"firmware_analysis\"):\n        self.output_dir = Path(output_dir)\n        self.output_dir.mkdir(exist_ok=True)\n        self.manifest = {\n            \"acquisition_date\": datetime.now().isoformat(),\n            \"firmware_samples\": [],\n        }\n\n    def extract_from_siemens_project(self, project_path):\n        \"\"\"Extract firmware\u002Fprogram blocks from Siemens TIA Portal project.\n\n        TIA Portal projects (.ap16\u002F.ap17) are ZIP archives containing\n        XML-encoded PLC program blocks and system configuration.\n        \"\"\"\n        print(f\"[*] Analyzing Siemens project: {project_path}\")\n        results = {\"platform\": \"Siemens\", \"blocks\": []}\n\n        if zipfile.is_zipfile(project_path):\n            with zipfile.ZipFile(project_path, \"r\") as zf:\n                for info in zf.infolist():\n                    # Program blocks are stored as XML in specific paths\n                    if \"ProgramBlocks\" in info.filename or \"SystemBlocks\" in info.filename:\n                        block_data = zf.read(info.filename)\n                        block_hash = hashlib.sha256(block_data).hexdigest()\n\n                        block_path = self.output_dir \u002F info.filename.replace(\"\u002F\", \"_\")\n                        block_path.write_bytes(block_data)\n\n                        results[\"blocks\"].append({\n                            \"name\": info.filename,\n                            \"size\": info.file_size,\n                            \"sha256\": block_hash,\n                            \"extracted_to\": str(block_path),\n                        })\n                        print(f\"  [+] Extracted: {info.filename} ({info.file_size} bytes)\")\n\n        self.manifest[\"firmware_samples\"].append(results)\n        return results\n\n    def extract_from_rockwell_project(self, acd_path):\n        \"\"\"Extract program data from Rockwell Studio 5000 ACD file.\n\n        ACD files contain controller program, tags, and configuration.\n        \"\"\"\n        print(f\"[*] Analyzing Rockwell project: {acd_path}\")\n        results = {\"platform\": \"Rockwell\u002FAllen-Bradley\", \"blocks\": []}\n\n        with open(acd_path, \"rb\") as f:\n            header = f.read(256)\n            # ACD files have a specific signature\n            if b\"RSLogix\" in header or b\"Studio 5000\" in header:\n                f.seek(0)\n                full_data = f.read()\n                file_hash = hashlib.sha256(full_data).hexdigest()\n\n                results[\"blocks\"].append({\n                    \"name\": os.path.basename(acd_path),\n                    \"size\": len(full_data),\n                    \"sha256\": file_hash,\n                    \"header_signature\": header[:16].hex(),\n                })\n                print(f\"  [+] Project hash: {file_hash}\")\n\n        self.manifest[\"firmware_samples\"].append(results)\n        return results\n\n    def compute_firmware_hash(self, firmware_path):\n        \"\"\"Compute multiple hashes of a firmware image for integrity tracking.\"\"\"\n        data = Path(firmware_path).read_bytes()\n        return {\n            \"file\": str(firmware_path),\n            \"size\": len(data),\n            \"md5\": hashlib.md5(data).hexdigest(),\n            \"sha256\": hashlib.sha256(data).hexdigest(),\n            \"sha512\": hashlib.sha512(data).hexdigest(),\n        }\n\n    def compare_firmware_integrity(self, current_fw, baseline_fw):\n        \"\"\"Compare current firmware against known-good baseline.\"\"\"\n        current_hash = self.compute_firmware_hash(current_fw)\n        baseline_hash = self.compute_firmware_hash(baseline_fw)\n\n        match = current_hash[\"sha256\"] == baseline_hash[\"sha256\"]\n\n        result = {\n            \"comparison_date\": datetime.now().isoformat(),\n            \"current_firmware\": current_hash,\n            \"baseline_firmware\": baseline_hash,\n            \"integrity_match\": match,\n            \"verdict\": \"PASS - Firmware matches baseline\" if match else \"FAIL - Firmware modified!\",\n        }\n\n        if not match:\n            # Find the offset where files diverge\n            current_data = Path(current_fw).read_bytes()\n            baseline_data = Path(baseline_fw).read_bytes()\n            min_len = min(len(current_data), len(baseline_data))\n\n            first_diff = None\n            diff_count = 0\n            for i in range(min_len):\n                if current_data[i] != baseline_data[i]:\n                    if first_diff is None:\n                        first_diff = i\n                    diff_count += 1\n\n            result[\"first_difference_offset\"] = f\"0x{first_diff:08x}\" if first_diff else None\n            result[\"total_different_bytes\"] = diff_count\n            result[\"size_difference\"] = len(current_data) - len(baseline_data)\n\n        return result\n\n    def save_manifest(self):\n        \"\"\"Save acquisition manifest.\"\"\"\n        manifest_path = self.output_dir \u002F \"acquisition_manifest.json\"\n        with open(manifest_path, \"w\") as f:\n            json.dump(self.manifest, f, indent=2)\n        print(f\"\\n[*] Manifest saved: {manifest_path}\")\n\n\nif __name__ == \"__main__\":\n    acq = PLCFirmwareAcquisition()\n\n    if len(sys.argv) \u003C 2:\n        print(\"Usage:\")\n        print(\"  python process.py extract-siemens \u003Cproject.ap17>\")\n        print(\"  python process.py extract-rockwell \u003Cproject.acd>\")\n        print(\"  python process.py compare \u003Ccurrent.bin> \u003Cbaseline.bin>\")\n        sys.exit(1)\n\n    cmd = sys.argv[1]\n    if cmd == \"extract-siemens\" and len(sys.argv) > 2:\n        acq.extract_from_siemens_project(sys.argv[2])\n    elif cmd == \"extract-rockwell\" and len(sys.argv) > 2:\n        acq.extract_from_rockwell_project(sys.argv[2])\n    elif cmd == \"compare\" and len(sys.argv) > 3:\n        result = acq.compare_firmware_integrity(sys.argv[2], sys.argv[3])\n        print(json.dumps(result, indent=2))\n    else:\n        print(\"Invalid command\")\n        sys.exit(1)\n\n    acq.save_manifest()\n```\n\n### Step 2: Perform Static Analysis of Firmware Image\n\nUse binwalk for firmware unpacking and Ghidra for disassembly to identify security issues in the firmware binary.