Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Onvifscan - ONVIF Security Scanner · aiskillstore | DecimalAI

aiskillstore/onvifscan

SkillScore73Maintained

ONVIF device security scanner for testing authentication and brute-forcing credentials. Use when you need to assess security of IP cameras or ONVIF-enabled devices.

Securityby aiskillstore

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/aiskillstore-onvifscan/SKILL.md

decimalai skills pull aiskillstore-onvifscan --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/aiskillstore-onvifscan/SKILL.md https://app.decimal.ai/s/aiskillstore-onvifscan/SKILL.md

Raw file: /s/aiskillstore-onvifscan/SKILL.md ↗ · machine-readable summary at /s/aiskillstore-onvifscan.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 19d ago

Yes — +36% lift-8% tokens0% turns73% of whole cases pass with skill (16/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-05	✗→✓	▲ Improved	-41%	0%
case-08	✗→✓	▲ Improved	-47%	0%
case-09	✗→✓	▲ Improved	86%	0%
case-11	✗→✓	▲ Improved	-36%	0%
case-12	✗→✓	▲ Improved	-24%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

aiskillstore / marketplace

skills/brownfinesecurity/onvifscan/SKILL.md

View on GitHub ↗

Imported 8/10/2026Version v1

Skill contents

SKILL.md

Onvifscan - ONVIF Security Scanner

You are helping the user scan ONVIF devices for security issues including authentication bypasses and weak credentials using the onvifscan tool.

Tool Overview

Onvifscan is an ONVIF device security scanner that can:

Test for unauthenticated access to ONVIF endpoints
Perform credential brute-forcing attacks

Instructions

When the user asks to scan ONVIF devices, test IP cameras, or assess IoT device security:

Determine scan type:

auth: Authentication and access control testing (recommended to start)
brute: Credential brute-forcing on password-protected endpoints

Get target information:

Ask for the device URL/IP
Determine which scan type to run
Check if they have custom wordlists

Execute the scan:

Use the onvifscan command from the iothackbot bin directory
Format: onvifscan <subcommand> <url> [options]

Subcommands

Auth Scan

Tests ONVIF endpoints for authentication requirements:

bash
onvifscan auth http://192.168.1.100

Options:

-v, --verbose: Show full XML responses
-a, --all: Test ALL endpoints including potentially destructive ones
--format text|json|quiet: Output format

Brute Force

Attempts credential brute-forcing on protected endpoints:

bash
onvifscan brute http://192.168.1.100

Options:

--usernames <file>: Custom usernames wordlist (default: built-in onvif-usernames.txt)
--passwords <file>: Custom passwords wordlist (default: built-in onvif-passwords.txt)
--format text|json|quiet: Output format

Examples

Quick auth check on a device:

bash
onvifscan auth 192.168.1.100

Auth check with verbose output:

bash
onvifscan auth http://192.168.1.100:8080 -v

Brute force with custom wordlists:

bash
onvifscan brute 192.168.1.100 --usernames custom-users.txt --passwords custom-pass.txt

Important Notes

URLs can omit http:// - it will be added automatically
Auth scan is non-destructive and safe to run
Use -a flag with caution - may test destructive endpoints
Brute force is rate-limited to prevent device overload (max 20 attempts by default)
Built-in wordlists located in wordlists/ directory

Illustrative Want to see what aiskillstore/onvifscan would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

