ot-ics SKILL.md skillA
ot-ics from novaestellar/novahaku is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add novaestellar/novahaku/ot-ics@git:20260910.546fe86Pins git:20260910.546fe86 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- novaestellar/novahaku
- Path
testing/ot-ics/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260910.546fe86, committed Sep 10, 2026
- Size
- 2,883 bytes
- Repository stars
- 28
- License
- MIT
Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# OT / ICS Security ## ACTION REQUIRED（读完后立刻执行） 1. `NOW`: 读取 `../field-journal/precedent-pentest.md` — **工控环境误操作可致物理危害** 2. `NOW`: 书面授权必须写清：站点、网段、是否允许主动扫描/写寄存器 4. `NEXT`: tool-index；多数工控工具需手动与隔离实验网 5. `ACT`: 资产与分区识别 → 暴露面 → 只读验证 ## 适用场景 - 工控/SCADA/DCS 安全评估（授权） - Purdue 模型分区与跨区通道 - Modbus/DNP3/S7/EtherNet/IP 等协议暴露 - 工程师站、HMI、历史库、跳板主机 - IT/OT 融合边界（防火墙规则、单向闸） ## 安全铁律（MUST） ```text MUST NOT 在未明确允许时： - 对 PLC 写线圈/寄存器 - 全网高速率扫描生产 OT - 中断安全仪表系统（SIS）相关路径 优先：只读识别、流量镜像、离线固件/配置分析 ``` ## 工作流 ### Phase 1 — 分区与资产 ```text □ Purdue L0–L5 草图：现场设备 → 控制 → 监督 → 站点 DMZ → 企业 □ 资产清单：PLC/RTU/HMI/工程师站/历史库/Jump host □ 协议与端口基线（仅授权网段） ``` ### Phase 2 — 被动与只读 ```text □ SPAN/镜像 PCAP → protocol-reverse / Wireshark 工控解析器 □ 配置与工程文件离线审计（TIA/RSLogix 导出等） □ 默认口令与明文协议（Modbus 无认证）记录为 Finding，不写盘改值 ``` ### Phase 3 — 受限主动（仅授权） ```text □ 低速识别，维护窗口 □ 只读功能码优先 □ 每步 Evidence；异常立即停止并通报 ``` ### Phase 4 — 固件/补丁面 ```text □ 控制器固件版本 → CVE 映射（不盲刷固件） □ 联合 firmware-pentest 做离线镜像分析 ``` ## 工具链 | 工具 | 用途 | 注意 | |------|------|------| | Wireshark 工控 dissectors | 被动解析 | 镜像流量 | | Nmap NSE（受限） | 识别 | 速率与时间窗 | | Claroty/Nozomi 等 | 资产发现 | 商业/现场 | | PLC 厂商工程软件 | 配置审计 | 离线优先 | | binwalk / Ghidra | 固件 | 离线 | ## 参考 …
Read the whole file at its exact version.
How to install
mdr add novaestellar/novahaku/ot-ics@sha256:a3f2330e3838b3d0The line at the top of this page pins the label git:20260910.546fe86, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_bokr2urfob3mtuf4)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 10, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (2883 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
novaestellar/novahaku · 28 stars · license MIT · pushed 2026-09-28 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_bokr2urfob3mtuf4 GET https://markdownregistry.com/api/v1/resolve?ref=novaestellar/novahaku/ot-ics GET https://markdownregistry.com/api/v1/blob/a3f2330e3838b3d01279970fd8b71909d19aca490659308f06d15c0b2f74a540
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.