\n\n```bash\n# Step 2a: Unpack firmware image with binwalk\nbinwalk -e firmware.bin\n# Output: _firmware.bin.extracted\u002F\n\n# Identify firmware components\nbinwalk firmware.bin\n# Look for: file system images, compressed sections, bootloader, RTOS kernel\n\n# Extract strings for credential and configuration analysis\nstrings -n 8 firmware.bin > firmware_strings.txt\n\n# Search for hardcoded credentials\ngrep -iE \"(password|passwd|pwd|secret|key|credential|login|admin|root)\" firmware_strings.txt\n\n# Search for network configuration\ngrep -iE \"(http|ftp|telnet|ssh|snmp|modbus|192\\.168|10\\.|172\\.)\" firmware_strings.txt\n\n# Search for debug\u002Fbackdoor indicators\ngrep -iE \"(debug|backdoor|test_mode|factory|service_port|hidden)\" firmware_strings.txt\n\n# Search for cryptographic material\ngrep -iE \"(BEGIN RSA|BEGIN CERTIFICATE|AES|DES|private.key)\" firmware_strings.txt\n\n# Step 2b: Entropy analysis to detect encrypted\u002Fcompressed sections\nbinwalk -E firmware.bin\n# High entropy sections may contain encrypted payloads or compressed data\n\n# Step 2c: Analyze with Ghidra (headless mode)\nanalyzeHeadless \u002Ftmp\u002Fghidra_project PLC_FW \\\n  -import firmware.bin \\\n  -processor ARM:LE:32:Cortex \\\n  -postScript FindCryptoConstants.java \\\n  -postScript FindHardcodedStrings.java \\\n  -log \u002Ftmp\u002Fghidra_analysis.log\n```\n\n### Step 3: Analyze PLC Communication Stack Security\n\nExamine how the PLC handles industrial protocol requests, focusing on authentication bypass, buffer overflows in packet parsing, and command injection vulnerabilities.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"PLC Protocol Security Analyzer.\n\nTests PLC protocol implementation for common vulnerabilities\nincluding authentication bypass, malformed packet handling,\nand function code access control.\n\nWARNING: Only run against lab\u002Ftest PLCs, never production systems.\n\"\"\"\n\nimport socket\nimport struct\nimport sys\nimport time\nfrom dataclasses import dataclass\n\n\n@dataclass\nclass ProtocolTestResult:\n    test_name: str\n    target: str\n    protocol: str\n    result: str  # PASS, FAIL, ERROR\n    severity: str\n    detail: str\n\n\nclass ModbusSecurityTester:\n    \"\"\"Tests Modbus\u002FTCP implementation security.\"\"\"\n\n    def __init__(self, target_ip, target_port=502):\n        self.target = target_ip\n        self.port = target_port\n        self.results = []\n\n    def _send_modbus(self, unit_id, func_code, data=b\"\"):\n        \"\"\"Send a Modbus\u002FTCP request and return response.\"\"\"\n        # MBAP Header: transaction_id(2) + protocol_id(2) + length(2) + unit_id(1)\n        mbap = struct.pack(\">HHHB\", 0x0001, 0x0000, len(data) + 2, unit_id)\n        pdu = struct.pack(\"B\", func_code) + data\n\n        try:\n            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            sock.settimeout(5)\n            sock.connect((self.target, self.port))\n            sock.send(mbap + pdu)\n            response = sock.recv(1024)\n            sock.close()\n            return response\n        except Exception as e:\n            return None\n\n    def test_authentication_required(self):\n        \"\"\"Test if PLC requires authentication for read\u002Fwrite operations.\"\"\"\n        # Test unauthenticated read\n        read_data = struct.pack(\">HH\", 0, 10)  # Read 10 registers from address 0\n        response = self._send_modbus(1, 3, read_data)\n\n        if response and len(response) > 8 and response[7] != 0x83:\n            self.results.append(ProtocolTestResult(\n                test_name=\"Modbus Authentication - Read\",\n                target=self.target,\n                protocol=\"Modbus\u002FTCP\",\n                result=\"FAIL\",\n                severity=\"high\",\n                detail=\"PLC accepts unauthenticated Modbus read commands. No authentication required.\",\n            ))\n\n        # Test unauthenticated write\n        write_data = struct.pack(\">HH\", 100, 0)  # Write 0 to register 100\n        response = self._send_modbus(1, 6, write_data)\n\n        if response and len(response) > 8 and response[7] != 0x86:\n            self.results.append(ProtocolTestResult(\n                test_name=\"Modbus Authentication - Write\",\n                target=self.target,\n                protocol=\"Modbus\u002FTCP\",\n                result=\"FAIL\",\n                severity=\"critical\",\n                detail=\"PLC accepts unauthenticated Modbus WRITE commands. Any host can modify registers.\",\n            ))\n\n    def test_function_code_access_control(self):\n        \"\"\"Test if PLC restricts dangerous function codes.\"\"\"\n        dangerous_funcs = {\n            8: \"Diagnostics (can restart communications)\",\n            17: \"Report Slave ID (information disclosure)\",\n            43: \"Encapsulated Interface Transport (device identification)\",\n        }\n\n        for fc, desc in dangerous_funcs.items():\n            response = self._send_modbus(1, fc, b\"\\x00\\x00\")\n            if response and len(response) > 8:\n                error_code = response[7]\n                if error_code != (fc | 0x80):  # Not an exception response\n                    self.results.append(ProtocolTestResult(\n                        test_name=f\"Function Code Access - FC{fc}\",\n                        target=self.target,\n                        protocol=\"Modbus\u002FTCP\",\n                        result=\"FAIL\",\n                        severity=\"medium\",\n                        detail=f\"PLC responds to FC{fc} ({desc}) without access control\",\n                    ))\n\n    def test_invalid_unit_id(self):\n        \"\"\"Test PLC response to broadcast and invalid unit IDs.