Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/brownfinesecurity/iothackbot/picocomnpx skills add BrownFineSecurity/iothackbot --skill picocomgit clone --depth 1 https://github.com/BrownFineSecurity/iothackbotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/brownfinesecurity/iothackbot/picocom)<a href="https://agentmods.dev/skills/brownfinesecurity/iothackbot/picocom"><img src="https://agentmods.dev/badge/skills/brownfinesecurity/iothackbot/picocom.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00053 | $0.07363 |
| Opus 5 | $0.00026 | $0.03682 |
| Sonnet 5 | $0.00011 | $0.01473 |
| Haiku 4.5 | $0.00005 | $0.00736 |
Grade F, and why
picocom scanned grade F with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Enumerates the file system for secretshighData exfiltration
Searching home directories for .env, .ssh, .aws or credential files is reconnaissance for credential theft.
find / -name "*.pem" 2>/dev/null Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Python 3 with pyserial library (`sudo pacman -S python-pyserial` on Arch, or `pip install pyserial`) Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
echo "your_ssh_public_key" >> /root/.ssh/authorized_keys Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
--trigger-script "curl http://192.168.1.100/api/reboot" \ How it starts
The opening of the file, as written. The whole thing — 901 lines — stays where its author put it; the contents beside it link to each section on GitHub.
IoT UART Console (picocom)
This skill enables interaction with IoT device UART consoles using picocom for security testing and penetration testing operations. It supports bootloader interaction, shell access (with or without authentication), device enumeration, and vulnerability discovery.
Prerequisites
- picocom must be installed on the system
- Python 3 with pyserial library (
sudo pacman -S python-pyserialon Arch, orpip install pyserial) - UART connection to the target device (USB-to-serial adapter, FTDI cable, etc.)
- Appropriate permissions to access serial devices (typically /dev/ttyUSB* or /dev/ttyACM*)
Recommended Approach: Serial Helper Script
IMPORTANT: This skill includes a Python helper script (serial_helper.py) that provides a clean, reliable interface for serial communication. This is the RECOMMENDED method for interacting with IoT devices.
Default Session Logging
ALL commands run by Claude will be logged to /tmp/serial_session.log by default.
To observe what Claude is doing in real-time:
# In a separate terminal, run:
tail -f /tmp/serial_session.log
This allows you to watch all serial I/O as it happens without interfering with the connection.
Why Use the Serial Helper?
The helper script solves many problems with direct picocom usage:
- Clean output: Automatically removes command echoes, prompts, and ANSI codes
- Prompt detection: Automatically detects and waits for device prompts
- Timeout handling: Proper timeout management with no arbitrary sleeps
- Easy scripting: Simple command-line interface for single commands or batch operations
- Session logging: All I/O logged to
/tmp/serial_session.logfor observation - Reliable: No issues with TTY requirements or background processes
Quick Start with Serial Helper
Single Command:
python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --command "help"
With Custom Prompt (recommended for known devices):
python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --prompt "User@[^>]+>" --command "ifconfig"
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 901 lines · 53 tokens per session scan F 9684cdae8827
picocom is a skill published in the GitHub repository BrownFineSecurity/iothackbot (819 stars, last pushed 3mo ago), licensed MIT. It adds 53 tokens to every session and 7,363 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it F with 4 findings (enumerates the file system for secrets, asks for root, reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
integrated-browser
Use this when working on the VS Code integrated browser ("browserView") to understand its architecture and mental model. Covers the embedded Chromium browser, its editor tab, navigation, overlay/layout, sessions, and agent browser tools under src/vs/platform/browserView and src/vs/workbench/contrib/browserView.
import-prom-rule
Bulk import of a Prometheus alert rule YAML file (create a whole set of rules at once). Dedicated to handling a remote URL or local YAML text, automatically parsing the three formats groups / a plain rules array / a single rule. ⚠️ Do not use this skill for single-rule creation — when the user describes a single alert…
pcbway
PCBWay PCB fabrication and assembly — turnkey/consigned assembly, design rules, ordering workflow. Alternative to JLCPCB for manufacturing. Use with KiCad. Use this skill when the user mentions PCBWay, needs turnkey assembly (PCBWay sources parts by MPN), has parts not available on LCSC, needs assembled boards with…
unifi-protect
How to manage UniFi Protect cameras and NVR — view cameras, smart detections, Find Anything detection search, recordings, snapshots, lights, sensors, Known Faces, license plates, and the Alarm Manager. Use this skill when the user mentions UniFi cameras, security cameras, NVR, recordings, motion detection, person…
find-high-speed-nets
Analyzes a KiCad PCB to identify high-speed and impedance-controlled nets by looking up component datasheets via AI. Classifies nets by speed tier (ultra-high/high/medium/low), detects RF/antenna feeds and other controlled-impedance nets, estimates max frequencies and rise times per interface, and recommends GND…
tilelang-env-check
TileLang-Ascend 环境检查与配置验证技能。检查代码仓库完整性、编译安装状态、环境变量配置，并运行简单测试验证环境。发现问题会自动调用相关 skill 进行修复，并按依赖顺序重新执行后续步骤。触发关键词："环境检查"、"检查环境"、"验证环境"、"环境配置"、"环境搭建"、"env check"、"check environment"、"verify environment"、"setup environment"。.