skill-name-in-kebab-caselisted

## When to Use - Initial assessment of an unfamiliar OT network. - Investigating anomalous <device-type> behavior reported by operators. Example: "The HMI shows a pump PLC at 100 percent with no operator input." - <Describe the trigger condition here. Name the protocol, device class, or scenario.> - <Add one bullet per distinct trigger. Each must name a concrete scenario an agent can match against.> ## Prerequisites - pymodbus 3.x. Verify with `pip show pymodbus`. - nmap 7.94 or newer with NSE OT scripts. Verify with `nmap --version`. - SPAN port or network TAP on the target segment. If unavailable, use <passive-skill-name> instead. - Credentials: <list accounts and scopes, and where the agent retrieves them>. - Authorization: <named approver or approval system> sign-off before start. - Upstream skills: <skill-name> when <condition>. Leave empty if none. ### Safety This skill is <passive|active>. - Passive. Captures and inspects traffic. Sends no packets. Safe to run during normal operations. - Active. Sends packets to live devices. Requires change control approval and a tested rollback plan. Run inside an approved maintenance window. Delete the line that does not apply. ## Workflow 1. Copy the target list from <source> to `targets.txt`. One IP per line. 2. Sweep the targets: `nmap -sS -Pn -p 502 -iL targets.txt -oN results/nmap_502.txt` If no port responds, stop and report the SPAN path as suspect. 3. Parse `results/nmap_502.txt` into `devices.csv`. Columns: `