\"\"\"\n        # Broadcast (unit ID 0) - should be carefully handled\n        read_data = struct.pack(\">HH\", 0, 1)\n        response = self._send_modbus(0, 3, read_data)\n\n        if response and len(response) > 8 and response[7] != 0x83:\n            self.results.append(ProtocolTestResult(\n                test_name=\"Broadcast Unit ID Handling\",\n                target=self.target,\n                protocol=\"Modbus\u002FTCP\",\n                result=\"FAIL\",\n                severity=\"high\",\n                detail=\"PLC responds to broadcast unit ID 0. This enables broadcast write attacks.\",\n            ))\n\n    def test_malformed_packet_handling(self):\n        \"\"\"Test PLC resilience against malformed Modbus packets.\"\"\"\n        # Oversized length field\n        malformed = struct.pack(\">HHH\", 0x0001, 0x0000, 0xFFFF) + b\"\\x01\\x03\\x00\\x00\\x00\\x01\"\n        try:\n            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            sock.settimeout(5)\n            sock.connect((self.target, self.port))\n            sock.send(malformed)\n            time.sleep(1)\n\n            # Verify PLC is still responsive\n            read_data = struct.pack(\">HH\", 0, 1)\n            response = self._send_modbus(1, 3, read_data)\n            sock.close()\n\n            if response is None:\n                self.results.append(ProtocolTestResult(\n                    test_name=\"Malformed Packet - Oversized Length\",\n                    target=self.target,\n                    protocol=\"Modbus\u002FTCP\",\n                    result=\"FAIL\",\n                    severity=\"critical\",\n                    detail=\"PLC became unresponsive after receiving oversized length field. Possible DoS vulnerability.\",\n                ))\n            else:\n                self.results.append(ProtocolTestResult(\n                    test_name=\"Malformed Packet - Oversized Length\",\n                    target=self.target,\n                    protocol=\"Modbus\u002FTCP\",\n                    result=\"PASS\",\n                    severity=\"info\",\n                    detail=\"PLC correctly handles oversized length field without crashing\",\n                ))\n        except Exception as e:\n            pass\n\n    def run_all_tests(self):\n        \"\"\"Run all Modbus security tests.\"\"\"\n        print(f\"\\n{'='*60}\")\n        print(f\"PLC MODBUS SECURITY ANALYSIS - {self.target}:{self.port}\")\n        print(f\"{'='*60}\")\n\n        self.test_authentication_required()\n        self.test_function_code_access_control()\n        self.test_invalid_unit_id()\n        self.test_malformed_packet_handling()\n\n        for r in self.results:\n            icon = \"[FAIL]\" if r.result == \"FAIL\" else \"[PASS]\"\n            print(f\"\\n  {icon} {r.test_name}\")\n            print(f\"    Severity: {r.severity}\")\n            print(f\"    Detail: {r.detail}\")\n\n        return self.results\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(\"Usage: python plc_protocol_tester.py \u003Ctarget_plc_ip> [port]\")\n        print(\"WARNING: Only use against lab\u002Ftest PLCs!\")\n        sys.exit(1)\n\n    target = sys.argv[1]\n    port = int(sys.argv[2]) if len(sys.argv) > 2 else 502\n\n    tester = ModbusSecurityTester(target, port)\n    tester.run_all_tests()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| PLC Firmware | The embedded software running on a Programmable Logic Controller, including the real-time operating system, protocol stacks, and I\u002FO drivers |\n| Ladder Logic | Graphical programming language for PLCs that represents relay logic circuits, stored as program blocks in PLC memory |\n| Function Block | Reusable PLC programming element that encapsulates logic with defined inputs\u002Foutputs, can be analyzed for malicious modifications |\n| Firmware Integrity | Verification that PLC firmware has not been modified from the vendor-supplied or approved version using cryptographic hash comparison |\n| IEC 62443-4-2 | Component security requirements in the IEC 62443 standard, defining security capabilities required for IACS components including PLCs |\n| JTAG\u002FSWD | Hardware debug interfaces (Joint Test Action Group \u002F Serial Wire Debug) used for firmware extraction and low-level analysis |\n\n## Tools & Systems\n\n- **Binwalk**: Firmware analysis tool for scanning, extracting, and analyzing embedded firmware images\n- **Ghidra**: NSA-developed reverse engineering framework supporting ARM, MIPS, PowerPC architectures common in PLCs\n- **EMUX\u002FFIRMADYNE**: Firmware emulation frameworks for dynamic analysis of embedded device firmware\n- **PLCinject**: Research tool for analyzing PLC logic injection vulnerabilities (use only in authorized lab settings)\n- **OpenPLC**: Open-source PLC platform useful as a test target for security research\n\n## Output Format\n\n```\nPLC Firmware Security Analysis Report\n=======================================\nDevice: [PLC Model and Firmware Version]\nAnalysis Date: YYYY-MM-DD\nMethodology: Static + Dynamic Analysis\n\nFIRMWARE INTEGRITY:\n  SHA-256: [hash]\n  Baseline Match: [Yes\u002FNo]\n  Vendor Signature Valid: [Yes\u002FNo\u002FNot Signed]\n\nVULNERABILITIES FOUND:\n  [PLC-001] [Severity] [Title]\n    CWE: [CWE-ID]\n    