Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-blockchaingit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-blockchain)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-blockchain"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-blockchain/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-blockchain"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-blockchain.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.03852 |
| Opus 5 | $0.00028 | $0.01926 |
| Sonnet 5 | $0.00011 | $0.00770 |
| Haiku 4.5 | $0.00006 | $0.00385 |
Grade C, and why
re-blockchain scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- 官方安装器（全平台，装到 `~/.foundry/bin`，含 forge/cast/anvil/chisel）: `curl -L https://foundry.paradigm.xyz | bash && foundryup` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- 官方安装器（全平台，装到 `~/.foundry/bin`，含 forge/cast/anvil/chisel）: `curl -L https://foundry.paradigm.xyz | bash && foundryup` How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
EVM 智能合约逆向（cast / panoramix / web3.py）
何时使用 / 何时不用
- 用：拿到合约字节码（链上地址或 .bin/.hex 文件）要还原逻辑——ABI 恢复、反编译、存储布局重建
- 用：合约漏洞分析（重入/整数溢出/权限）或漏洞利用前的审计定位
- 用：恶意合约/代币诈骗合约取证（链上数据获取、只读拉取）
- 不用：Solidity 源码可得且未混淆——直接读源码更准（审计思路同 [[re-vuln]]），本技能面向无源码/仅字节码
- 不用：本节未覆盖的非 EVM 链（如 WASM 系链，指令集不同）；WASM 走 [[re-wasm]]
- 注意：链上交互以只读为主（
cast call/cast code/cast storage）；任何写链/部署/动态验证默认本地 anvil 或隔离网络（[[platform-tips]] 沙箱最高原则）；合约分析基本静态，按「静态优先」执行
工具准备
python3 —— 脚本化分析基础
- Linux:
apt install python3/dnf install python3/pacman -S python - macOS:
brew install python3；Windows:choco install python - 验证:
python3 --version（本技能脚本均为 Python 3）
cast（foundry）—— 链上交互/字节码/存储主力
- 官方安装器（全平台，装到
~/.foundry/bin，含 forge/cast/anvil/chisel）:curl -L https://foundry.paradigm.xyz | bash && foundryup - macOS:
brew install foundry（官方 Homebrew formula，含四件套） - Arch: 官方仓库无 foundry——用 AUR
foundry-bin（yay -S foundry-bin等）；注意pacman -S foundry是无关的 GNOME Builder 工具包，别装错；Debian/Ubuntu/Fedora 无官方包——用官方安装器 - 验证:
cast --version && anvil --version
web3.py（pip，Python 3.8+）—— 脚本化链上分析
pip install web3（官方 PyPI，web3 7.x 要求 Python ≥3.8，PyPI 声明<4无 3.12 上限）- 验证:
python3 -c "import web3; print(web3.__version__)"
panoramix（pip，Python 3.9–3.11）—— EVM 反编译器（disasm→流程）
pip install panoramix-decompiler（官方 PyPI 0.6.x，要求 Python 3.9–3.11）；维护更活跃的 fork 为panoramix-decompiler-abi，两者都提供panoramix命令- 验证:
panoramix --help（或python3 -m panoramix --help） - 用法: 直接传原始字节码
panoramix <hex> --abi反编译；传合约地址则需WEB3_PROVIDER_URI环境变量（从链上拉字节码）；输出伪码.pan/反汇编.asm写到 cache 目录
pyevmasm（pip，Python 3）—— EVM 反汇编
pip install pyevmasm（官方 PyPI）；验证:pyevmasm -d 0x6001600101输出指令行- 备选:
cast disassemble <hex>（foundry 自带，同一用途）
hevm / echidna（可选，形式化/模糊验证）
- echidna: GitHub releases 预编译二进制（crytic/echidna）或
cargo install --locked echidna（官方仓库无发行版包；Arch 有 AUR 包）；验证:echidna --version - hevm: GitHub releases（ethereum/hevm）或 cargo 构建；验证:
hevm --version - 均为可选——先跑完步骤 1-5 的静态分析，需要行为验证再上
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 147 lines · 57 tokens per session scan C e4253a745e9e
re-blockchain is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 12d ago), licensed Apache-2.0. It adds 57 tokens to every session and 3,852 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.