Skip to content
Get packs

Guide · Agent skill

How to use the Zigbee, Thread & Matter Attacks agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This is a Claude agent skill, a folder of instructions that teaches an AI agent a specific methodology. The skill named offensive-zigbee-thread-matter gives the agent a playbook for assessing the 802.15.4 mesh protocols behind many smart-home devices such as bulbs, door locks and sensors. This guide explains what the skill does, how to install it, how to phrase requests so the agent uses it, and what you need before you touch any hardware. It is written for authorised testers and students, and it assumes no prior experience with agent skills.

Zigbee, Thread & Matter AttacksSnailSploit/Claude-Red · MIT

Quick start

  1. 1Download the skill ZIP. Get the offensive-zigbee-thread-matter ZIP from the directory page. Confirm you have the licence terms, which are MIT.
  2. 2Unzip into the skills folder. Extract the folder into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project. Alternatively, upload the ZIP under Settings, Capabilities, Skills in the Claude apps.
  3. 3Set up your tools on a bench network. Install Python 3 with scapy and scapy-dot15d4, KillerBee, Z3sec and Wireshark with the dot15d4 and zbee dissectors. Test them only on devices you own.
  4. 4Write a scoped request. Ask the agent for a plan that names the protocol, device class and written authorisation. Keep the request specific to the assessment.
  5. 5Review and run each step yourself. Read every command the agent proposes, check it against your scope, and run it manually. Stop at any step that falls outside the agreed scope.
  6. 6Document findings with defensive notes. Record captures, logs and observations. Add defensive recommendations to the report, since this skill covers attack methodology only.

What the skill makes the agent do

The skill is a methodology document, a SKILL.md file. When it is active, the agent follows its structure: identify the target radio channel, find the network coordinator and joining devices, check Touchlink commissioning behaviour, observe device joins, and examine cluster command handling. It also covers Thread credential handling and Matter commissioning, with attack ideas for each.

The skill describes tools such as the KillerBee suite, scapy with the dot15d4 contribution, Z3sec and Wireshark with the dot15d4 and zbee dissectors. It does not contain code of its own that runs on your machine. The agent uses the instructions to plan and explain the work, and you run any tools yourself.

  • Covers IEEE 802.15.4 sniffing with compatible USB dongles
  • Covers Touchlink commissioning weaknesses in Zigbee 3.0 lighting
  • Covers capture of network keys during device joins
  • Covers replay and injection of Zigbee Cluster Library commands
  • Covers Thread credential handling and 6LoWPAN routing issues
  • Covers Matter commissioning chain analysis

Install the skill from a ZIP file

Download the ZIP for this skill from the directory page. Unzip it so that the skill folder sits inside your Claude skills directory. For a personal install, use ~/.claude/skills/. For a single project, put it in the project's .claude/skills/ folder instead. Claude Code picks up skills from these locations.

If you use the Claude apps, you can upload the skill instead of copying files. Open Settings, go to Capabilities, then Skills, and upload the ZIP there.

  • Personal: ~/.claude/skills/
  • Project only: .claude/skills/ inside the project folder
  • Claude apps: Settings → Capabilities → Skills
~/.claude/skills/

Trigger the skill with natural requests

You do not need a special command. Describe the task in plain language that mentions the protocol and the context. The agent reads the skill description and loads the methodology when the request matches. Naming the scope helps, because the skill is written for authorised work.

Good requests state the protocol, the device type and the written scope. For example: 'Using the Zigbee attack methodology, plan a wireless assessment of the bulbs and door locks in the client's lab, within the scope in our signed agreement.' Vague requests such as 'hack my neighbour's lock' will not match the skill's purpose and should not be used.

  • Name the protocol: Zigbee, Thread or Matter
  • Name the device class: bulbs, door locks, sensors or commercial mesh
  • State the authorisation and scope in the same message
  • Ask for a plan, a checklist or an explanation of what a capture shows

Prepare hardware and software

The skill assumes you already have 802.15.4 radio hardware and a working Python environment. The source lists TI CC2531, CC2652 and the Sonoff Zigbee Dongle E as compatible adapters. You will need Python 3 with scapy and scapy-dot15d4, the KillerBee toolkit, the Z3sec toolkit cloned from GitHub, and Wireshark with the dot15d4 and zbee dissectors.