Detail: [Technical description]\n    Impact: [Operational impact]\n    Remediation: [Fix or mitigation]\n```\n","# Performing PLC Firmware Security Analysis\n\n## When to Use\n\n- When assessing PLC security as part of an IEC 62443 component security evaluation (IEC 62443-4-2)\n- When validating firmware integrity after a suspected compromise or supply chain attack\n- When evaluating the security of a new PLC platform before deployment in critical infrastructure\n- When performing vulnerability research on industrial control system devices in an authorized lab\n- When responding to an incident where PLC logic or firmware tampering is suspected\n\n**Do not use** on live production PLCs without explicit authorization and safety controls in place. Firmware extraction and analysis should be performed on lab devices or offline backups. Never upload PLC firmware to public analysis services. See performing-ics-penetration-testing for authorized live testing procedures.\n\n## Prerequisites\n\n- Isolated lab environment with the target PLC hardware or an emulated environment\n- PLC programming software for the target platform (Siemens TIA Portal, Rockwell Studio 5000, Schneider EcoStruxure)\n- Firmware extraction tools (binwalk, firmware-mod-kit, JTAG\u002FSWD debugger)\n- Static analysis tools (Ghidra, IDA Pro, Binary Ninja with ARM\u002FMIPS\u002FPowerPC support)\n- Understanding of PLC architecture (real-time OS, ladder logic execution, I\u002FO scanning)\n- Reference copy of known-good firmware for integrity comparison\n\n## Workflow\n\n### Step 1: Acquire PLC Firmware for Analysis\n\nExtract or obtain PLC firmware through authorized methods. This can be done by downloading from the vendor, extracting from a lab device, or obtaining from a project backup.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"PLC Firmware Acquisition and Integrity Verification.\n\nSupports firmware extraction from project files, network downloads,\nand binary image comparison against known-good baselines.\n\"\"\"\n\nimport hashlib\nimport json\nimport os\nimport struct\nimport sys\nimport zipfile\nfrom datetime import datetime\nfrom pathlib import Path\n\n\nclass PLCFirmwareAcquisition:\n    \"\"\"Handles PLC firmware acquisition from various sources.\"\"\"\n\n    def __init__(self, output_dir=\"firmware_analysis\"):\n        self.output_dir = Path(output_dir)\n        self.output_dir.mkdir(exist_ok=True)\n        self.manifest = {\n            \"acquisition_date\": datetime.now().isoformat(),\n            \"firmware_samples\": [],\n        }\n\n    def extract_from_siemens_project(self, project_path):\n        \"\"\"Extract firmware\u002Fprogram blocks from Siemens TIA Portal project.\n\n        TIA Portal projects (.ap16\u002F.ap17) are ZIP archives containing\n        XML-encoded PLC program blocks and system configuration.\n        \"\"\"\n        print(f\"[*] Analyzing Siemens project: {project_path}\")\n        results = {\"platform\": \"Siemens\", \"blocks\": []}\n\n        if zipfile.is_zipfile(project_path):\n            with zipfile.ZipFile(project_path, \"r\") as zf:\n                for info in zf.infolist():\n                    # Program blocks are stored as XML in specific paths\n                    if \"ProgramBlocks\" in info.filename or \"SystemBlocks\" in info.filename:\n                        block_data = zf.read(info.filename)\n                        block_hash = hashlib.sha256(block_data).hexdigest()\n\n                        block_path = self.output_dir \u002F info.filename.replace(\"\u002F\", \"_\")\n                        block_path.write_bytes(block_data)\n\n                        results[\"blocks\"].append({\n                            \"name\": info.filename,\n                            \"size\": info.file_size,\n                            \"sha256\": block_hash,\n                            \"extracted_to\": str(block_path),\n                        })\n                        print(f\"  [+] Extracted: {info.filename} ({info.file_size} bytes)\")\n\n        self.manifest[\"firmware_samples\"].append(results)\n        return results\n\n    def extract_from_rockwell_project(self, acd_path):\n        \"\"\"Extract program data from Rockwell Studio 5000 ACD file.\n\n        ACD files contain controller program, tags, and configuration.\n        \"\"\"\n        print(f\"[*] Analyzing Rockwell project: {acd_path}\")\n        results = {\"platform\": \"Rockwell\u002FAllen-Bradley\", \"blocks\": []}\n\n        with open(acd_path, \"rb\") as f:\n            header = f.read(256)\n            # ACD files have a specific signature\n            if b\"RSLogix\" in header or b\"Studio 5000\" in header:\n                f.seek(0)\n                full_data = f.read()\n                file_hash = hashlib.sha256(full_data).hexdigest()\n\n                results[\"blocks\"].append({\n                    \"name\": os.path.basename(acd_path),\n                    \"size\": len(full_data),\n                    \"sha256\": file_hash,\n                    \"header_signature\": header[:16].hex(),\n                })\n                print(f\"  [+] Project hash: {file_hash}\")\n\n        self.manifest[\"firmware_samples\"].append(results)\n        return results\n\n    def compute_firmware_hash(self, firmware_path):\n        \"\"\"Compute multiple hashes of a firmware image for integrity tracking.\"\"\"\n        data = Path(firmware_path).read_bytes()\n        return {\n            \"file\": str(firmware_path),\n            \"size\": len(data),\n            \"md5\": hashlib.md5(data).hexdigest(),\n            \"sha256\": hashlib.sha256(data).hexdigest(),\n            \"sha512\": hashlib.sha512(data).hexdigest(),\n        }\n\n    def compare_firmware_integrity(self, current_fw, baseline_fw):\n        \"\"\"Compare current firmware against known-good baseline.