Skill

performing-plc-firmware-security-analysis

skill:mukul975/anthropic-cybersecurity-skills#performing-plc-firmware-security-analysis

This skill covers analyzing Programmable Logic Controller (PLC) firmware for security vulnerabilities including hardcoded credentials, insecure update mechanisms, backdoor functions, memory corruption flaws, and undocumented debug interfaces. It addresses firmware extraction from common PLC platforms (Siemens S7, Allen-Bradley, Schneider Modicon), static analysis of firmware images, dynamic analysis in emulated environments, and comparison against known-good baselines to detect tampering.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:43 UTC at 54a7988

findings

high

highest severity

threat classes

4,532

files scanned

74/80

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/performing-plc-firmware-security-analysis:skills/performing-plc-firmware-security-analysis/SKILL.md:263:EXEC
suspicious: finding skill:skills/performing-plc-firmware-security-analysis:skills/performing-plc-firmware-security-analysis/references/api-reference.md:45:SUPPLY

Security findings 2

Code execution

highContextual risklow confidence

SKILL.md's Step 2 analyzeHeadless command instructs the agent to run Ghidra postScripts FindCryptoConstants.java and FindHardcodedStrings.java, which the repository does not ship, so the agent would execute unreviewable code resolved from those paths at runtime.

skills/performing-plc-firmware-security-analysis/SKILL.md:263-268

-postScript FindCryptoConstants.java

vector:instruction

Counter-argument considered

Strongest refutation would be that the missing scripts make the instruction inert, but the artifact's instruction to run scripts by filename that it does not ship or source keeps the executed code unfixed at runtime, and no carve-out, declaration, or mitigation covers it; the concrete headless command in the skill body satisfies reach and chain, so the finding stands.

Supply chain

mediumContextual risklow confidence

The reference documentation instructs an unpinned installation of binwalk from PyPI, so the exact tool code executed at analysis time is not fixed by the artifact.

skills/performing-plc-firmware-security-analysis/references/api-reference.md:45

pip install binwalk

vector:instruction

Counter-argument considered

The only plausible refutation is the official-registry install carve-out, but that carve-out requires pinning and the instruction is unpinned, and the target declares no claims (and ships no mitigation) covering unpinned dependency resolution; the instruction in the skill's referenced file gives the agent a direct install command, so the finding stands.

Open questions 7

What the analysis could not settle from the code alone.

Whether live on-network protocol testing of physical PLCs is within this skill's declared scope, given the When-to-Use section defers authorized live testing to the separate performing-ics-penetration-testing skill while Step 3 ships an active Modbus tester.

Reconnaissance

[file request skills/performing-ics-penetration-testing/SKILL.md] Does performing-ics-penetration-testing ship in this repository, and does its content include live PLC exploitation or other capabilities that change the declared-surface assessment of the firmware-analysis skill that references it?

Code execution

[file request skills/performing-plc-firmware-security-analysis/scripts/FindCryptoConstants.java] The Step 2 Ghidra headless command in SKILL.md runs postScripts FindCryptoConstants.java and FindHardcodedStrings.java; does the repository ship these scripts and, if so, what do they execute?

Code execution

[file request skills/performing-ics-penetration-testing/SKILL.md] The skill directs the agent to 'See performing-ics-penetration-testing for authorized live testing procedures' — does that referenced file exist in this repository, and does it contain live-PLC exploitation or other capabilities that change this skill's declared-surface assessment?

Code execution

[file request skills/performing-plc-firmware-security-analysis/scripts/FindCryptoConstants.java] Does this Ghidra post-script referenced by the Step 2 analyzeHeadless command ship in the artifact, and if so what code does it execute during analysis?

Code execution

[file request skills/performing-plc-firmware-security-analysis/scripts/FindHardcodedStrings.java] Does this second Ghidra post-script referenced by the Step 2 analyzeHeadless command ship in the artifact, and if so what code does it execute during analysis?

Code execution

[file request skills/performing-plc-firmware-security-analysis/scripts/plc_protocol_tester.py] Does a standalone plc_protocol_tester.py referenced in the embedded usage line ship in the artifact, and does it match the embedded Modbus tester including the unauthenticated write and malformed-packet probes?

Destructive action

Coverage gaps 10

Parts of the artifact the static analysis could not fully examine.

ledger_finding_without_valid_finding run 1: instruction-surface.0 SRC:5a1819926c53d2da

ledger_finding_without_valid_finding run 1: instruction-surface.0 SRC:a5c6ea4bd6ac173c

ledger_finding_without_valid_finding run 1: declared-vs-actual.0 SRC:5a1819926c53d2da

ledger_finding_without_valid_finding run 1: declared-vs-actual.0 SRC:a5c6ea4bd6ac173c

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:5a1819926c53d2da

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:a5c6ea4bd6ac173c

invalid_judge_finding instruction-surface.0

invalid_judge_finding declared-vs-actual.0

invalid_judge_finding behavior-chains.0

invalid_judge_finding request.0