Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 26zl/cybersec-toolkit --skill ctf-revgit clone --depth 1 https://github.com/26zl/cybersec-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/26zl/cybersec-toolkit/ctf-rev)<a href="https://agentmods.dev/skills/26zl/cybersec-toolkit/ctf-rev"><img src="https://agentmods.dev/badge/skills/26zl/cybersec-toolkit/ctf-rev.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00086 | $0.01048 |
| Opus 5 | $0.00043 | $0.00524 |
| Sonnet 5 | $0.00017 | $0.00210 |
| Haiku 4.5 | $0.00009 | $0.00105 |
Grade A, and why
ctf-rev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CTF reverse engineering methodology
1. Triage
file ./bin
strings ./bin | head -50
strings ./bin | grep -i "flag\|ctf{\|password\|key"
xxd ./bin | head -20 # magic bytes
checksec --file=./bin # protections
2. Detect packing
# Entropy check (>7.5 = packed/encrypted)
ent ./bin # or: python3 -c "from collections import Counter; ..."
# UPX / known packers
upx -t ./bin # tests + identifies UPX
detect-it-easy-cli ./bin
diec ./bin
If UPX-packed: upx -d ./bin -o unpacked. For custom packers: dump from memory after unpacking stub runs (gdb / x64dbg).
3. Pick the decompiler
| Binary type | Best tool |
|---|---|
| ELF / PE / Mach-O | Ghidra (registry), IDA (commercial), Binary Ninja |
| Stripped ELF | Ghidra + recover symbols via FunctionID / Lumen |
| .NET (DLL/EXE) | dnSpyEx, ilspycmd, dotPeek |
| Java JAR | jadx, cfr, procyon |
| Java class | javap -c -p |
| Android APK | jadx-gui, apktool d then jadx on dex |
| iOS / Mach-O | Hopper, Ghidra |
| Go binary | redress, GoReSym, Ghidra + Go plugin |
| Rust | Ghidra + rustfilt for symbols |
| WASM | wabt (wasm-decompile), wasmer for run |
Python .pyc |
uncompyle6, decompyle3, pycdc |
| PyInstaller .exe | pyinstxtractor then pycdc on .pyc |
| Compiled Lua | unluac, luadec |
4. Dynamic analysis
# Trace
ltrace ./bin
strace ./bin
strace -f -e trace=read,write,open ./bin
# Debugger
gdb-multiarch ./bin
# pwndbg or gef extensions are loaded by default
# Fault injection / branch flipping
gdb> set $eax = 1 # change return value to bypass check
For Android: frida for runtime instrumentation, objection on top.
5. Anti-debug / anti-VM
Common checks:
ptrace(PTRACE_TRACEME)returns -1 if already debugged → patch withnop/proc/self/statusTracerPid: 0check → LD_PRELOAD a fake or patch- timing checks (rdtsc) → patch
IsDebuggerPresent()(Windows) → patch the call site
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 109 lines · 86 tokens per session scan A bcb303573b9b
ctf-rev is a skill published in the GitHub repository 26zl/cybersec-toolkit (49 stars, last pushed today), licensed MIT. It adds 86 tokens to every session and 1,048 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
argus
Argus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin reflection / null / credentialed read), CRLF & host-header injection, NoSQL injection (operator auth-bypass / $where blind), JWT attacks (alg:none / RS256→HS256 confusion / secret crack)…
exploiting-linux-kernel-vulnerabilities
Methodology for discovering and exploiting Linux kernel memory-corruption vulnerabilities (UAF, OOB read/write, race/TOCTOU, type confusion) during authorized engagements, covering reachability analysis, building stable read/write primitives from a single bug, defeating KASLR/SMEP/SMAP/KPTI, slab/buddy heap grooming…
exploiting-format-string-vulnerabilities
Methodology for exploiting format string bugs where attacker-controlled data reaches the format argument of printf-family functions, enabling stack/memory disclosure (info leaks for ASLR/PIE/canary defeat) and arbitrary write primitives (%n) to hijack control flow via GOT/.finiarray overwrites.
exploiting-integer-overflow-vulnerabilities
Methodology for finding and exploiting integer overflow, underflow, truncation, and signedness bugs in native code during authorized engagements, focusing on how wrapped arithmetic in size/length calculations leads to undersized allocations, oversized copies, length-check bypasses, and downstream heap/stack overflows.
investigating-windows-endpoints
Investigate a live or triaged Windows host for intrusion evidence using disk and registry artifacts — MFT/$UsnJrnl, registry hives, AmCache/ShimCache, Prefetch, LNK/JumpLists, ShellBags, and event logs — parsed with the Eric Zimmerman suite and consolidated into a timeline. Use when a Windows endpoint is suspect and…
reverse-engineering
Progress binary analysis from sample intake through static, anti-analysis, unpacking, dynamic tracing, VM reverse engineering, and symbolic review.