{"id":"fe101834-ed12-4537-bec3-5e6abc192fbf","slug":"ctf-ros","kind":"skill","name":"ctf-ros","summary":"Agent skill for ROS / ROS 2 and robotics security: recon, tooling, CTF labs, CVE catalogue, hardening (condensed from awesome-ros-security).","owner":"infinitepwn","repoUrl":"https://github.com/infinitepwn/ctf-ros","license":"MIT","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"skill","createdAt":"2026-10-31T00:59:40.000Z","addedAt":"2026-11-01T13:48:49.869Z","logoUrl":"https://avatars.githubusercontent.com/u/188052472?u=51178504805f3748c41db9e2e0c42d19dbaf02e1&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools"],"tags":["ctf","penetration-testing","robotics","ros","ros2","security","sros2"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-11-01T14:13:05.872Z","sample":false,"url":"https://conduits.dev/tools/ctf-ros","language":"Shell","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# ctf-ros\n\nAn agent skill for **ROS / ROS 2 and robotics security** work: CTF challenges, authorized\npentests, and the defensive side. It is a condensed, actionable rewrite of the curated\n[awesome-ros-security](https://github.com/iotsrg/awesome-ros-security) list - every tool, CVE,\npaper and link in it is traceable back to that source, but the content is reorganised as\n\"what to do when you see X\" rather than as a link dump.\n\n```\nSKILL.md                 entry point: layer router, ROS 1 vs ROS 2, first-move table, env setup\nrecon.md                 attack surface, recon workflow, six pentest checklists\ntooling.md               tools grouped by job, each with a \"reach for it when\" column\nctf-and-labs.md          robot CTFs, practice labs, simulators, learning hardware\ncves-and-incidents.md    CVE catalogue by vendor, published incidents, fingerprint->CVE lookup\nhardening.md             SROS2 / DDS-Security, standards, hardening wins, perception defence\nresources.md             papers, talks, blogs, books, courses, communities\n```\n\n1002 lines, 267 source-verified URLs, 17 CVEs, 15 arXiv papers.\n\n## Install\n\n### Claude Code / DSH style skill directory\n\n```bash\ngit clone https://github.com/infinitepwn/ctf-ros.git\n./ctf-ros/install.sh\n```\n\n`install.sh` copies the skill into `${DSH_SKILLS_DIR:-$HOME/.dsh/skills}/ctf-ros`. Override\n`DSH_SKILLS_DIR` for any other agent that reads a skills directory:\n\n```bash\nDSH_SKILLS_DIR=~/my-agent/skills ./ctf-ros/install.sh\n```\n\n### Manual\n\nCopy the directory so that `SKILL.md` sits at the root of a folder named `ctf-ros`:\n\n```\n<skills-dir>/ctf-ros/SKILL.md\n<skills-dir>/ctf-ros/recon.md\n...\n```\n\n## How an agent uses it\n\n`SKILL.md` opens with a router table: identify the layer you were handed (live network, PCAP,\nfirmware image, source package, web dashboard, perception model, drone link, CTF bundle), then\nfollow the one reference file that matches. The frontmatter follows the common skill convention:\n\n```yaml\nname: ctf-ros\ndescription: ...when to use / when NOT to use...\nallowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch Skill\n```\n\nInside, ROS 2 is reached with `ros2 node list` / `ros2 topic echo` after setting\n`ROS_DOMAIN_ID` and `RMW_IMPLEMENTATION`; ROS 1 with `ROS_MASTER_URI` and\n`rosnode` / `rostopic` / `rosservice` / `rosparam`. Reference files are loaded on demand,\nnot up front.\n\n## Scope and safety\n\nEverything here is for **your own hardware, an explicitly authorized lab, or a CTF**. A robot is a\ncyber-physical system: a wrong message on `/cmd_vel` is not a failed request, it is a moving\nmachine. Exploit in simulation unless the engagement states that real hardware is in scope and\nnames a stop condition.\n\n## Verification\n\n- Every URL in this repo (267 unique) also appears in the upstream list; none were invented.\n- All 17 CVE identifiers and 15 arXiv identifiers match the upstream text one to one.\n- ASCII-only, one H1 per file, sibling links checked, line counts as listed above.\n- CVE identifiers are reproduced as upstream publishes them; confirm the ID and affected versions\n  against NVD or the vendor advisory before quoting one in a report.\n\n## Attribution and license\n\nContent condensed from [iotsrg/awesome-ros-security](https://github.com/iotsrg/awesome-ros-security),\nwhich builds on the work of [Alias Robotics](https://aliasrobotics.com/) and the\n[Robot Vulnerability Database](https://github.com/aliasrobotics/RVD), and on the research, vendor\nadvisories and conference talks linked inside. The skill layout and frontmatter follow the\nconventions of the [ctf-skills](https://github.com/ljagiello/ctf-skills) family by Lukasz Jagiello.\n\nReleased under the MIT license (see [LICENSE](LICENSE)). Upstream links remain the property of\ntheir authors; this repo claims no ownership over them.\n"}