Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/evilfreelancer/secs/testing-ics-ot-protocolsnpx skills add EvilFreelancer/secs --skill testing-ics-ot-protocolsgit clone --depth 1 https://github.com/EvilFreelancer/secsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evilfreelancer/secs/testing-ics-ot-protocols)<a href="https://agentmods.dev/skills/evilfreelancer/secs/testing-ics-ot-protocols"><img src="https://agentmods.dev/badge/skills/evilfreelancer/secs/testing-ics-ot-protocols.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00127 | $0.02274 |
| Opus 5 | $0.00063 | $0.01137 |
| Sonnet 5 | $0.00025 | $0.00455 |
| Haiku 4.5 | $0.00013 | $0.00227 |
Grade A, and why
testing-ics-ot-protocols scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sL "https://defuddle.md/<url>" # scheme in the path is optional How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Testing ICS / OT Protocols
In OT, a scan is not free. The same TCP connect or version probe that IT devices shrug off can hang a legacy PLC, disrupt a safety instrumented system (SIS), or cause physical process upset — and the cost is measured in downtime, damaged equipment, or human safety, not a reset service. So the default is to listen, not to ask, and to ask only after a change-management approval, a maintenance window, and lab validation against the exact device model. Completeness of vulnerability data is subordinate to keeping the process running and people safe.
This skill is passive-first and defensive by default. Active interaction with Level 0-1 field devices and any SIS is out of bounds without a documented safety review and the customer's safety officer in the loop — this is a hard rule under AGENTS.md, not a preference. Confirm the exact in-scope subnets, asset list, and blackout windows before any capture begins.
When to Use
- Mapping an OT/ICS network and inventorying industrial assets non-disruptively
- Evaluating IT/OT convergence: segmentation, zone/conduit rules, DMZ, data diodes
- Reviewing industrial-protocol exposure (unauthenticated Modbus writes, cleartext OPC UA)
- Baselining OT traffic so anomalies become detectable later
- Reviewing firewall rules between Purdue levels against an IEC 62443 model
When NOT to Use
- IT service enumeration (SMB/SSH/RDP/HTTP on Level 3.5+ business hosts) — use
enumerating-network-services; those are IT assets even when they sit near OT - Working through a captured OT pcap in depth — use
analyzing-network-traffic; this skill decides what to capture and how safely, that one dissects it - Building detections for OT traffic — use
engineering-detectionsandwriting-sigma-rules - A suspected compromise or safety event in the plant — stop and use
responding-to-incidents; escalate to the safety officer immediately - Any active probing of PLCs, RTUs, or SIS without a signed safety review — refuse and escalate; there is no non-destructive default that makes this safe on live field devices
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 151 lines · 127 tokens per session scan A 83f57e64cf8e
testing-ics-ot-protocols is a skill published in the GitHub repository EvilFreelancer/secs (10 stars, last pushed 25d ago), licensed Apache-2.0. It adds 127 tokens to every session and 2,274 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ot-iot-device-security
USAP agent skill for OT/IoT/Device Security. Evaluate operational technology and IoT security controls, identify OT network segmentation gaps, and assess ICS/SCADA security posture.
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
Blue Team Defense & Hardening
System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement.
designing-hardware-products
AI-automated hardware product pipeline: from requirements to manufacturable Gerber + compiled firmware + cross-platform app. Orchestrates system design, ESP-IDF firmware, KiCad PCB, UniApp client, and release packaging in a zero-human-touch flow.
operating-kicad-eda
KiCad EDA orchestration via kicad-mcp MCP server. Routes 17 tools for schematic creation, PCB layout, autorouting, DRC, and Gerber export. Enforces serialized PCB ops, library-first lookup, and autoroute-only routing.
wave-issue-coverage
For each DRAFT requirement in a given Ground Control wave (or all waves), ensure a GitHub issue covers it and is bidirectionally linked. Use when the user asks to "cover wave N requirements with issues", "back-fill issues for draft requirements", or similar. Requires the Ground Control MCP and gh CLI.