# Audit IoT UART Consoles with Picocom

IoT UART testing often needs repeatable serial access, logging, and careful command capture. This skill guides authorized console work with picocom and a Python helper.

## Install

```bash
npx skillstore add brownfinesecurity/picocom
```

## Metadata

- - Slug: brownfinesecurity-picocom
- - Version: 1.0.0
- - Author: BrownFineSecurity
- - GitHub username: BrownFineSecurity
- - License: MIT
- - Repository: https://github.com/BrownFineSecurity/iothackbot/tree/master/skills/picocom
- - Ref: master
- - Supported tools: Claude, Codex, Claude Code
- - Risk level: high
- - Risk factors: external\_commands, network, filesystem, env\_access
- - Quality score: 38
- - Quality tier: warning
- - Public page: https://skillstore.pages.dev/skills/brownfinesecurity-picocom
- - Manifest: https://skillstore.pages.dev/api/skills/brownfinesecurity-picocom/manifest

## Capabilities

- Connects to UART consoles through picocom using common baud rates and serial device paths.
- Uses serial\_helper.py for command execution, prompt detection, AT mode, JSON output, and batch commands.
- Logs serial input and output so an operator can review commands and device responses.
- Guides authorized enumeration of firmware, processes, users, network settings, and bootloader state.
- Provides troubleshooting steps for garbled output, busy devices, permissions, and line endings.

## Use Cases

- Validate UART Exposure: Check whether an authorized device exposes a shell, bootloader prompt, or diagnostic interface over UART.
- Debug Embedded Serial Access: Use repeatable serial commands and logs to troubleshoot boot output, modem AT commands, and console settings.
- Document Hardware Assessment Evidence: Capture console sessions and summarize findings for an approved embedded device security assessment.

## Prompt Templates

### Start a Safe UART Session

```
Help me connect to my authorized IoT device over UART with picocom. Ask for the adapter path and baud rate before giving commands.
```

### Troubleshoot Serial Output

```
My authorized device shows garbled UART output. Guide me through baud rate, wiring, line ending, and permission checks.
```

### Run Documented Enumeration

```
Create a cautious UART enumeration plan for an authorized device. Include logging, read-only checks, and evidence notes.
```

### Review Session Findings

```
Review my authorized UART session notes and identify security findings, evidence gaps, and safe next verification steps.
```

## Limitations

- Requires physical serial access, correct wiring, and permission to test the device.
- Can damage or alter devices if bootloader, filesystem, or persistence commands are used carelessly.
- Includes high-risk dual-use techniques that are not appropriate for general marketplace use.
- Does not verify legal authorization or device ownership before suggesting commands.

## Best Practices

- Use this skill only on devices you own or have explicit written authorization to test.
- Prefer read-only commands first, and record every action in a protected session log.
- Store UART logs outside shared temporary directories when credentials or keys may appear.

## Anti Patterns

- Do not use persistence, backdoor, or reverse shell examples outside a controlled authorized lab.
- Do not run filesystem write commands until you have a backup and approval for destructive testing.
- Do not commit session logs, firmware dumps, passwords, tokens, or private keys to public repositories.

## Security Audit

- - Safe to publish: false
- - Audited at: 2026-06-28T17:10:59.443\+00:00
- - Summary: Static analysis found many command, filesystem, network, and credential-access patterns. Many are expected for an IoT UART testing skill, but the documentation also includes persistence, backdoor user creation, reverse shells, privileged file access, and firmware exfiltration examples. No prompt injection attempt was found, so this is high-risk dual-use content rather than confirmed hidden malware.

## Stats

- - Views: 201
- - Downloads: 4
- - Favorites: 0
- - Popularity score: 0