Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Asaiuta/reverse-workbench-skill --skill archive-file-triagegit clone --depth 1 https://github.com/Asaiuta/reverse-workbench-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/asaiuta/reverse-workbench-skill/archive-file-triage)<a href="https://agentmods.dev/skills/asaiuta/reverse-workbench-skill/archive-file-triage"><img src="https://agentmods.dev/badge/skills/asaiuta/reverse-workbench-skill/archive-file-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/asaiuta/reverse-workbench-skill/archive-file-triage"><img src="https://agentmods.dev/badge/skills/asaiuta/reverse-workbench-skill/archive-file-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.00784 |
| Opus 5 | $0.00051 | $0.00392 |
| Sonnet 5 | $0.00021 | $0.00157 |
| Haiku 4.5 | $0.00010 | $0.00078 |
Grade A, and why
archive-file-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
文件与归档前置分诊
在深入逆向、固件、恶意样本或取证分析前，先建立输入文件的身份与受控工作副本。这样既保留可复核证据，也避免把路径穿越、软链接、压缩炸弹或嵌套归档直接带入后续步骤。
工具与路径
先读取 ../tool-index.md；工具路径以索引为准，缺失时按现有 bootstrap 流程安装。常用工具：Get-FileHash、file、7z、tar、unzip、Expand-Archive。Windows 内置 cmdlet 可完成哈希和 ZIP 基础处理；未知格式优先通过 file 或 7z l 判别。
在构造不熟悉 CLI 参数前，先查本机帮助：
Get-Help Get-FileHash -Full
7z
file --help
unzip -h
tar --help
工作流
- 保留原件：不修改用户提供的输入；在任务目录建立单独输出目录，例如
artifacts/<样本名>/。 - 记录身份：记录完整路径、大小、修改时间和 SHA-256。需要跨报告关联时可追加 SHA-1/MD5，但 SHA-256 是主标识。
- 先识别、后列举：使用文件类型识别和归档 listing，不要直接递归解压。
- 评估解压风险：检查绝对路径、
..路径、软/硬链接、异常文件数、嵌套归档和异常解压体积。 - 受控提取：仅解压到任务专属的新目录；保留命令日志和 listing。不要执行解出的程序、脚本或安装包。
- 再次分诊：对提取结果按文件类型、哈希与目录结构做一次分类；按目标切换到
firmware-pentest/、apk-reverse/、reverse-engineering/或malware-analysis/。
最小证据记录
$input = 'C:\case\sample.bin'
$out = 'C:\case\artifacts\sample'
New-Item -ItemType Directory -Force -Path $out | Out-Null
Get-Item -LiteralPath $input | Format-List FullName,Length,LastWriteTimeUtc |
Out-File -Encoding utf8 "$out\metadata.txt"
Get-FileHash -Algorithm SHA256 -LiteralPath $input |
Format-List | Out-File -Encoding utf8 "$out\hashes.txt"
将大型清单、原始命令输出和递归结果写入文件，不要全部贴入对话。
输出要求
报告：输入路径、类型、大小、哈希（适用时）、实际命令、输出目录、重要提取路径、可疑归档行为，以及无法确认或解压失败的限制。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 50 lines · 103 tokens per session scan A 1476a4082740
archive-file-triage is a skill published in the GitHub repository Asaiuta/reverse-workbench-skill (2 stars, last pushed 25d ago), licensed MIT. It adds 103 tokens to every session and 784 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
osint-recon
A knowledge guide for open-source intelligence, or OSINT: collecting information from publicly available sources. It covers servers, websites, domains, and, when appropriate, people.
hackerone
A safety wrapper for HackerOne bug-bounty testing that reads a program's allowed targets and rules before handing each allowed asset to a penetration-testing workflow. HackerOne is a platform where companies invite researchers to report security bugs.
crypto-toolkit
A toolkit for encoding, decoding, hashing, and encrypting data in formats such as Base64, hexadecimal, URLs, JWTs, AES, RSA, and common ciphers.
redteam-cve-lookup
CVE lookup and applicability assessment domain card. Use after reconnaissance has identified products, versions, services, or fingerprints and red-team mode needs evidence-based CVE matching before deeper testing.
redteam-cve-validation
CVE validation domain card. Use after CVE lookup has produced applicable or candidate CVEs and red-team mode needs scoped evidence to decide whether to continue, pivot, or report.
secknowledge-skill
A knowledge base for testing the security of websites, software, and AI systems, including agents and language models.