Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-ai-attackgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-ai-attack)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ai-attack"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ai-attack/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ai-attack"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ai-attack.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00112 | $0.03365 |
| Opus 5 | $0.00056 | $0.01682 |
| Sonnet 5 | $0.00022 | $0.00673 |
| Haiku 4.5 | $0.00011 | $0.00336 |
Grade A, and why
re-ai-attack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AI 模型安全评估与取证（行为层）
CORE RULE：攻击面由可观测性决定，不由攻击名称决定
先问接口/资产给什么，再选攻击面——三者是三个世界：
| 可观测性 | 世界 |
|---|---|
logits available（API 返回概率/logits） |
蒸馏（soft label）、指纹、成员推断全部可用 |
labels only（API 只返回标签） |
降级：决策边界采样、黑盒迁移、影子模型 |
weights available（拿到模型文件） |
白盒：梯度方法（FGSM/PGD）、直接比对、阈值成员推断 |
同一攻击名在不同可观测性下可行性与实现完全不同——先按「输入资产盘点」确认 API 输出字段/模型文件，再选路径。
任务分类器（intent → 路径）
用户目的识别，命中即走对应分支；未命中落入下方「何时使用」判断：
| 用户目的（intent） | 路径 |
|---|---|
| 怀疑模型被复制 / 模型被盗用 / 嫌疑副本比对 | → fingerprint（模型指纹/水印检测，步骤 2） |
| 判断训练数据泄露 / 某样本是否在训练集 | → membership（成员推断，步骤 3） |
| 测试 API 是否容易被复制 / 接口可提取性 | → extraction（模型提取，步骤 1） |
| 测试鲁棒性 / 对抗样本效果 / 防御验证 | → adversarial（对抗样本评估，步骤 4） |
输入资产盘点（INPUT INVENTORY）
路径命中后先确认已有资产——不同资产组合决定可走路径，缺资产先向用户索要或说明局限：
| 资产 | 影响路径 |
|---|---|
| API endpoint（+ query budget） | extraction（步骤 1）必需——无 endpoint 无法提取 |
| model file（本地模型/权重） | fingerprint 比对与成员推断（步骤 2/3）可用；无则只能走 API 侧 |
| training dataset（疑似训练集样本） | membership（步骤 3）必需——无样本无法推断成员 |
| suspected copy（嫌疑副本） | fingerprint（步骤 2）必需——无副本无从比对 |
| baseline model（受害者/参考模型） | fingerprint 比对必需——无基线只有副本无法定指纹 |
| watermark hypothesis（水印假设） | fingerprint 水印验证（步骤 2）——有具体假设（触发集/后门）可定向验证 |
规则：intent 命中后检查该路径所需资产；缺失 → 先向用户询问（有无/能否提供），用户无法提供则说明该路径不可执行并转可用路径。
何时使用 / 何时不用
- 用：模型泄露/窃取取证、API 模型攻击评估（提取/指纹）、训练数据泄露判定、模型鲁棒性评估（对抗样本）
- 用：水印/指纹验证（嫌疑副本与受害者模型比对）
- 用：模型 API 一致性审计（同输入多查询/多端点比对，找副本/代理）
- 用：鲁棒性基线评估（上线前/防御验证前测一遍干净与扰动准确率）
- 不用：模型文件格式解析与权重提取（转 [[re-ai-model]]）；模型训练/微调（非逆向）；部署加固（防御侧不在本技能）
- 不用：无授权目标（红线：仅授权评估场景；授权边界见 [[gotchas]]）
- RE_AUTH 前置（guard 联动）：本技能 guard.require_authorization=true——执行前确认授权上下文（triage 第 0 步
RE_AUTH）：owned / ctf / research 可执行；unknown 先询问目标归属（所有权 / 测试授权 / 研究环境），未说明只做静态评估不进入动态步骤 - 不用：提示注入/提示泄露评估（LLM 侧攻击面）与 API 服务本身的注入/越权测试（应用侧漏洞不在本技能）
工具准备
python3（核心运行时）
- 各平台安装见 [[re-python]] 工具准备
模型库（torch / tensorflow，按目标格式选）
- 多平台:
pip install torch/pip install tensorflow（按硬件可选 CPU 版；按目标框架选一即可，蒸馏脚本只依赖其张量操作） - 验证:
python3 -c "import torch"
攻击评估库（ART，可选）
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 151 lines · 112 tokens per session scan A c3bb0f8eff9f
re-ai-attack is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 12d ago), licensed Apache-2.0. It adds 112 tokens to every session and 3,365 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
ctf-ai-ml
Provides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership inference, training data poisoning, fine-tuning manipulation, neural network analysis, LoRA adapter exploitation, LLM jailbreaking, or…
ai-data-security
A security-testing method for AI systems that examines data leaks, training-data exposure, and the integrity of retrieval-augmented generation (RAG) or vector databases. A vector database stores data in a form AI systems use to find related information.
prompt-injection
A security-testing method for indirect prompt injection, where instructions hidden in webpages, documents, emails, databases, or API responses influence an AI system. It also covers attacks on connected tools, retrieved data, and information handling.