\"\"\"\n        current_hash = self.compute_firmware_hash(current_fw)\n        baseline_hash = self.compute_firmware_hash(baseline_fw)\n\n        match = current_hash[\"sha256\"] == baseline_hash[\"sha256\"]\n\n        result = {\n            \"comparison_date\": datetime.now().isoformat(),\n            \"current_firmware\": current_hash,\n            \"baseline_firmware\": baseline_hash,\n            \"integrity_match\": match,\n            \"verdict\": \"PASS - Firmware matches baseline\" if match else \"FAIL - Firmware modified!\",\n        }\n\n        if not match:\n            # Find the offset where files diverge\n            current_data = Path(current_fw).read_bytes()\n            baseline_data = Path(baseline_fw).read_bytes()\n            min_len = min(len(current_data), len(baseline_data))\n\n            first_diff = None\n            diff_count = 0\n            for i in range(min_len):\n                if current_data[i] != baseline_data[i]:\n                    if first_diff is None:\n                        first_diff = i\n                    diff_count += 1\n\n            result[\"first_difference_offset\"] = f\"0x{first_diff:08x}\" if first_diff else None\n            result[\"total_different_bytes\"] = diff_count\n            result[\"size_difference\"] = len(current_data) - len(baseline_data)\n\n        return result\n\n    def save_manifest(self):\n        \"\"\"Save acquisition manifest.\"\"\"\n        manifest_path = self.output_dir \u002F \"acquisition_manifest.json\"\n        with open(manifest_path, \"w\") as f:\n            json.dump(self.manifest, f, indent=2)\n        print(f\"\\n[*] Manifest saved: {manifest_path}\")\n\n\nif __name__ == \"__main__\":\n    acq = PLCFirmwareAcquisition()\n\n    if len(sys.argv) \u003C 2:\n        print(\"Usage:\")\n        print(\"  python process.py extract-siemens \u003Cproject.ap17>\")\n        print(\"  python process.py extract-rockwell \u003Cproject.acd>\")\n        print(\"  python process.py compare \u003Ccurrent.bin> \u003Cbaseline.bin>\")\n        sys.exit(1)\n\n    cmd = sys.argv[1]\n    if cmd == \"extract-siemens\" and len(sys.argv) > 2:\n        acq.extract_from_siemens_project(sys.argv[2])\n    elif cmd == \"extract-rockwell\" and len(sys.argv) > 2:\n        acq.extract_from_rockwell_project(sys.argv[2])\n    elif cmd == \"compare\" and len(sys.argv) > 3:\n        result = acq.compare_firmware_integrity(sys.argv[2], sys.argv[3])\n        print(json.dumps(result, indent=2))\n    else:\n        print(\"Invalid command\")\n        sys.exit(1)\n\n    acq.save_manifest()\n```\n\n### Step 2: Perform Static Analysis of Firmware Image\n\nUse binwalk for firmware unpacking and Ghidra for disassembly to identify security issues in the firmware binary.\n\n```bash\n# Step 2a: Unpack firmware image with binwalk\nbinwalk -e firmware.bin\n# Output: _firmware.bin.extracted\u002F\n\n# Identify firmware components\nbinwalk firmware.bin\n# Look for: file system images, compressed sections, bootloader, RTOS kernel\n\n# Extract strings for credential and configuration analysis\nstrings -n 8 firmware.bin > firmware_strings.txt\n\n# Search for hardcoded credentials\ngrep -iE \"(password|passwd|pwd|secret|key|credential|login|admin|root)\" firmware_strings.txt\n\n# Search for network configuration\ngrep -iE \"(http|ftp|telnet|ssh|snmp|modbus|192\\.168|10\\.|172\\.)\" firmware_strings.txt\n\n# Search for debug\u002Fbackdoor indicators\ngrep -iE \"(debug|backdoor|test_mode|factory|service_port|hidden)\" firmware_strings.txt\n\n# Search for cryptographic material\ngrep -iE \"(BEGIN RSA|BEGIN CERTIFICATE|AES|DES|private.key)\" firmware_strings.txt\n\n# Step 2b: Entropy analysis to detect encrypted\u002Fcompressed sections\nbinwalk -E firmware.bin\n# High entropy sections may contain encrypted payloads or compressed data\n\n# Step 2c: Analyze with Ghidra (headless mode)\nanalyzeHeadless \u002Ftmp\u002Fghidra_project PLC_FW \\\n  -import firmware.bin \\\n  -processor ARM:LE:32:Cortex \\\n  -postScript FindCryptoConstants.java \\\n  -postScript FindHardcodedStrings.java \\\n  -log \u002Ftmp\u002Fghidra_analysis.log\n```\n\n### Step 3: Analyze PLC Communication Stack Security\n\nExamine how the PLC handles industrial protocol requests, focusing on authentication bypass, buffer overflows in packet parsing, and command injection vulnerabilities.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"PLC Protocol Security Analyzer.\n\nTests PLC protocol implementation for common vulnerabilities\nincluding authentication bypass, malformed packet handling,\nand function code access control.\n\nWARNING: Only run against lab\u002Ftest PLCs, never production systems.\n\"\"\"\n\nimport socket\nimport struct\nimport sys\nimport time\nfrom dataclasses import dataclass\n\n\n@dataclass\nclass ProtocolTestResult:\n    test_name: str\n    target: str\n    protocol: str\n    result: str  # PASS, FAIL, ERROR\n    severity: str\n    detail: str\n\n\nclass ModbusSecurityTester:\n    \"\"\"Tests Modbus\u002FTCP implementation security.\"\"\"\n\n    def __init__(self, target_ip, target_port=502):\n        self.target = target_ip\n        self.port = target_port\n        self.results = []\n\n    def _send_modbus(self, unit_id, func_code, data=b\"\"):\n        \"\"\"Send a Modbus\u002FTCP request and return response.\"\"\"\n        # MBAP Header: transaction_id(2) + protocol_id(2) + length(2) + unit_id(1)\n        mbap = struct.pack(\">HHHB\", 0x0001, 0x0000, len(data) + 2, unit_id)\n        pdu = struct.pack(\"B\", func_code) + data\n\n        try:\n            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            sock.settimeout(5)\n            sock.connect((self.target, self.port))\n            sock.send(mbap + pdu)\n            response = sock.recv(1024)\n            sock.close()\n            return response\n        except Exception as e:\n            return None\n\n    def test_authentication_required(self):\n        \"\"\"Test if PLC requires authentication for read\u002Fwrite operations.