Wireless Assessment Plan

---
name: wireless-assessment-plan
description: "Plans authorized Wi-Fi, Bluetooth, RFID/NFC, SDR, and other radio assessments with explicit physical scope, transmission authority, disruption budgets, capture handling, coverage, and handoffs. Use before conducting or reviewing a wireless penetration test."
allowed-tools: Read Grep Glob
---

# Wireless assessment plan

Radio signals cross walls, property lines, and engagement boundaries. Receiving
a signal can be passive while retaining its content, targeting its source, or
transmitting a response creates separate scope, privacy, safety, and regulatory
questions. Model those decisions before activating test equipment.

## When to Use

- Plan wireless assessment for authorized security work.
- Use only within explicit authorization and the stated rules of engagement.

## When NOT to Use

- Do not treat this skill as permission to access, test, or change a target.
- Do not convert missing evidence into a clean result or a stronger claim.

## Workflow

1. State the objective, written authorization references, approved locations,
   technologies, actions, transmission bands, disruption budget, and data rules.
   Bind every location to the authorization that names it; do not invent a
   survey, staging, or observation area to make existing evidence fit.
2. Inventory exact radio targets. Separate in-scope systems from excluded and
   unattributed signals. An observed identifier is not proof of ownership.
3. Inventory equipment by receive, transmit, emulate, and write capability.
   Keep transmit-capable equipment disabled until the plan authorizes its use.
4. Start with passive observation. Bind identifiers, channel or frequency,
   location, time, and signal evidence before proposing active work.
5. Record every proposed action against one in-scope target, one location, one
   device, one authorization reference, a stop condition, and recovery steps.
6. Treat protocol reads, association, active enumeration, authentication,
   credential testing, impersonation, protocol writes, disruption, emulation,
   and replay as RF emission. Verify written transmission authority and the
   approved band.
7. Give disruptive work an explicit duration and affected-device ceiling.
   Availability impact includes nearby clients and safety systems, not only the
   named access point or reader.
8. Cover each declared technology across scope, passive inventory, attribution,
   trust, confidentiality, integration, client behavior, availability,
   monitoring, and data safety as applicable. Preserve blocked and delegated work.
9. Register captures containing credentials, personal data, or bystander traffic
   and assign a restricted, redacted, destroyed, or other approved disposition.
10. Delegate wired segmentation, identity infrastructure, companion apps,
    backend services, and physical-access consequences with an owner and status.

## Interpretation rules

- A visible SSID, device address, tag identifier, or signal is an observation,
  not attribution or authorization.
- A capture proves only what its location, time, receiver, and recorded band
  support. Signal strength alone does not prove physical location.
- A handshake or challenge capture does not prove a weak credential. An offline
  credential test and its result are separate evidence.
- Failure to disrupt does not prove protected management or resilient service;
  range, channel, equipment, client state, and rate can explain the result.
- A successful association does not prove segmentation failure. The downstream
  path needs its own authorized evidence or handoff.
- Receive-only authority does not permit active protocol reads, replay,
  emulation, jamming, cloning, enumeration, or writes.

## Rationalizations to reject

- **"The signal reaches us, so it is in scope."** Propagation does not establish
  ownership, attribution, or authority.
- **"It is an unlicensed band, so transmission is allowed."** Band rules,
  power limits, engagement authority, interference, and local law still apply.
- **"One short deauthentication or jam will not hurt anything."** Disruption
  needs an explicit budget and can affect bystanders or safety-relevant systems.
- **"We only captured traffic; we did not attack it."** Captures can contain
  credentials, personal data, and unrelated communications that require handling.
- **"The SSID and company name match, so this is their access point."** Names
  are forgeable. Preserve attribution as unresolved until evidence supports it.
- **"a complete record means we can transmit."** It validates the document.
  Written authorization and the operator still govern execution.