Install and test these tools on a bench network you own before any engagement. The skill does not install anything for you, and it does not include version pins, so check each project's own documentation for installation.

  • Python 3 with scapy and scapy-dot15d4
  • KillerBee toolkit
  • Z3sec toolkit, cloned from its GitHub repository
  • Compatible 802.15.4 adapter such as TI CC2531, CC2652 or Sonoff Zigbee Dongle E
  • Wireshark with dot15d4 and zbee dissectors

Safety: scripts, network and legal limits

The skill itself does not run scripts and does not use the network. Everything that touches radios or networks happens in tools you install and operate. The attack steps it describes can factory-reset, hijack or unlock devices. Using them against equipment you do not own, or outside written permission, is illegal in most places.

Only use this skill against devices and networks you own, or that are covered by a written scope with the owner. Keep captures and test logs as evidence of authorisation. The skill is not a hardening guide, so pair it with defensive references when you write up findings.

  • No scripts run from the skill bundle; no network use by the skill
  • Test only your own lab devices or systems with written permission
  • Keep signed scope documents and log every test session
  • Plan for defensive fixes in your report, since the skill covers attacks only

Tips for a useful session

Ask the agent to structure its output as a numbered plan with a stop condition at each step. Review each command yourself before running it, and check the target channel and addresses against your scope document. Use Wireshark to inspect captures rather than relying on summaries alone.

Detection notes in the source say most environments do not monitor 802.15.4 traffic, and hub apps often show new-device alerts that users ignore. Record what your test would have looked like to a defender, since that is useful in a report.

  • Ask for a numbered plan with stop conditions
  • Check every address and channel against the written scope
  • Inspect captures in Wireshark before drawing conclusions
  • Note what hub apps and coordinators would show, for the report

What people use it for

  • Planning a written-scope wireless assessment of Zigbee lighting and sensors in a company lab
  • Explaining what a 802.15.4 capture shows, including frame counters and ZCL commands
  • Building a checklist for a Matter commissioning review on test devices
  • Teaching students how Touchlink and join-key weaknesses work on a lab bench
  • Structuring the methods section of a penetration test report for a smart-building client

Frequently asked questions

How do I install the offensive-zigbee-thread-matter skill?

Download the ZIP from the directory page and unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project. In the Claude apps you can instead upload the ZIP under Settings, Capabilities, Skills.

What hardware do I need for Zigbee sniffing?

The source lists the TI CC2531, CC2652 and Sonoff Zigbee Dongle E as compatible 802.15.4 adapters. You also need Python 3 with scapy and scapy-dot15d4, plus the KillerBee toolkit. The skill does not supply hardware.

Is this skill free to use?

The skill is licensed under the MIT licence, as stated on the directory page. The tools it refers to, such as KillerBee, Z3sec and Wireshark, have their own licences that you should check separately.

Does the skill run code or use the internet?

The directory listing states that the skill runs no scripts and uses no network. The tools it describes are separate software that you install and run yourself.

Is it legal to use this on my neighbour's smart lock?

No. The methodology describes factory resetting, hijacking and unlocking devices, which is illegal in most places without the owner's permission. Use it only on devices you own or that are covered by written authorisation.

How does this compare with a home-security hardening guide?

This skill covers attack methodology and has no hardening or defensive guidance. For securing your own smart home, use a defensive guide from the device vendor or a security publication instead.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits security researchers and penetration testers who hold written authorisation for smart-home or commercial IoT work, and students learning 802.15.4 weaknesses on a lab bench. It is not suitable for home users who want to secure their own devices, or for beginners without radio hardware and protocol background, since it assumes familiarity with KillerBee, scapy and Wireshark.

Download the skill