\"\"\"\n        # Test unauthenticated read\n        read_data = struct.pack(\">HH\", 0, 10)  # Read 10 registers from address 0\n        response = self._send_modbus(1, 3, read_data)\n\n        if response and len(response) > 8 and response[7] != 0x83:\n            self.results.append(ProtocolTestResult(\n                test_name=\"Modbus Authentication - Read\",\n                target=self.target,\n                protocol=\"Modbus\u002FTCP\",\n                result=\"FAIL\",\n                severity=\"high\",\n                detail=\"PLC accepts unauthenticated Modbus read commands. No authentication required.\",\n            ))\n\n        # Test unauthenticated write\n        write_data = struct.pack(\">HH\", 100, 0)  # Write 0 to register 100\n        response = self._send_modbus(1, 6, write_data)\n\n        if response and len(response) > 8 and response[7] != 0x86:\n            self.results.append(ProtocolTestResult(\n                test_name=\"Modbus Authentication - Write\",\n                target=self.target,\n                protocol=\"Modbus\u002FTCP\",\n                result=\"FAIL\",\n                severity=\"critical\",\n                detail=\"PLC accepts unauthenticated Modbus WRITE commands. Any host can modify registers.\",\n            ))\n\n    def test_function_code_access_control(self):\n        \"\"\"Test if PLC restricts dangerous function codes.\"\"\"\n        dangerous_funcs = {\n            8: \"Diagnostics (can restart communications)\",\n            17: \"Report Slave ID (information disclosure)\",\n            43: \"Encapsulated Interface Transport (device identification)\",\n        }\n\n        for fc, desc in dangerous_funcs.items():\n            response = self._send_modbus(1, fc, b\"\\x00\\x00\")\n            if response and len(response) > 8:\n                error_code = response[7]\n                if error_code != (fc | 0x80):  # Not an exception response\n                    self.results.append(ProtocolTestResult(\n                        test_name=f\"Function Code Access - FC{fc}\",\n                        target=self.target,\n                        protocol=\"Modbus\u002FTCP\",\n                        result=\"FAIL\",\n                        severity=\"medium\",\n                        detail=f\"PLC responds to FC{fc} ({desc}) without access control\",\n                    ))\n\n    def test_invalid_unit_id(self):\n        \"\"\"Test PLC response to broadcast and invalid unit IDs.\"\"\"\n        # Broadcast (unit ID 0) - should be carefully handled\n        read_data = struct.pack(\">HH\", 0, 1)\n        response = self._send_modbus(0, 3, read_data)\n\n        if response and len(response) > 8 and response[7] != 0x83:\n            self.results.append(ProtocolTestResult(\n                test_name=\"Broadcast Unit ID Handling\",\n                target=self.target,\n                protocol=\"Modbus\u002FTCP\",\n                result=\"FAIL\",\n                severity=\"high\",\n                detail=\"PLC responds to broadcast unit ID 0. This enables broadcast write attacks.\",\n            ))\n\n    def test_malformed_packet_handling(self):\n        \"\"\"Test PLC resilience against malformed Modbus packets.\"\"\"\n        # Oversized length field\n        malformed = struct.pack(\">HHH\", 0x0001, 0x0000, 0xFFFF) + b\"\\x01\\x03\\x00\\x00\\x00\\x01\"\n        try:\n            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            sock.settimeout(5)\n            sock.connect((self.target, self.port))\n            sock.send(malformed)\n            time.sleep(1)\n\n            # Verify PLC is still responsive\n            read_data = struct.pack(\">HH\", 0, 1)\n            response = self._send_modbus(1, 3, read_data)\n            sock.close()\n\n            if response is None:\n                self.results.append(ProtocolTestResult(\n                    test_name=\"Malformed Packet - Oversized Length\",\n                    target=self.target,\n                    protocol=\"Modbus\u002FTCP\",\n                    result=\"FAIL\",\n                    severity=\"critical\",\n                    detail=\"PLC became unresponsive after receiving oversized length field. Possible DoS vulnerability.\",\n                ))\n            else:\n                self.results.append(ProtocolTestResult(\n                    test_name=\"Malformed Packet - Oversized Length\",\n                    target=self.target,\n                    protocol=\"Modbus\u002FTCP\",\n                    result=\"PASS\",\n                    severity=\"info\",\n                    detail=\"PLC correctly handles oversized length field without crashing\",\n                ))\n        except Exception as e:\n            pass\n\n    def run_all_tests(self):\n        \"\"\"Run all Modbus security tests.\"\"\"\n        print(f\"\\n{'='*60}\")\n        print(f\"PLC MODBUS SECURITY ANALYSIS - {self.target}:{self.port}\")\n        print(f\"{'='*60}\")\n\n        self.test_authentication_required()\n        self.test_function_code_access_control()\n        self.test_invalid_unit_id()\n        self.test_malformed_packet_handling()\n\n        for r in self.results:\n            icon = \"[FAIL]\" if r.result == \"FAIL\" else \"[PASS]\"\n            print(f\"\\n  {icon} {r.test_name}\")\n            print(f\"    Severity: {r.severity}\")\n            print(f\"    Detail: {r.detail}\")\n\n        return self.results\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(\"Usage: python plc_protocol_tester.py \u003Ctarget_plc_ip> [port]\")\n        print(\"WARNING: Only use against lab\u002Ftest PLCs!