skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-bluetooth-security-assessment

Assess Bluetooth Low Energy device security by scanning, enumerating GATT services, and detecting vulnerabilities.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#wireless security#bluetooth#ble#gatt#Security assessment#bleak
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-bluetooth-security-assessment
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-bluetooth-security-assessment
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/wireless-security/performing-bluetooth-security-assessment
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-bluetooth-security-assessment

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires bleak.

What problem does it solve?

Bluetooth Low Energy devices in IoT, healthcare, and smart home environments often ship with weak or absent security controls, and manually auditing them is slow and error-prone. This Skill automates BLE security assessments so you can identify unencrypted GATT characteristics, unauthenticated read/write access, and known vulnerable device profiles before attackers do.

Core Features & Use Cases

  • BLE Device Discovery: Scan for advertising BLE devices using the Python bleak library, capturing device names, MAC addresses, RSSI, and advertised service UUIDs.
  • GATT Enumeration and Analysis: Connect to target devices, enumerate all GATT services and characteristics, and flag properties like unauthenticated read/write access on sensitive data.
  • Vulnerability Detection and Reporting: Match discovered UUIDs against known sensitive services (Heart Rate, Device Information, Battery) and produce a structured JSON report with severity ratings and remediation guidance.
  • Use Case: During an IoT penetration test, you discover a smart band advertising nearby. Use this Skill to connect, enumerate its GATT table, and confirm that its Heart Rate Measurement characteristic is readable without encryption, then document the finding with a risk score.

Quick Start

Scan for nearby BLE devices and perform a full GATT security assessment on the device named SmartBand-XR, then generate a JSON vulnerability report.

Frequently Asked Questions about performing-bluetooth-security-assessment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan for Bluetooth Low Energy devices with Python?▼

Use BleakScanner from the bleak library to discover advertising BLE devices asynchronously. The scan returns each device's name, MAC address, RSSI signal strength, and advertised service UUIDs, which you can filter to select targets.

How to enumerate GATT services on a BLE device?▼

Connect to the target with BleakClient and iterate over its GATT services, recording each service UUID and its characteristics. For every characteristic, inspect properties like read, write, write-without-response, and notify to identify unauthenticated access.

Does bleak support Bluetooth Classic devices?▼

No, bleak only covers Bluetooth Low Energy. Bluetooth Classic (BR/EDR) profiles like SDP and RFCOMM will not appear in a BLE scan and must be assessed separately with tools like hcitool, sdptool, or bettercap.

What platforms does the bleak library support?▼

bleak works on Linux with BlueZ 5.43+ and D-Bus permissions, Windows 10 version 1709 or later, and macOS 10.15+ with CoreBluetooth. All platforms require a Bluetooth adapter supporting BLE (Bluetooth 4.0+).

Why does my BLE scan show no devices nearby?▼

A device not advertising is not necessarily absent. Non-discoverable peripherals and devices using randomized resolvable private addresses hide from passive scans, so a single BleakScanner.discover() pass should not be treated as conclusive.

How do I confirm a BLE characteristic is actually exploitable?▼

Corroborate bleak results with independent tools like gatttool or bettercap's ble.enum, then prove the weakness by performing an actual unauthenticated read or write. A write property listed in the GATT table is not confirmed exploitable until an unauthenticated write succeeds.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

kismet

Detect Wi-Fi, Bluetooth, Zigbee, and SDR wireless networks passively.

Community
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
brucesongsbrucesongs
60

bluetooth-rfid-nfc

Unify Bluetooth, BLE, RFID, and NFC security assessment workflows.

Community
Advanced
matlabmatlab
995

matlab-simulate-bluetooth-network

Simulate Bluetooth system-level networks including BLE, LE Audio, and Classic BR/EDR in MATLAB.

Official
Advanced