IoTNet
PCAP/live-capture wrapper that fingerprints MQTT, CoAP, Zigbee, Modbus and flags unencrypted or weakly-authed IoT traffic.
Test report
- Verdict
- Works with setup
- Score
- Tested
- Jul 13, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · fa29f5a
SKILL.md tells the model to shell out to `iotnet`, but the tool's core module (tools/iothackbot/core/iotnet_core.py) imports pyshark for all PCAP/live parsing -- a dependency the README's pip-install line and the skill body never mention, so a by-the-book install per the docs installs successfully and then fails at first real run (verified: no tshark, no pyshark in a clean environment, ImportError).
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 3/5
- Triggers reliably 5/5
- Output vs. baseline 7/10
- Docs & honesty 3/5
What IoTNet does
Instructs the model to drive the `iotnet` CLI from the iothackbot security-testing toolkit against a PCAP file or a live interface capture, detect IoT protocols, and report vulnerabilities with severity levels and remediation notes. Triggers on network traffic analysis, IoT protocol identification, or IoT device security assessment requests.
How to install IoTNet
git clone https://github.com/BrownFineSecurity/iothackbot
cd iothackbot
mkdir -p ~/.claude/skills
cp -r skills/iotnet ~/.claude/skills/iotnet
# also required (undocumented in SKILL.md): export PATH="$PATH:$(pwd)/bin"; pip install pyshark; install system tshark (Wireshark)
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger IoTNet
-
/iotnetPCAP/live-capture wrapper that fingerprints MQTT, CoAP, Zigbee, Modbus and flags unencrypted or weakly-authed IoT traffic.
It also activates on plain-language prompts like these:
-
Scan this PCAP file for MQTT and Zigbee traffic vulnerabilities -
Fingerprint the IoT protocols on this live network capture -
Check my IoT devices for unencrypted or weakly authenticated traffic
Frequently asked questions
- Is the IoTNet skill free?
- Yes. The skill itself is free from BrownFineSecurity/iothackbot. SkillProof publishes the install command and an independent test verdict at no cost.
- Does IoTNet work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 13, 2026. Verdict: Works with setup. SKILL.md tells the model to shell out to `iotnet`, but the tool's core module (tools/iothackbot/core/iotnet_core.py) imports pyshark for all PCAP/live parsing -- a dependency the README's pip-install line and the skill body never mention, so a by-the-book install per the docs installs successfully and then fails at first real run (verified: no tshark, no pyshark in a clean environment, ImportError).
- What is the IoTNet SkillProof Score?
- 7.2/10 — installs cleanly 3/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 3/5.
- How do I install IoTNet?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use IoTNet with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.