Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 2233admin/reverse-skill-evolver --skill competition-firmware-layoutgit clone --depth 1 https://github.com/2233admin/reverse-skill-evolverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/2233admin/reverse-skill-evolver/competition-firmware-layout)<a href="https://agentmods.dev/skills/2233admin/reverse-skill-evolver/competition-firmware-layout"><img src="https://agentmods.dev/badge/skills/2233admin/reverse-skill-evolver/competition-firmware-layout/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/2233admin/reverse-skill-evolver/competition-firmware-layout"><img src="https://agentmods.dev/badge/skills/2233admin/reverse-skill-evolver/competition-firmware-layout.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00110 | $0.00647 |
| Opus 5.5 | $0.00044 | $0.00259 |
| Sonnet 5.5 | $0.00022 | $0.00129 |
| Haiku 4.5 | $0.00011 | $0.00065 |
Grade A, and why
competition-firmware-layout scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to competition-firmware-layout — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Competition Firmware Layout
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the hard part is understanding how a firmware image is structured, booted, updated, and turned into reachable device behavior.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Preserve the original image, extracted partitions, unpacked filesystems, and patched copies as separate artifacts.
- Map outer container, partition table, bootloader, kernel, rootfs, config, and update metadata before editing anything.
- Track the boot or update chain in order instead of jumping straight to the most interesting file.
- Record keys, signatures, offsets, partition boundaries, and init entrypoints in one compact evidence chain.
- Reproduce the decisive secret, branch, or reachable service from the smallest extracted path.
Workflow
1. Establish Image Layout
- Identify container type, partition headers, compression, filesystem type, and any appended or nested images.
- Record offsets, sizes, hashes, mount points, and partition names before extraction mutates anything.
- Separate bootloader, kernel, initramfs, rootfs, config blobs, and update metadata as different layers.
2. Trace Boot Or Update Flow
- Map how control moves from bootloader to kernel to init to services, or from update package to verifier to installer.
- Note which credentials, certificates, passwords, seeds, or config files are consumed at each stage.
- Distinguish checked-in firmware intent from the live behavior the extracted files actually support.
3. Reduce To The Decisive Path
- Show the smallest chain from image boundary to service exposure, auth bypass, debug interface, credential recovery, or flag artifact.
- Keep extracted filesystems, derived configs, and patch experiments separate from pristine inputs.
- If the challenge becomes mostly about native crash behavior or exploit primitives after extraction, switch back to the broader reverse skill.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 51 lines · 110 tokens per session scan A 32e17b49d0f3
competition-firmware-layout is a skill published in the GitHub repository 2233admin/reverse-skill-evolver (24 stars, last pushed 3d ago), licensed MIT. It adds 110 tokens to every session and 647 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to competition-firmware-layout, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
autofish-control
Control Android devices with Autofish via the af CLI. Use this skill when you need reliable observe-act-verify loops, ref-based tapping, overlay management, screenshots, and recovery steps.
flashlight
Turn the flashlight on or off.
android-adb-control
Direct control of Android physical devices and Termux environments via Android Debug Bridge (ADB).
wifi
Guide an Android Agent to inspect Wi-Fi status, scan nearby Wi-Fi networks, read configured Wi-Fi entries, connect with saved or provided credentials, disconnect, forget Wi-Fi, and use Wi-Fi settings fallbacks when Android app-layer APIs cannot complete the action.
pin-and-lock
Entering digits on native (non-IME) PIN pads, and setting/clearing a secure lock screen required by AndroidKeyStore / Keystore-backed crypto flows. Use when a task needs to unlock a device, enter a PIN, or set/clear a device lock.
core-nfc
Read and write NFC tags on iOS/iPadOS with CoreNFC — NFCNDEFReaderSession (NDEF read + writeNDEF via NFCNDEFTag: queryNDEFStatus/readNDEF/writeNDEF), NFCTagReaderSession for ISO7816/ISO15693/FeliCa/MIFARE through the NFCTag enum (.iso7816/.iso15693/.feliCa/.miFare) and PollingOption (.iso14443/.iso15693/.iso18092)…