\")\n        sys.exit(1)\n\n    target = sys.argv[1]\n    port = int(sys.argv[2]) if len(sys.argv) > 2 else 502\n\n    tester = ModbusSecurityTester(target, port)\n    tester.run_all_tests()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| PLC Firmware | The embedded software running on a Programmable Logic Controller, including the real-time operating system, protocol stacks, and I\u002FO drivers |\n| Ladder Logic | Graphical programming language for PLCs that represents relay logic circuits, stored as program blocks in PLC memory |\n| Function Block | Reusable PLC programming element that encapsulates logic with defined inputs\u002Foutputs, can be analyzed for malicious modifications |\n| Firmware Integrity | Verification that PLC firmware has not been modified from the vendor-supplied or approved version using cryptographic hash comparison |\n| IEC 62443-4-2 | Component security requirements in the IEC 62443 standard, defining security capabilities required for IACS components including PLCs |\n| JTAG\u002FSWD | Hardware debug interfaces (Joint Test Action Group \u002F Serial Wire Debug) used for firmware extraction and low-level analysis |\n\n## Tools & Systems\n\n- **Binwalk**: Firmware analysis tool for scanning, extracting, and analyzing embedded firmware images\n- **Ghidra**: NSA-developed reverse engineering framework supporting ARM, MIPS, PowerPC architectures common in PLCs\n- **EMUX\u002FFIRMADYNE**: Firmware emulation frameworks for dynamic analysis of embedded device firmware\n- **PLCinject**: Research tool for analyzing PLC logic injection vulnerabilities (use only in authorized lab settings)\n- **OpenPLC**: Open-source PLC platform useful as a test target for security research\n\n## Output Format\n\n```\nPLC Firmware Security Analysis Report\n=======================================\nDevice: [PLC Model and Firmware Version]\nAnalysis Date: YYYY-MM-DD\nMethodology: Static + Dynamic Analysis\n\nFIRMWARE INTEGRITY:\n  SHA-256: [hash]\n  Baseline Match: [Yes\u002FNo]\n  Vendor Signature Valid: [Yes\u002FNo\u002FNot Signed]\n\nVULNERABILITIES FOUND:\n  [PLC-001] [Severity] [Title]\n    CWE: [CWE-ID]\n    Detail: [Technical description]\n    Impact: [Operational impact]\n    Remediation: [Fix or mitigation]\n```\n",{"name":5,"tags":24,"author":32,"domain":33,"license":14,"version":34,"nist_csf":35,"subdomain":40,"description":41,"mitre_attack":42},[25,26,27,28,29,30,31],"ot-security","ics","scada","industrial-control","iec62443","firmware-analysis","plc-security","mahipal","cybersecurity","1.0.0",[36,37,38,39],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security","This skill covers analyzing Programmable Logic Controller (PLC) firmware for security vulnerabilities including hardcoded credentials, insecure update mechanisms, backdoor functions, memory corruption flaws, and undocumented debug interfaces. It addresses firmware extraction from common PLC platforms (Siemens S7, Allen-Bradley, Schneider Modicon), static analysis of firmware images, dynamic analysis in emulated environments, and comparison against known-good baselines to detect tampering.\n",[43,44,45,46,47],"T1078","T1190","T1059","T1003","T1110","main","1eb986d0b0ecc180291597e08eb5a58288843536","skills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fperforming-plc-firmware-security-analysis","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv","2026-08-25 13:16:33",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add vikasvardhanv\u002Fjerry_skills --skill performing-plc-firmware-security-analysis",{"tool":60,"command":61},"bunx","bunx skills add vikasvardhanv\u002Fjerry_skills --skill performing-plc-firmware-security-analysis",{"tool":63,"command":64},"pnpm","pnpm dlx skills add vikasvardhanv\u002Fjerry_skills --skill performing-plc-firmware-security-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fperforming-plc-firmware-security-analysis\u002FSKILL.md",true,[68,72,78],{"path":69,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":15},"LICENSE","许可证",11255,{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Fapi-reference.md","REFERENCE","参考文档",1760,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fperforming-plc-firmware-security-analysis\u002Freferences\u002Fapi-reference.md",{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"scripts\u002Fagent.py","SCRIPT","脚本",7482,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fperforming-plc-firmware-security-analysis\u002Fscripts\u002Fagent.py",[85,93,100,107,114,121],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7BESR1CJ3H5SP9XM8KYJZ9W","syllabus","Generates a curated supplementary reading list from any course syllabus using Consensus academic search. Grill-me intake (syllabus input format + course audience + year range) plus a grouping forcing-options checkpoint before any search runs — so the reading list matches the course's level and recency need. Parses the syllabus to extract topics and learning outcomes, searches Consensus for recent peer-reviewed papers per topic, and produces a professionally formatted .docx with clickable Consensus links, plain-language summaries calibrated to audience level, and Bloom-higher-order discussion questions tied to course learning goals. Use when the user uploads a syllabus, course outline, or curriculum document and wants supplementary readings (e.g., 'create a reading list from this syllabus', 'find recent papers for my course') — even casual mentions with a syllabus attached should trigger this