Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-attributiongit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-attribution)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-attribution"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-attribution/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-attribution"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-attribution.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.02835 |
| Opus 5 | $0.00031 | $0.01418 |
| Sonnet 5 | $0.00012 | $0.00567 |
| Haiku 4.5 | $0.00006 | $0.00283 |
Grade A, and why
re-attribution scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
威胁归因（APT Attribution）
何时使用 / 何时不用
- 用：情报归因请求（「谁干的」）、多事件串并（判断几起事件是否同一活动）、基础设施关联分析、样本/能力到攻击者的推理
- 用：受害环境的攻击者画像（时间线、TTP、基础设施特征综合）
- 用：同组活动排查（一次事件 → 找同基础设施/同能力的其他事件，先关联再定级）
- 不用：单个 IOC 查询（转 [[re-ti]]）；恶意行为判定（转 [[re-behavior]]）
- 不用：司法证据链（刑事标准高于情报归因，本技能结论不能直接作为司法证据，见 [[gotchas]]）
- 不用：只有单角证据时做组织级归因（仅样本或仅域名不支撑归因声明，分支判断见 [[decision-tree]]）
工具准备
关联查询工具（Passive DNS / 证书透明 / Whois）
- whois CLI（注册信息/ASN 归属）：Linux
apt install whois/dnf install whois；macOSbrew install whois；Windows 用 WSL 分支（见 [[platform-tips]]） - python-whois（Python 模块）：多平台
pip install python-whois；验证:python3 -c "import whois" - dnsx（DNS 枚举）：官方渠道为 Go 二进制——GitHub
projectdiscovery/dnsxreleases 或go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest；验证dnsx -version（PyPI 同名包与官方工具无关，别混用） - 证书透明日志：crt.sh 网页查询（公开服务，按域名/证书指纹检索）
- ASN 归属查询：
whois -h whois.cymru.com <IP>返回 AS 号与归属（Team Cymru 公开接口）
MISP（情报关联与共享）
- Docker 部署（官方安装脚本/镜像，
apt install misp在发行版源不存在）或轻量替代（本地 CSV/图文件） - 验证: 登录 MISP UI 能创建/检索事件（轻量替代用数据导入脚本自检）
图分析（基础设施关系）
- 多平台:
pip install networkx（python 图分析）；验证:python3 -c "import networkx"
操作步骤
按顺序执行；全部内容脱敏处理（红线：不指向具体组织/受害者身份，只用代号与抽象描述）。
-
钻石模型定位：
- 四角：受害者（已明确）/ 基础设施（C2 域名/IP/证书）/ 能力（工具/样本/漏洞利用）/ 对手（待推断）
- 活动线：把事件建模为元组（时间、对手、能力、基础设施、受害者），多事件按共享元素连成活动线
- 元数据要素：时间窗、受害域、行业属性——用于聚类与时间线（不单独作证据）
- 四角信息表字段：每角列（已知项/未知项/来源/查询时间），未知项就是归因缺口
- 产出：四角已知信息表 + 缺失角（归因目标）
- 规则：只有两角以上才能开始推理；单角（仅样本）不支撑归因声明（判据见 [[decision-tree]]）
- 单角输出形态：只有 1 角时交付「情报线索」级（IOC 清单 + 特征描述），标注「未进入归因」，不写组织名
-
基础设施图谱：
# 域名/IP/证书关联聚类（示例流程，工具可替换） # 1) 收集 C2 域名/IP → whois 注册信息（注册者/邮箱/NS/ASN） # 2) 证书透明日志（crt.sh）查共用证书 → 关联其他域名 # 3) dnsx 主动枚举关联子域/NS 记录（被动 DNS 接口看解析历史） # 4) networkx 图聚类：共享注册者/证书/NS/ASN 的节点合并- 聚类特征按区分度排序：唯一注册邮箱/证书 > 共用 NS/ASN > 同托管商
- 被动 DNS 关注点：域名首次解析时间、解析 IP 段切换史、历史 NS 变化（注册人操作习惯特征）
- IP 段特征：段内其他域名的用途/注册时间（同类活动聚集是弱线索，需排除托管商批量注册）
- Whois 隐私保护：注册信息可能匿名（GDPR 后常见）——注册者字段不可用时降级用证书/NS/行为特征交叉，标注注册信息盲区
- 域名相似性（同后缀/typosquat）只作弱线索：注册商与注册时间都可伪造
- 跳板/托管商共存不能作为归属证据（见坑 1 与 [[gotchas]]）
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 120 lines · 62 tokens per session scan A 34ff8705cb95
re-attribution is a skill published in the GitHub repository dslsdzc/rev-skills (50 stars, last pushed 11d ago), licensed Apache-2.0. It adds 62 tokens to every session and 2,835 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.