Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-iotgit clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/defender-for-iot)<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/defender-for-iot"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/defender-for-iot/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/defender-for-iot"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/defender-for-iot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00197 | $0.01755 |
| Opus 5 | $0.00098 | $0.00877 |
| Sonnet 5 | $0.00039 | $0.00351 |
| Haiku 4.5 | $0.00020 | $0.00176 |
Grade A, and why
defender-for-iot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Microsoft Defender for IoT
Defender for IoT delivers agentless network detection and response for two distinct estates that legacy endpoint tools miss:
- OT / ICS (operational technology, SCADA, PLCs, industrial networks).
- Enterprise IoT (EIoT) — printers, cameras, VoIP phones, smart-building devices on the corporate network — discovered and protected via the Microsoft Defender for Endpoint sensor and surfaced in Defender XDR.
When to use
Securing factory, utility, healthcare, or building-automation networks; or extending visibility to unmanaged "things" on the enterprise LAN that cannot run an endpoint agent.
Do not use this skill for IoT Hub / IoT Central data-plane security, Azure Sphere
firmware design, or workstation/server EDR (defender-for-endpoint).
OT vs Enterprise IoT — pick the right path
| Estate | Path | Sensor |
|---|---|---|
| Plant networks, ICS, SCADA, PLCs (Levels 0–3 Purdue) | Defender for IoT — OT | Dedicated OT network sensor (physical or virtual VM) attached to SPAN/TAP |
| Corporate LAN unmanaged devices (printers, cameras, VoIP) | Defender for IoT — EIoT | Existing MDE sensors on Windows endpoints; no separate appliance |
Rule of thumb: if it speaks Modbus / DNP3 / S7 / EtherNet/IP, you need an OT sensor. If it's an IP camera on the office VLAN, EIoT via MDE is enough.
Approach
OT estate
-
Network mapping by Purdue level first. Identify Level 0/1 (controllers, sensors), Level 2 (SCADA HMI), Level 3 (operations management). Sensors monitor traffic between levels and east-west within Level 2/3.
-
Pick sensor placement. One sensor per OT site, attached to a SPAN port that mirrors the core OT switch. Aggregate multi-site sensors into a cloud-connected model (preferred for new deployments) or the legacy on-prem management console (for air-gapped sites).
-
Deploy passively. OT sensors are fully passive — no probing, no active scans. This is non-negotiable in safety-critical environments. Confirm with plant ops before any port turn-up.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 126 lines · 197 tokens per session scan A 17b9bacc097b
defender-for-iot is a skill published in the GitHub repository vinayaklatthe/microsoft-security-skills (173 stars, last pushed 2mo ago), licensed MIT. It adds 197 tokens to every session and 1,755 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
home-assistant
This skill should be used when helping with Home Assistant setup, including creating automations, modifying dashboards, checking entity states, debugging automations, and managing the smart home configuration. Use this for queries about HA entities, YAML automation/dashboard generation, or troubleshooting HA issues.
raspberry-pi-pico2
Use when developing with Raspberry Pi Pico 2 or the Pi Debug Probe.
piper-tts-training
Train custom TTS voices for Piper (ONNX format) using fine-tuning or from-scratch approaches. Use when creating new synthetic voices, fine-tuning existing Piper checkpoints, preparing audio datasets for TTS training, or deploying voice models to devices like Raspberry Pi or Home Assistant. Covers dataset preparation…
mixed-reality
Work on C# and .NET-adjacent mixed-reality solutions around HoloLens, MRTK, OpenXR, Azure services, and integration boundaries where .NET participates in the stack. USE FOR: building or integrating mixed-reality solutions with C#; working on HoloLens, MRTK, Azure mixed-reality services, or OpenXR-related code…
power-automate
Use when operating Microsoft Power Automate cloud flows from code — create, enable, update, list or delete via the Dataverse Web API (workflow table, category 5) with Entra ID OAuth2, plus run-history debugging. NOT designing the flow definition (that is automation-flows), NOT picking a platform by billing model (that…
hardware-design
Provides guidance and tools for hardware design. Activate when using KiCAD, looking up electronic parts or designing PCBs.