Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/2233admin/reverse-skill-evolver/firmware-pentestnpx skills add 2233admin/reverse-skill-evolver --skill firmware-pentestgit clone --depth 1 https://github.com/2233admin/reverse-skill-evolverWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00215 | $0.03840 |
| Opus 5 | $0.00108 | $0.01920 |
| Sonnet 5 | $0.00043 | $0.00768 |
| Haiku 4.5 | $0.00021 | $0.00384 |
Grade A, and why
firmware-pentest scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://fccid.io/?q=$FCC_ID" This is a copy
92% identical to firmware-pentest — 16 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 346 lines — stays where its author put it; the contents beside it link to each section on GitHub.
固件 / IoT 渗透链 (Firmware Pentest)
适用范围
下列任务进入本 skill：
- 拿到一份固件文件（.bin / .img / .trx / .chk / OTA zip），需要从零到 RCE
- 路由器/摄像头/IoT 设备审计 — 需要批量发现已知 CVE 和未公开漏洞
- 加密/打包固件，需要找 bootloader 解密例程或硬件 dump
- 需要在不接触硬件的情况下跑起来（QEMU 全系统仿真 / Firmadyne / FAT）
- 对仿真起来的服务做 fuzz（AFL++ qemu mode / boofuzz）
- 硬件接口接入（UART / JTAG / SPI flash dump）
与其他 skill 分工
| 场景 | 用什么 |
|---|---|
| 从零拿到固件，全链路走 FSTM | 本 skill |
| 只做单个 ELF/so 静态逆向 | reverse-engineering/、ida-reverse/、radare2/ |
| 仿真起来后做 Web/RCE 利用 | pentest-tools/、attack-chain/ |
| 硬件接口（UART/JTAG/SPI）实操 | 本 skill 的 Stage 2 章节 + patterns-hardware.md |
| APK / Android 固件（含 boot.img） | apk-reverse/（先剥 boot.img 再用本 skill） |
| 跨版本固件符号迁移 | binary-diff/ |
核心原理
固件 .bin
│
├─ Stage 1-3: 信息收集 / 获取 / 静态分析（不解压也能看的部分）
│
├─ Stage 4: 提取文件系统 ← binwalk v3 / unblob / jefferson / ubi_reader
│ │
│ └─ 失败 → 找 bootloader 解密例程 / UART dump / SPI flash 硬件读
│
├─ Stage 5: 文件系统静态分析 ← EMBA 自动化 + 手工 grep
│
├─ Stage 6: 模拟运行 ← Firmadyne / FAT / qemu-user-static + chroot
│
├─ Stage 7-8: 动态 / 运行时分析 ← gdb-multiarch、IDA 远程调试、Ghidra
│
└─ Stage 9: 二进制利用 ← AFL++ fuzz / 手工 PoC / ARM / MIPS payload
关键判断：
- 提取失败不等于固件加密，先把 binwalk v2、binwalk v3、unblob、jefferson、ubi_reader 全跑一遍
- EMBA 一行命令出 HTML 报告，能省 80% 体力，剩 20% 是真正的漏洞挖掘
- 仿真起不来时优先怀疑 NVRAM 缺失、网卡名错配、
/dev/节点缺失 - ARM / MIPS payload 必须区分大小端（mipsel vs mipseb），别用错
OWASP FSTM 九阶段工作流
Stage 1 — 信息收集（Information Gathering）
收集型号、芯片、SDK、已公开 CVE。
# FCC ID 查询（美区设备）
curl -s "https://fccid.io/?q=$FCC_ID"
# 芯片识别参考点
echo "Realtek RTL8197 / Broadcom BCM / MediaTek MT76 / Qualcomm IPQ"
输出：芯片型号、SDK 来源（SDK 决定 binwalk 能否一把成功）。
Stage 2 — 获取固件（Obtaining Firmware）
四条路：官网下载、OTA 抓包、UART 落 shell 后 dump、SPI flash 物理读。
# OTA 抓包后批量下载
mitmdump -s save_response.py
# UART 接入（USB-TTL，常用波特率 57600 / 115200）
picocom -b 115200 /dev/ttyUSB0
# SPI flash 用 CH341A + flashrom 读
flashrom -p ch341a_spi -r dump.bin
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 346 lines · 215 tokens per session scan A b7c638f36c4c
firmware-pentest is a skill published in the GitHub repository 2233admin/reverse-skill-evolver (13 stars, last pushed 21d ago), licensed MIT. It adds 215 tokens to every session and 3,840 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 2 findings (asks for root, makes network calls). It is 92% identical to firmware-pentest, differing in 16 lines, and is treated as a copy.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
agent-host-chat-contributions
Build and review cross-cutting agent-host chat behavior through lifecycle contributions. Use when adding turn lifecycle side effects, prompt or context injection, restored-history transformation, protocol-action observation, or when reviewing changes that add code to AgentSideEffects or AgentService.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.