Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-crypto-idgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-crypto-id)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-crypto-id"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-crypto-id/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-crypto-id"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-crypto-id.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.03315 |
| Opus 5 | $0.00022 | $0.01657 |
| Sonnet 5 | $0.00009 | $0.00663 |
| Haiku 4.5 | $0.00004 | $0.00331 |
Grade A, and why
re-crypto-id scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
加密算法识别
何时使用 / 何时不用
- 用：拿到密文（流量或数据 blob）不确定是什么算法时
- 用：样本里有加密实现，需要在反编译前先锁定算法范围
- 用：怀疑自定义加密（XOR/ROL/ROR 变换）而非标准算法
- 不用：算法已知（直接用 [[re-crypto-keys]] 找密钥、[[re-crypto-decrypt]] 解密）
- 不用：标准库 API 调用清晰可见（
CryptEncrypt/OpenSSL 符号可直接查——见 [[re-crypto-keys]] 导入表线索） - 不用：纯静态就能判定是明文（[[re-triage]] 熵低/可读字符串多）
工具准备
所有工具先验证再使用。本技能以静态/离线分析为主，可免沙箱；动态确认环节（Frida）只针对已运行样本（默认沙箱，[[platform-tips]] 最高原则）。
python3 —— 指纹与熵分析脚本
- 安装与验证见 [[re-proto-rev]] 工具准备（python3）
binutils —— strings/objdump 取常量与反汇编线索
- Linux:
apt install binutils/dnf install binutils/pacman -S binutils（多数自带） - macOS:
brew install binutils（或系统自带 otool 替代） - Windows/WSL: WSL 内 Linux 版；Windows 本机用 Ghidra 自带工具
- 验证:
strings --version；objdump --version
hexdump —— 十六进制查看密文/常量
- 安装与验证见 [[re-fw-extract]] 工具准备（hexdump）
Detect It Easy（DIE）—— 可选，快速签名识别（Windows 常用）
- Windows: GitHub releases 下载便携版 https://github.com/horsicq/Detect-It-Easy（`diec.exe` CLI /
die.exeGUI）；choco install die（部分镜像有） - Linux: AUR
yay -S detect-it-easy或 releases 的 Linux 版 - macOS: 源码构建（Qt 依赖）或 Wine 跑 Windows 版
- 验证:
diec --help输出用法；diec sample.bin能输出签名
操作步骤
按顺序执行，每步记下结果。判定产物（算法假设 + 证据）传给 [[re-crypto-keys]] / [[re-crypto-decrypt]]。
- 常量表指纹（AES S-box / CRC 表 / MD5 IV）：
# 静态数据段找常量表候选：连续 256 字节、熵低、无 ASCII strings -n 8 sample.bin | head -50 objdump -s -j .data sample.bin | head -60 # 搜索 AES S-box 开头（前 16 字节特征） python3 - <<'EOF' data = open('sample.bin','rb').read() aes_sbox = bytes.fromhex('637c777bf26b6fc53001672bfed7ab76') crc32_tab_be = bytes.fromhex('0000000077073096ee0e612c990951ba') # 标准 CRC32 表前 16 字节（poly 0xEDB88320，显示序/BE） crc32_tab_le = bytes.fromhex('00000000963007772c610eeeba510999') # 同一表在 x86/ARM 小端二进制内存中的字节序 for name, sig in [('AES_SBOX', aes_sbox), ('CRC32_TAB(BE)', crc32_tab_be), ('CRC32_TAB(LE)', crc32_tab_le)]: i = data.find(sig) while i != -1: print(f"{name} @ 0x{i:x}"); i = data.find(sig, i+1) EOF- 命中 AES S-box（256 字节表）→ AES 候选；命中 CRC 表 → 有 CRC/校验（可能配合 [[re-proto-rev]] 步骤 3）；命中 MD5 IV → MD5 候选
- 字节序：上面列出的 hex 均为显示序（BE 阅读序）。小端二进制（x86/ARM）里常量表在内存中的实际字节为 LE 序——CRC 表同时搜
00000000963007772c610eeeba510999（脚本已含），MD5 IV 显示序为67452301efcdab89...，LE 序列化为0123456789abcdeffedcba9876543210（两种模式都搜） - 没命中 → 不排除动态生成表（见坑 2），继续下一步
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 139 lines · 44 tokens per session scan A 2155446ca2c7
re-crypto-id is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 12d ago), licensed Apache-2.0. It adds 44 tokens to every session and 3,315 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.