skill.","MIT","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fsyllabus\u002Fskills\u002Fsyllabus\u002FSKILL.md",[],[],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":19},"01M7BES1YA6R97W7QPMFFM1PED","pulse","Multi-source recency research skill that takes the pulse of any topic across Reddit, Hacker News, the open web, and optionally X\u002FTwitter within a configurable recent window (default 30 days). Forcing intake clarifies topic specificity, angle (trend\u002Fsentiment\u002Fproblems\u002Fopportunities\u002Fcomparison), time window, and platform scope before searching. Returns a synthesized briefing with citations, engagement metrics, and cross-platform pattern analysis. Use when the user requests multi-source recency intelligence on a topic (e.g., 'pulse on [topic]', 'what's happening with [topic]', 'what are people saying about [topic]', 'current conversation about [topic]', 'take the pulse of [topic]', 'trending: [topic]', 'find me info on [topic]'), and for competitor research, trend discovery, tool comparisons, and audience sentiment analysis.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fpulse\u002Fskills\u002Fpulse\u002FSKILL.md",[],[],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":19},"01M7BERNHYGY035AR00VRT03KE","patent","Patent prior-art and landscape intelligence skill — not generic patent help. Commits to one of five sub-use-cases via forcing intake (novelty search \u002F freedom-to-operate \u002F competitive landscape \u002F acquisition diligence \u002F litigation prior-art) before any search runs. Searches Google Patents, Espacenet, USPTO, and optionally Lens.org for citation-graph signals. Output is an editable Word document (.docx) with verdict, ranked closest art (claim-text extracted), CPC-class-aware landscape, family-resolved hits, geographic coverage, FTO flags where applicable, strategy recommendations, and full audit log. Use when the user asks for patent searching or analysis (e.g., 'prior art search for [invention]', 'freedom to operate analysis for [product]'). Produces search signal, not legal advice — always recommends consulting a patent attorney before filing or licensing decisions. Trademark, copyright, and trade-secret questions are out of scope.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fpatent\u002Fskills\u002Fpatent\u002FSKILL.md",[],[],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":19},"01M7BERCK1EAKTWW7R436WAR0J","notebooklm","Browser automation skill for controlling Google's NotebookLM. Use when the user wants anything done in NotebookLM (e.g., 'open NotebookLM', 'check my [name] notebook', 'ask my notebook about X', 'add [source] to NotebookLM', 'generate a Video Overview from my notebook', 'use NotebookLM Studio'). Handles reading and querying notebooks, adding sources (URLs, text, files, YouTube links, synthesized content), generating Studio outputs (Audio\u002FVideo Overviews, Mind Maps, Reports incl. Briefing Doc\u002FStudy Guide\u002FFAQ, Flashcards, Quiz, slide decks, infographics — discover the exact set from the live Studio panel; the UI evolves fast), and creating new notebooks. Requires browser automation environment — fails gracefully when unavailable.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fnotebooklm\u002Fskills\u002Fnotebooklm\u002FSKILL.md",[],[],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":19},"01M7BEQZAZAQRTXFJRY7RHV3TY","litreview","Academic literature orientation skill that searches papers via free keyless APIs (PubMed E-utilities + OpenAlex) by default — with the Consensus MCP as an optional enhancement lane when connected — builds a strategic search plan using PICO (default) or SPIDER \u002F Decomposition \u002F hybrid as fallbacks, and synthesizes findings into a formatted Word (.docx) research guide. Grill-me intake (research question specificity + framework hint + tentative depth) before the recon search; a second forcing checkpoint after Phase 2 confirms framework + sub-areas + depth before searches consume budget. Configurable depth (5\u002F10\u002F20 queries) controls coverage vs. speed. Output is a 'launching pad' — an orientation guide that lets a researcher dive in confidently, not a finished review. Use when the user starts literature-oriented research (e.g., 'litreview on [topic]', 'literature review on [topic]', 'I'm starting a literature review on X', 'I'm writing a paper on X', 'help me research X', 'I'm doing research on X', 'can you help me research X'). Do NOT use for single one-off paper searches wanting a quick list — that's a plain PubMed\u002FOpenAlex (or Consensus) query.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Flitreview\u002Fskills\u002Flitreview\u002FSKILL.md",[],[],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":19},"01M7BEQKJ45K31QK5VRAQSVJCJ","grants","NIH grant research skill for clinical researchers. Grill-me intake (research idea + career stage + preliminary data + environment + submission posture + known institute targets) locks down the funding strategy before any search runs. Runs a 5-facet Consensus positioning analysis (with draft Significance\u002FInnovation language), maps the research to the right NIH institutes and study sections via RePORTER, finds NOSIs and funded overlap, and produces an editable Word document (.docx) with budget\u002Fscope-aware mechanism recommendations, submission timelines, and a mandatory program officer recommendation. Use when the user asks about research funding or makes any grant-related request (e.g., 'grants for [topic]', 'find grants for my research idea', 'what grants match my research', 'help me find NIH funding', 'grant opportunities for my research'). NIH-only scope — non-NIH funders (PCORI, DOD CDMRP, VA, foundations) are out of scope and flagged at intake.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fgrants\u002Fskills\u002Fgrants\u002FSKILL.md",[],[]]