Skills iotnet
📦

iotnet

Content revision r2 High Risk ⚙️ External commands🌐 Network access

Analyze IoT Network Traffic for Security Risks

IoT packet captures can hide insecure protocols, plaintext data, and weak authentication. This skill guides IoTNet analysis and presents prioritized findings with remediation advice.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "iotnet" from https://skillstore.io/skills/brownfinesecurity-iotnet.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-iotnet/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/brownfinesecurity-iotnet.md Signed manifest GET /api/skills/brownfinesecurity-iotnet/manifest Signed lockfile GET /api/skills/brownfinesecurity-iotnet/lockfile

Test it

Using "iotnet". Analyze office-floor.pcap for IoT protocols and security issues.

Expected outcome:

IoTNet identified MQTT and CoAP traffic. The highest priority finding is unencrypted MQTT communication that may expose device messages.

Using "iotnet". Compare baseline.pcap and updated.pcap using the custom detection rules.

Expected outcome:

  • The updated capture contains less plaintext MQTT traffic than the baseline.
  • CoAP traffic remains unencrypted and requires review.
  • Prioritize transport encryption, then verify device authentication.

Using "iotnet". Review camera.pcap for traffic from the authorized camera address.

Expected outcome:

The filtered capture contains ONVIF and UPnP traffic. Review exposed discovery messages and verify that camera management traffic uses protected transport.

Security Audit

High Risk
v10 • 7/23/2026 Open versioned report

Most reported shell-execution patterns are false positives caused by Markdown code fences and inline parameter names. Four sudo instructions are confirmed because live capture runs IoTNet with elevated privileges, and the workflow lacks explicit authorization and privacy safeguards for inspecting network traffic.

1
Files scanned
143
Lines analyzed
4
Review items
0
False positives ignored

Confirmed security concerns (1)

High
SKILL.md:20-35SKILL.md:117-125
Live Traffic Capture Lacks Authorization Safeguards
The skill directs the agent to capture and inspect network traffic, including possible plaintext credentials, without requiring ownership, consent, scope validation, or protected handling.
The workflow explicitly proceeds from a capture request to execution, and the listed security checks include plaintext credentials. No authorization or privacy check appears in the skill.
Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
SKILL.md:48
sudo privilege escalation
sudo iotnet -i eth0 -d 30
The live-capture command explicitly runs IoTNet through sudo. Packet capture may legitimately need elevation, but this grants the tool root-level execution.
High
SKILL.md:82
sudo privilege escalation
sudo iotnet -i wlan0 -d 60
The example explicitly invokes sudo for a 60-second wireless capture. This is a real elevated command even though the network-analysis use is legitimate.
High
SKILL.md:92
sudo privilege escalation
sudo iotnet -i eth0 -c "port 1883 or port 5683" -d 45
The filtered live-capture example explicitly invokes sudo. User-controlled interface or filter arguments increase the impact of unsafe command construction.
High
SKILL.md:138
sudo privilege escalation
- Live capture requires root/sudo privileges
The skill states that live capture requires root or sudo privileges. This confirms that the workflow expects elevated execution.

Risk Factors

⚙️ External commands (29)
SKILL.md:41-43 SKILL.md:43-47 SKILL.md:47-49 SKILL.md:49-54 SKILL.md:54-55 SKILL.md:55-58 SKILL.md:58-59 SKILL.md:59-60 SKILL.md:60-63 SKILL.md:63-66 SKILL.md:66-67 SKILL.md:67-70 SKILL.md:70-71 SKILL.md:71-76 SKILL.md:76-78 SKILL.md:78-81 SKILL.md:81-83 SKILL.md:83-86 SKILL.md:86-88 SKILL.md:88-91 SKILL.md:91-93 SKILL.md:93-96 SKILL.md:96-98 SKILL.md:98-101 SKILL.md:101-103 SKILL.md:48 SKILL.md:82 SKILL.md:92 SKILL.md:138
🌐 Network access (1)
SKILL.md:87
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/brownfinesecurity-iotnet/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/brownfinesecurity-iotnet/security.svg)](https://skillstore.io/skills/brownfinesecurity-iotnet?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/brownfinesecurity-iotnet?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-iotnet/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-iotnet.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

BrownFineSecurity. (2026). iotnet security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-iotnet/audits/10

BibTeX citation

@techreport{brownfinesecurity-brownfinesecurity-iotnet-2026, author = {BrownFineSecurity}, title = {iotnet security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/brownfinesecurity-iotnet/audits/10}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "iotnet security audit report (audit version 10)" version: "unspecified" type: report authors: - name: "BrownFineSecurity" date-released: "2026-07-23" url: "https://skillstore.io/skills/brownfinesecurity-iotnet/audits/10" identifiers: - type: other value: "skillstore:brownfinesecurity-iotnet:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Review Device Captures

Analyze authorized PCAP files to identify IoT protocols, plaintext traffic, and weak authentication.

Validate Product Communications

Compare device traffic against encryption and authentication requirements before a release.

Triage Network Findings

Summarize protocol distribution and prioritize likely communication risks for remediation.

Try These Prompts

Analyze One Capture 
Analyze [PCAP path] with IoTNet. Identify IoT protocols and summarize security findings by severity.
Focus on One Device 
Analyze [PCAP path] for traffic involving [device IP]. Report insecure protocols, missing encryption, and weak authentication.
Compare Multiple Captures 
Analyze [PCAP paths] with [rules file]. Compare protocol distribution, security findings, and remediation priorities across captures.
Plan a Scoped Live Capture 
Plan an authorized live capture on [interface] for [duration] using [BPF filter]. Confirm scope and privilege requirements before execution.

Best Practices

  • Confirm network ownership or written authorization before analyzing or capturing traffic.
  • Prefer offline PCAP analysis when live capture is unnecessary.
  • Limit capture scope and redact credentials or sensitive payloads from shared results.

Avoid

  • Do not capture third-party traffic without explicit permission.
  • Do not run broad or indefinite live captures with elevated privileges.
  • Do not treat protocol detection alone as proof of a vulnerability.

Frequently Asked Questions

Can this skill analyze existing packet captures?
Yes. It supports one or more standard PCAP files and does not require elevated privileges for offline analysis.
Can it capture live traffic?
Yes. Live capture requires an interface, a duration, network access, explicit authorization, and elevated capture permissions.
Which IoT protocols can it identify?
Documented examples include MQTT, CoAP, Zigbee, Z-Wave, ONVIF, UPnP, SSDP, and Modbus.
Can I filter the analysis?
Yes. You can filter by IP address, BPF capture expression, or Wireshark display expression.
Does it support custom detection rules?
Yes. Provide a custom rules configuration file through the documented config option.
Does a finding confirm that a device is vulnerable?
No. Findings require validation against device configuration, deployment context, and authorized testing results.

Developer Details

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/BrownFineSecurity/iothackbot/tree/master/skills/iotnet

Ref

a39a91716eadede5f4cdefd78178fed4e837a128

Maintenance freshness

7/24/2026

Usage

7 downloads · 175 views

File structure

📄 SKILL.md