IoT UART Console (Picocom)
Pentest IoT UART consoles via picocom: enumerate, hit bootloaders, gain root shells.
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 14, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · 93418e0
Ships a real serial_helper.py (confirmed present) that cleans echoes/prompts and logs sessions to /tmp/serial_session.log; the SKILL.md itself doubles as a solid embedded-pentest checklist (baud ladder, BusyBox fingerprinting, U-Boot bootargs injection) rather than just a picocom cheat-sheet. Tested defensively only, no physical UART target attached.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 8/10
- Docs & honesty 5/5
What IoT UART Console (Picocom) does
Drives picocom (plus a bundled Python serial_helper.py) to talk to an IoT device's UART/serial console for authorized penetration testing: baud detection, BusyBox/bootloader identification, device enumeration, and privilege escalation. Triggers when the user mentions embedded devices, IoT hardware, serial consoles, or UART pentesting.
How to install IoT UART Console (Picocom)
git clone https://github.com/BrownFineSecurity/picocom-claude-skill
cd picocom-claude-skill
mkdir -p ~/.claude/skills
cp -r .claude/skills/picocom ~/.claude/skills/iot-uart-console-picocom
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger IoT UART Console (Picocom)
-
/iot-uart-console-picocomPentest IoT UART consoles via picocom: enumerate, hit bootloaders, gain root shells.
It also activates on plain-language prompts like these:
-
Connect to this IoT device's UART console with picocom -
Enumerate this embedded device over serial and find the bootloader -
Try to get a root shell on this device through its UART console
Frequently asked questions
- Is the IoT UART Console (Picocom) skill free?
- Yes. The skill itself is free from BrownFineSecurity/picocom-claude-skill. SkillProof publishes the install command and an independent test verdict at no cost.
- Does IoT UART Console (Picocom) work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 14, 2026. Verdict: Tested · Works. Ships a real serial_helper.py (confirmed present) that cleans echoes/prompts and logs sessions to /tmp/serial_session.log; the SKILL.md itself doubles as a solid embedded-pentest checklist (baud ladder, BusyBox fingerprinting, U-Boot bootargs injection) rather than just a picocom cheat-sheet. Tested defensively only, no physical UART target attached.
- What is the IoT UART Console (Picocom) SkillProof Score?
- 9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 5/5.
- How do I install IoT UART Console (Picocom)?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use IoT UART Console (Picocom) with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.