detecting-modbus-command-injection-attacks
85 / 100 · Low risk
Fine to try.
Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection. Use when deploying IDS for Modbus OT networks, investigating unauthorized PLC register/coil changes, or responding to FrostyGoop-style Modbus attacks.
What this skill can do
Downloads and installs other software
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'detecting-modbus-command-injection-attacks' ] || [ -L ~/.agents/skills/'detecting-modbus-command-injection-attacks' ]; then echo 'A skill folder named detecting-modbus-command-injection-attacks already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/mukul975/Anthropic-Cybersecurity-Skills' "$d" && git -C "$d" checkout --quiet '54a798831d2266a3ca61ce68a7acb80b81160d57' -- 'skills/detecting-modbus-command-injection-attacks' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/detecting-modbus-command-injection-attacks' ~/.agents/skills/'detecting-modbus-command-injection-attacks' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'detecting-modbus-command-injection-attacks' ~/.claude/skills/'detecting-modbus-command-injection-attacks' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
[](https://zalavijaysinh.github.io/skilltrust/repos/mukul975/Anthropic-Cybersecurity-Skills/)
Score history
| Date | Version | Score |
|---|---|---|
| 2026-11-08 | 54a7988 | 85 |
| 2026-11-07 | 54a7988 | 85 |