wsdiscovery

wsdiscovery is a skill for Claude Code, Codex from BrownFineSecurity/iothackbot. It costs 49 tokens per session (596 once invoked), scanned A, original, MIT.

A network scanner for finding devices that use WS-Discovery, a protocol that devices use to announce themselves on a local network. It is commonly used by ONVIF security cameras and recorders.

In plain words
What is it for?
Use it to discover ONVIF cameras, network video recorders, and other WS-Discovery devices, with text or JSON results and optional detailed protocol output.
Why use it?
It helps locate compatible cameras and other devices without requiring their addresses to be known beforehand.

Skill for Claude CodeCodex

Part of the iothackbot plugin — 13 skills shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/brownfinesecurity/iothackbot/wsdiscovery
Any agent
npx skills add BrownFineSecurity/iothackbot --skill wsdiscovery
Clone the repo
git clone --depth 1 https://github.com/BrownFineSecurity/iothackbot

Made for: Claude Code, Codex.

Or install iothackbot, the plugin that ships this one along with the rest of its 13 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for wsdiscovery

README.md
[![agentmods](https://agentmods.dev/badge/skills/brownfinesecurity/iothackbot/wsdiscovery.svg)](https://agentmods.dev/skills/brownfinesecurity/iothackbot/wsdiscovery)
Your own site
<a href="https://agentmods.dev/skills/brownfinesecurity/iothackbot/wsdiscovery"><img src="https://agentmods.dev/badge/skills/brownfinesecurity/iothackbot/wsdiscovery.svg" alt="Measured on agentmods" height="20"></a>
Per session 49 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 596 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00049 $0.00596
Opus 5 $0.00024 $0.00298
Sonnet 5 $0.00010 $0.00119
Haiku 4.5 $0.00005 $0.00060

Measured 4d ago against content hash 90ca5c424d0b, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

wsdiscovery scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/wsdiscovery/SKILL.md · 78 lines

How it starts

The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Wsdiscovery - WS-Discovery Protocol Scanner

You are helping the user discover and enumerate devices using the WS-Discovery protocol (commonly used by ONVIF cameras and IoT devices) using the wsdiscovery tool.

Tool Overview

Wsdiscovery implements the WS-Discovery protocol to discover network devices that support this standard. It's particularly useful for finding ONVIF cameras, network video recorders (NVRs), and other IoT devices that advertise themselves via WS-Discovery.

Instructions

When the user asks to discover ONVIF devices, find network cameras, or scan for WS-Discovery devices:

  1. Understand the target:

    • Ask for the target hostname or IP address
    • Determine if they want verbose output (full XML responses)
    • Decide on output format
  2. Execute the scan:

    • Use the wsdiscovery command from the iothackbot bin directory
    • Basic usage: wsdiscovery <hostname_or_ip>
    • For verbose output: wsdiscovery <hostname_or_ip> -v
    • For JSON output: wsdiscovery <hostname_or_ip> --format json
  3. Output formats:

    • --format text (default): Human-readable colored output with device details
    • --format json: Machine-readable JSON
    • --format quiet: Minimal output

What It Discovers

The tool extracts and displays:

  • IP addresses and ports
  • Endpoint references (device UUIDs)
  • Device types
  • Manufacturer information
  • Device names and models
  • Hardware versions
  • Serial numbers
  • Firmware versions
  • Location information
  • Service endpoints (XAddrs) - URLs for device management
  • Metadata versions

Examples

Discover devices on a specific host:

wsdiscovery 192.168.1.100

Discover with full XML responses:

wsdiscovery 192.168.1.100 -v

Output device information as JSON:

wsdiscovery 192.168.1.100 --format json

Scan network broadcast address to find all devices:

wsdiscovery 239.255.255.250

Important Notes

  • WS-Discovery uses multicast/broadcast discovery
  • Devices must support the WS-Discovery protocol to be found
  • Common with ONVIF cameras, printers, and network media devices
  • Service endpoints (XAddrs) can be used with onvifscan for further testing
  • The tool parses ONVIF-specific scope information when available

Read the full file on GitHub · 78 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 78 lines · 49 tokens per session scan A 90ca5c424d0b

Subscribe to this mod's changes

wsdiscovery is a skill published in the GitHub repository BrownFineSecurity/iothackbot (825 stars, last pushed 3mo ago), licensed MIT. It adds 49 tokens to every session and 596 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

integrated-browser

Use this when working on the VS Code integrated browser ("browserView") to understand its architecture and mental model. Covers the embedded Chromium browser, its editor tab, navigation, overlay/layout, sessions, and agent browser tools under src/vs/platform/browserView and src/vs/workbench/contrib/browserView.

microsoft/vscode · 68 tokens

import-prom-rule

Bulk import of a Prometheus alert rule YAML file (create a whole set of rules at once). Dedicated to handling a remote URL or local YAML text, automatically parsing the three formats groups / a plain rules array / a single rule. ⚠️ Do not use this skill for single-rule creation — when the user describes a single alert…

ccfos/nightingale · 125 tokens

pcbway

PCBWay PCB fabrication and assembly — turnkey/consigned assembly, design rules, ordering workflow. Alternative to JLCPCB for manufacturing. Use with KiCad. Use this skill when the user mentions PCBWay, needs turnkey assembly (PCBWay sources parts by MPN), has parts not available on LCSC, needs assembled boards with…

aklofas/kicad-happy · 119 tokens

unifi-protect

How to manage UniFi Protect cameras and NVR — view cameras, smart detections, Find Anything detection search, recordings, snapshots, lights, sensors, Known Faces, license plates, and the Alarm Manager. Use this skill when the user mentions UniFi cameras, security cameras, NVR, recordings, motion detection, person…

sirkirby/unifi-mcp · 112 tokens

KernelWiki

Use when the user asks about optimizing NVIDIA Blackwell (SM100, B200) or Hopper (SM90, H100) GPU kernels — tcgen05/TMEM/CLC/NVFP4/2-SM cooperative, warp specialization, FlashAttention-4, DeepGEMM, FlashMLA, MoE, grouped GEMM, CuTe-DSL/PTX/Triton on Blackwell, or wants concrete PR references from…

mit-han-lab/KernelWiki · 143 tokens

unifly

This skill should be used when the user asks to "manage UniFi devices", "configure UniFi networks", "create a VLAN", "provision an SSID", "create firewall rules", "reorder firewall policies", "create a NAT rule", "set up port forwarding", "configure masquerade NAT", "add DNS records", "manage traffic matching lists"…

hyperb1iss/unifly · 265 tokens