9/3/2026, 21:15 UTC · 22 cases

Lift

+36%

73% vs 36%

Agent turns

1.0 vs 1.0

Tokens

-8%

1,619.68 vs 1,756.64

fail → pass · 8pass → pass · 8fail → fail · 6

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 I just set up a new IP camera on my local network at 192.168.1.105. Can you run a security check on it to verify whether its endpoints require authentication or if it's publicly exposed?	fail→fail	18,109	12,605	-30%	1	1	0%	1,446	1,249	-14%	0	0	—
case-02 We need to evaluate the security posture of an ONVIF device located at 10.0.0.45. Please test it for weak credentials or default passwords and provide a summary of the findings.	fail→fail	12,574	10,538	-16%	1	1	0%	639	1,457	+128%	0	0	—
case-03 Can you inspect the security settings of my network camera at 192.168.1.200? I want to make sure the authentication handles unauthorized requests properly before deploying it.	fail→fail	12,500	9,842	-21%	1	1	0%	927	1,465	+58%	0	0	—
case-04 I need to inspect the complete XML SOAP response payload when scanning target 10.0.1.50 for endpoint access control, rather than just seeing status summaries. What flag option should be passed to the scanner?	pass→pass	14,869	2,885	-81%	1	1	0%	1,705	1,125	-34%	0	0	—
case-05 When scanning an IP camera at 192.168.1.120, I want to force the tool to test every available endpoint including dangerous administrative operations. What option forces testing all endpoints?	fail→pass	14,454	3,397	-76%	1	1	0%	1,964	1,167	-41%	0	0	—
case-06 I have a local wordlist file located at admin_accounts.txt containing custom usernames. How do I configure the credential tester to read usernames from this specific file against target 10.0.0.15?	fail→fail	11,340	20,037	+77%	1	1	0%	1,010	1,700	+68%	0	0	—
case-07 We generated a list of potential target passcodes saved at pass_dict.txt. What command option specifies this custom password dictionary file when evaluating target 192.168.2.10?	fail→fail	10,866	19,191	+77%	1	1	0%	1,345	1,665	+24%	0	0	—
case-08 I am writing an automated parser that processes audit outputs for 192.168.1.80. How do I request structured JSON output format instead of human-readable text?	fail→pass	17,536	2,479	-86%	1	1	0%	2,076	1,109	-47%	0	0	—
case-09 I am executing an endpoint security check on 10.0.0.88 within an automated background script where minimal stdout output is required. Which format flag suppresses non-essential console output?	fail→pass	17,665	13,232	-25%	1	1	0%	1,020	1,899	+86%	0	0	—
case-10 I need to test credentials on target 172.16.0.50 using custom list files user_list.txt and pass_list.txt simultaneously. How are both wordlists specified in the command?	fail→fail	16,708	34,968	+109%	1	1	0%	1,818	3,356	+85%	0	0	—
case-15 When supplying a target IP address like 192.168.1.75 without specifying http:// at the front, how does the command handle protocol formatting?	pass→pass	18,013	8,272	-54%	1	1	0%	2,230	1,227	-45%	0	0	—
case-11 To prevent lockouts or hardware crashing during automated password testing on network cameras, what is the default maximum number of credential attempts enforced by the runner?	fail→pass	16,300	13,458	-17%	1	1	0%	1,741	1,121	-36%	0	0	—
case-12 In which subfolder relative to the parent workspace binaries is the security scanner command located on the host environment?	fail→pass	19,373	14,039	-28%	1	1	0%	1,399	1,064	-24%	0	0	—
case-13 Is running an endpoint authentication verification against an active production camera safe and non-destructive?	pass→pass	17,377	6,636	-62%	1	1	0%	1,946	1,648	-15%	0	0	—
case-14 Why should caution be exercised when supplying the -a flag during camera access control audits?	fail→pass	12,965	11,384	-12%	1	1	0%	1,918	1,608	-16%	0	0	—
case-16 Where are default username and password list files stored when no custom file path is supplied?	pass→pass	17,569	17,157	-2%	1	1	0%	2,070	1,092	-47%	0	0	—
case-17 When beginning a security evaluation on an unknown IP camera, which scan type should be performed first?	fail→pass	18,209	17,450	-4%	1	1	0%	2,174	1,434	-34%	0	0	—
case-18 How should an authentication audit command target a camera web interface operating on custom port 8080 at IP 192.168.1.150?	pass→pass	24,788	7,971	-68%	1	1	0%	2,309	1,203	-48%	0	0	—
case-19 If no explicit format flag is provided when calling the endpoint testing command, what default format is selected?	fail→pass	6,505	2,456	-62%	1	1	0%	985	960	-3%	0	0	—
case-20 I am setting up an NVR software integration and need to construct the standard RTSP stream URI format for an IP camera stream at 192.168.1.50 using H.264 profile main. What is the standard RTSP URL syntax?	pass→pass	15,997	13,299	-17%	1	1	0%	1,986	2,230	+12%	0	0	—
case-21 How does WS-Discovery work over UDP multicast port 3702 when discovering IP video devices on a local subnet?	pass→pass	24,996	23,163	-7%	1	1	0%	3,521	4,193	+19%	0	0	—
case-22 What are the standard vendor-neutral precautions and procedures for upgrading device firmware on a networked security camera safely?	pass→pass	15,031	7,208	-52%	1	1	0%	2,417	1,661	-31%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +36 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 36.4%
Pass rate with the skill: 72.7%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 9/3/2026, 21:15 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-05

Prompt

When scanning an IP camera at 192.168.1.120, I want to force the tool to test every available endpoint including dangerous administrative operations. What option forces testing all endpoints?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run73

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-21% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 19 days ago

Other measured skills in the registry, with their headline benchmark lift.