Guide · Agent skill
How to use the Bluetooth Classic Attack Methodology agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-bluetooth-classic skill is a packaged playbook that gives an AI agent a structured method for security testing older Bluetooth Classic (BR/EDR) devices, such as legacy car kits, industrial sensors and audio accessories. It is aimed at authorised penetration testers, security students working in a lab and red teams documenting exposed profiles on in-scope hardware. By the end of this guide you will know what the skill does, how to install it, how to ask for help with natural requests and what you need in place before using it.
Bluetooth Classic Attack MethodologySnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from our page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. Confirm that SKILL.md sits inside the offensive-bluetooth-classic folder.
- 2Or upload it in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the ZIP there if you prefer not to use the file system.
- 3Install the BlueZ tools. On Linux, make sure hcitool, sdptool, bluetoothctl, hciconfig and rfcomm are available, and that you have a Bluetooth adapter connected.
- 4Confirm scope and permission. Write down which devices are in scope and confirm you have written permission to test them before running anything.
- 5Ask for the task in plain language. Describe the device type, your authorised scope and the check you want, such as service enumeration or a KNOB applicability check.
What the skill makes the agent do
An agent skill is a folder containing a SKILL.md file with instructions that Claude loads when a task matches the skill's description. This one holds an attack methodology for Bluetooth Classic, which the source describes as older than Bluetooth Low Energy (BLE) and less commonly attacked today.
The skill's workflow has five stages: discover devices, enumerate exposed services via SDP, test each service profile for unauthenticated access, check pairing crypto for KNOB applicability, and consider proximity-based attacks on legacy or unpatched devices. It also covers reporting, such as identifying chipset and firmware per device and mapping CVE applicability.
- Device discovery with hcitool, bluetoothctl and redfang
- Service listing with sdptool browse and sdptool records
- Serial Port Profile (SPP) access on industrial or IoT debug ports
- Checks for BlueBorne patch level and KNOB applicability
- Notes on Headset, File Transfer, Object Push and HID profile abuse
How to install the offensive-bluetooth-classic skill
You can install the skill in one of two ways. Download the ZIP for this skill from our page and unzip it into your user skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill limited to one project.
Alternatively, upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills. Either way, the folder must contain SKILL.md. The source lists SKILL.md as the only file in the package.
- Option A: unzip into ~/.claude/skills/ for personal use
- Option B: unzip into a project's .claude/skills/ folder
- Option C: upload the ZIP under Settings, Capabilities, Skills in the Claude apps
~/.claude/skills/offensive-bluetooth-classic/SKILL.mdHow to trigger the skill with natural requests
You do not need a special command. Describe a task that involves older Bluetooth Classic devices and the agent should pick up the skill when the request matches its description. The description mentions legacy car kits, industrial sensors, older medical devices and audio accessories.
Name the device, state the scope and say what you want checked. Clear scope helps, because the skill is written for in-scope targets only.
- Discover Bluetooth Classic devices near me and list which ones expose a serial port profile, for my authorised lab test
- Enumerate the SDP services on this audio accessory and tell me which profiles allow unauthenticated access
- Check whether this legacy car kit is exposed to KNOB, based on its chipset and firmware
- Document the exposed profiles and CVE applicability for these in-scope industrial sensors for our red team report
What you need before you start
The source lists Linux with BlueZ tools as the requirement. These are hcitool, sdptool, bluetoothctl, hciconfig and rfcomm. You also need a Bluetooth adapter. The commands in the skill use sudo, so you will need administrator rights on the machine.
KNOB testing has an extra requirement: a Broadcom-based adapter supported by the internalblue project. Optional tools referenced in the source are redfang, screen, the internalblue project and the Armis blueborne scanner.
- Linux with BlueZ tools (hcitool, sdptool, bluetoothctl, hciconfig, rfcomm)
- A Bluetooth adapter
- For KNOB testing: a Broadcom-based adapter supported by internalblue
- Optional: redfang, screen, internalblue, Armis blueborne scanner
Safety, scope and network use
The skill runs scripts and uses the network, according to its listing. The content is written for attacking live targets. Only test devices you own or have written permission to assess. Unauthorised use may be illegal.
Discovery can be slow. The source notes that redfang is very slow, at about seven hours per OUI prefix, because it tries address brute forcing for non-discoverable devices. Plan time and scope before running long scans.
The skill does not cover modern Bluetooth Low Energy devices. It is oriented towards offence, so for defensive hardening advice you will need other resources.
- Get written permission and define the scope before any test
- Run only against devices you own or are authorised to assess
- Expect long runtimes for address brute forcing
- Check the scripts and any network activity before running them in a sensitive environment
What people use it for
- Listing the SDP services on an in-scope legacy car kit to see which profiles are exposed
- Checking whether an industrial sensor's Serial Port Profile is reachable without authentication during an authorised test
- Mapping CVE applicability for BlueBorne and KNOB across a set of older audio accessories in a lab
- Writing a red team report that documents profile abuses and chipset details for in-scope devices
Frequently asked questions
Is the offensive-bluetooth-classic skill free to use?
The source lists the licence as MIT. Check the licence file in the repository before you redistribute or modify the skill. The skill is only meant for authorised testing of devices you have permission to assess.
How do I install an agent skill like this?
Download the ZIP from our page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings, Capabilities, Skills.
What do I need to run the Bluetooth Classic skill?
You need Linux with BlueZ tools, including hcitool, sdptool, bluetoothctl, hciconfig and rfcomm, plus a Bluetooth adapter. KNOB testing also requires a Broadcom-based adapter supported by internalblue.
Does this skill work on Bluetooth Low Energy devices?
No. The source states that modern Bluetooth Low Energy devices are not covered. The skill focuses on Bluetooth Classic (BR/EDR) devices such as legacy car kits, industrial sensors and audio accessories.
Why does device discovery take so long?
The source says redfang can be very slow, at roughly seven hours per OUI prefix, because it brute forces addresses to find non-discoverable devices. Standard discovery with hcitool inq or bluetoothctl scan is much faster but only finds discoverable devices.
Can I use this skill to test my own headphones or home devices?
You can test devices you own, which is the main permitted use. The skill is written for attacking live targets, so keep the test within your own equipment and document it. If you only need hardening advice, this skill is not designed for that.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are an authorised penetration tester, a security student in a lab or a red team documenting exposed profiles on in-scope legacy Bluetooth Classic hardware. Pick something else if you need defensive hardening advice, want to test Bluetooth Low Energy devices, or do not have written permission to assess the target.
Download the skill