Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-ctfgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-ctf)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ctf"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ctf/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ctf"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ctf.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00124 | $0.02968 |
| Opus 5 | $0.00062 | $0.01484 |
| Sonnet 5 | $0.00025 | $0.00594 |
| Haiku 4.5 | $0.00012 | $0.00297 |
Grade A, and why
re-ctf scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CTF 实践（题型识别 / 自动化解题 / 约束求解）
完整工作流
按顺序执行；每步产物（题型结论 / 关键函数地址 / 约束模型 / flag）记录证据路径 + sha256（见 [[re-triage]]），供 writeup 引用。
- 题型识别 —— 先别急着上工具，读题 + 初勘定题型（见坑 1）：
- 逆向题（rev / babyre）：给一个二进制，要求还原算法 / 找输入 / 找 flag —— 按第 2-4 步走
- 加密 / 算法题：给加密函数 / 密文，要求解出明文或逆算法 —— 涉及 [[re-crypto-id]] / [[re-crypto-decrypt]]，约束求解用 [[re-z3]]
- 序列号 / 注册类题：校验函数还原 → 注册机（见 [[re-license]] / [[re-keygen]]，硬推比较链用 [[re-z3]]）
- pwn / 栈溢出题：入门利用走 [[re-pwn]]（[[re-gdb]] / [[re-radare2]] 动态调试，运行在 [[re-sandbox]]）
- 初勘命令：
file/checksec/ 熵 / strings（[[re-triage]]），识别架构、是否带壳、是否静态链接
- 简单题直接 [[re-binary-core]] —— 题不需要自动化时，走通用分析（初勘 → 格式解析 → 反编译 → 调试）：[[re-ghidra]] / [[re-ida]] / [[re-radare2]] 反编译主逻辑，人工还原出 flag / 注册算法。先估算复杂度：几行比较 / 简单 XOR 的题 15 分钟人工就够，上 angr 反而慢（见坑 2）
- 需自动化 → [[re-angr]] / [[re-z3]]：
- 输入在长循环 / 深比较链里逐字节校验（human 逐位逆推费时、容易错）→ [[re-angr]] 符号执行（符号化输入 → find 目标地址 → 求解）
- 校验是"一组数学等式 / 比较链"（满足约束即 flag）→ [[re-z3]] 建模求解（比 angr 轻、快、稳）
- 分派细则见「选择树」
- 混淆 → [[re-deobfuscate]] —— 反编译产物有花指令 / 控制流平坦化 / 字符串加密：先还原再自动化。直接对混淆函数上 angr 会路径爆炸 / 解不出（见坑 3）；[[re-deobfuscate]] 还原后回到第 2/3 步
- 验证与产出：
- 求解出的输入跑原程序（沙箱内，[[platform-tips]] 最高原则）必须打印
flag{...}（见坑 4：flag 格式 / 与求解结果一致性） - 记录：题型、关键函数地址、约束模型、求解脚本、flag、复现命令 —— writeup 与 [[re-ioc]] 特征（如自动化解题特征）
- 求解出的输入跑原程序（沙箱内，[[platform-tips]] 最高原则）必须打印
何时用哪个原子技能（选择树）
按题型特征 / 目标分支：
- 刚拿到题，未定题型 → 第 1 步：[[re-triage]] 初勘 + 反编译扫一眼主逻辑，先人工判断（大多数简单题人工即可，别急着自动化）
- 简单 XOR / 移位 / 查表变换（≤ 一屏伪代码） → [[re-binary-core]] 人工还原（[[re-ghidra]] / [[re-radare2]]），或小规模约束直接 [[re-z3]] 建模
- 逐字节 / 逐字符长循环校验（每个字节都要满足条件，人工逆推繁琐） → [[re-angr]]（符号化输入 + find 校验通过地址）
- "满足一组等式 / 比较链即 flag / 密钥"（无循环或循环已人工展开） → [[re-z3]]（BitVec 建模 + solver 求解）
- 输入位置复杂（argv / 文件 / 标准输入 / 网络） → [[re-angr]]（符号化任意输入点，[[re-z3]] 需人工先定位变量来源）
- 花指令 / 平坦化 / 字符串加密可见 → 先 [[re-deobfuscate]] 还原，再按题型走 angr / z3 / 人工（坑 3）
- 带壳题（CTF 少见，常见于"脱壳题"）→ 先 [[re-anti-analysis]]（packer-id → unpack-*），脱壳后回本网关
- 加密 / 密码学题（AES / RSA / 自定义加密 + 密文）→ [[re-crypto-id]] 识别 → [[re-crypto-decrypt]] 还原；自定义数学关系用 [[re-z3]] 求解
- pwn 题 → [[re-pwn]]（漏洞利用入门：栈溢出 / 格式化字符串 / ret2libc）→ [[re-gdb]] / [[re-radare2]] + [[re-sandbox]] 动态调试（本网关以逆向题为主，pwn 作为相邻题型移交调试域）
- flag 解出但格式不对 → 检查大小写 / 换行 / 编码（坑 4）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 69 lines · 124 tokens per session scan A 08563ed3a67a
re-ctf is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 12d ago), licensed Apache-2.0. It adds 124 tokens to every session and 2,968 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
reverse-engineering-shellcode
Analyzes position-independent shellcode: disassembling raw bytes at the right architecture, recognizing PEB-walk API resolution and egg hunters, and emulating execution to recover behavior and payloads. Activates for requests to analyze shellcode, disassemble raw position-independent code, or emulate a shellcode blob.