Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/dslsdzc/rev-skillsnpx agentmods add skills/dslsdzc/rev-skills/re-crash-triageWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-crash-triage)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-crash-triage"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-crash-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-crash-triage"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-crash-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 11 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 48 Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
- medium Privilege Escalation · line 24 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 25 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 31 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 32 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 33 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 40 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 41 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 126 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 48 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 52 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00114 | $0.02760 |
| Opus 5 | $0.00057 | $0.01380 |
| Sonnet 5 | $0.00023 | $0.00552 |
| Haiku 4.5 | $0.00011 | $0.00276 |
Grade B, and why
re-crash-triage scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- clang: `sudo apt install clang` / `sudo dnf install clang` / `sudo pacman -S clang` / macOS Xcode 自带 How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
崩溃分析与漏洞定位（crash triage）
何时使用 / 何时不用
- 用：fuzz 产出崩溃输入；程序段错误/abort；需要判断崩溃是否真实漏洞（可达性）并产出最小 PoC；多线程/非确定性崩溃需复现
- 不用：还没崩溃、要主动找 bug（→ [[re-fuzzing]]）；崩溃已定位、需要深挖函数逻辑（→ [[re-binary-core]] 底座）
- 不用：只需要看符号栈（直接 [[re-gdb]] 亦可，但本技能含完整"复现→最小化→定位→PoC"流程）
工具准备
所有工具先验证再使用。复现崩溃是动态执行，默认沙箱内跑（[[platform-tips]] 最高原则，见 [[re-sandbox]]）。
ASAN / UBSAN —— 内存与未定义行为检测（clang/gcc 内置）
- clang:
sudo apt install clang/sudo dnf install clang/sudo pacman -S clang/ macOS Xcode 自带 - gcc: Debian/Ubuntu
sudo apt install gcc（ASAN 内置在 gcc，无独立包）；Fedorasudo dnf install gcc；Archsudo pacman -S gcc - 编译:
gcc -fsanitize=address,undefined -g -fno-omit-frame-pointer -o target_asan target.c（clang 参数相同） - 验证: 写一个数组越界小程序编译运行，确认输出含
AddressSanitizer字样
gdb —— 回溯与 core 分析
- Debian/Ubuntu:
sudo apt install gdb - Fedora/RHEL:
sudo dnf install gdb - Arch:
sudo pacman -S gdb - macOS:
brew install gdb（需 codesign 授权）；Xcode 自带 lldb 亦可（见 [[re-lldb]]） - Windows: WSL 内 Linux 版；Windows 本机用 WinDbg（[[re-windbg]]）
- 验证:
gdb --version
rr —— 录制/重放（非确定性崩溃）
- Debian/Ubuntu:
sudo apt install rr（universe 仓库） - Fedora/RHEL:
sudo dnf install rr - Arch:
paru -S rr（AUR 包；官方仓库无 rr） - macOS: 无支持（rr 仅支持 Linux，官方原话 "Apple hardware is fine, Apple software is not"）；Apple Silicon 用户用 Asahi Linux 或 Linux 虚拟机（需 PMU 透传）
- Windows: WSL2 内 Linux 版
- 源码编译:
git clone https://github.com/rr-debugger/rr && mkdir rr/obj && cd rr/obj cmake -DCMAKE_BUILD_TYPE=Release ../rr && make -j$(nproc) && sudo make install - 前置: Linux 内核 3.11+（建议 4.7+）；
perf_event_paranoid> 1 时超慢，先放开：sudo sysctl kernel.perf_event_paranoid=1 - 虚拟机内需 PMU 透传（VMware/KVM 可，VirtualBox 不可）
- 验证:
rr --version
afl-tmin / afl-cmin —— 输入最小化与去重（随 AFL++ 安装）
- 安装见 [[re-fuzzing]] 的 AFL++ 一节（
afl-tmin/afl-cmin随包安装） - 验证:
afl-tmin -h
操作步骤
按顺序执行；崩溃输入与 PoC 先 sha256 存证（[[re-triage]] 方法）。
- 确定性复现：
sha256sum crash_input > crash_input.sha256 ./target < crash_input # stdin 输入 ./target crash_input # 文件输入 ./target -f crash_input # 按目标实际参数形态- 连续跑 3 次都崩 = 确定性崩溃，继续第 2 步；时崩时不崩 = 非确定性（多线程/未初始化/ASLR），跳到第 4 步用 rr
- core dump 开启（崩溃后留 core 供分析）:
ulimit -c unlimited；cat /proc/sys/kernel/core_pattern若指向 systemd-coredump/apport 则 core 会被系统收走（见坑 4）
- ASAN 报告解读（目标须为
-fsanitize=address -g -fno-omit-frame-pointer构建，见工具准备）：heap-buffer-overflow/stack-buffer-overflow/global-buffer-overflow：越界读写——报告含越界方向（READ of size N/WRITE of size N）与越界偏移heap-use-after-free：UAF——看freed by与allocated by两段栈，找释放点与再使用点attempting double-free：重复释放SEGV：空指针/野指针访问，细节需 gdb 补（第 4 步）- 关键：
#0帧是崩溃点，别只看行号——结合数据流向判断是哪个输入字节导致
- 输入最小化：
afl-tmin -i crash_input -o crash.min -- ./target @@ # 多个崩溃输入先按路径去重： afl-cmin -i crashes_dir -o minimized -- ./target @@- afl-tmin 产出保持崩溃的最短输入；可再手工删头/尾字节验证（二分查找最小边界）
- 最小化后输入即 PoC 底稿；崩溃类型保持 = 同一 bug 的判定依据
- gdb 回溯定位：
gdb -q ./target (gdb) set disable-randomization on # 关 ASLR 便于地址对照 (gdb) run crash.min (gdb) bt # 完整回溯 (gdb) info registers # 崩溃点寄存器 (gdb) x/16i $pc # 崩溃点反汇编- core 文件分析：
gdb -q ./target /path/to/core bt全是??（无符号）：记模块基址 + 偏移，进 [[re-ghidra]] / [[re-ida]] 反编译补帧（见坑 5）- 非确定性崩溃 → rr 录制重放：
rr record ./target crash_input rr replay # 打开 gdb 会话 (rr) continue # 跑回崩溃点 (rr) bt (rr) reverse-continue # 崩溃前反向执行找根因
- core 文件分析：
- PoC / 报告：
- PoC：
crash.min+ sha256 + 复现命令（环境：ASAN 构建参数、运行参数、输入通道） - 报告要点：崩溃类型（ASAN 类别）、崩溃点函数/行/偏移、数据流向（哪个输入字节 → 越界下标）、根因（长度校验缺失 / 索引未验证 / 释放后使用）、可达性（见坑 3：崩溃路径真实可触达、输入可控）、影响评估（越界读→信息泄露、越界写→RCE、纯崩溃→DoS）、修复建议
- 产出：PoC hash 与崩溃特征可进 [[re-ioc]]
- PoC：
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 128 lines · 114 tokens per session scan B c695c520964b
re-crash-triage is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 13d ago), licensed Apache-2.0. It adds 114 tokens to every session and 2,760 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.