Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-electrongit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-electron)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-electron"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-electron/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-electron"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-electron.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 11 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 34 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 35 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 36 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 91 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 92 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 93 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 53 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 60 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 61 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 97 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 125 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.05182 |
| Opus 5 | $0.00046 | $0.02591 |
| Sonnet 5 | $0.00018 | $0.01036 |
| Haiku 4.5 | $0.00009 | $0.00518 |
Grade A, and why
re-electron scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- 备选: 纯 curl + Node 内置 ws，无需装包（`curl http://127.0.0.1:<port>/json/list` 拿 `webSocketDebuggerUrl` 后连 WebSocket 发 JSON-RPC） How it starts
The opening of the file, as written. The whole thing — 169 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Electron 桌面应用逆向（asar / CDP / .jsc）
何时使用 / 何时不用
- 用：Electron 打包桌面应用——
resources/app.asar结构、主/渲染进程 JS 逻辑还原、原生.node模块、密钥/通信逻辑提取 - 用：V8 字节码
.jsc文件（bytenode 类工具编译产物）的识别与边界判断 - 用：动态调试——主进程
--inspect、渲染进程--remote-debugging-port（CDP）、ELECTRON_RUN_AS_NODE以 Node 模式复用运行时 - 用：反调试对抗——devtools / inspect 检测识别与绕过（联动 [[re-evasion]]）
- 不用：纯浏览器扩展（走 [[re-browser-ext]]）
- 不用：脱离 Electron 场景的混淆 JS/脚本（走 [[re-script-deob]] / [[re-deobfuscate]]）
- 不用：
.jsc出现在 Cocos 游戏资源场景（那是 Cocos 引擎字节码，走 [[re-game]]；本技能只管 Electron 的 V8 字节码） - 不用：仅需通用二进制初勘（[[re-binary-core]] 通用底座；本技能只补 Electron 打包层语义）
- 注意：动态执行默认沙箱（[[platform-tips]] 最高原则）——跑应用、连 CDP、加载
.jsc均按动态处理，静态解包可免沙箱
工具准备
所有工具先验证再使用。静态解包可免沙箱；运行应用 / 动态调试默认沙箱 + 网络隔离（[[platform-tips]] 最高原则）。Electron 应用多为跨平台打包，工具链以 npm 生态为主、跨 OS 一致。
Node.js + npm —— 工具底座（asar / CDP 客户端 / bytenode / fuses）
- Linux: 发行版包
apt install nodejs npm（Debian/Ubuntu 仓库版本偏旧，V8 版本锁场景用 NodeSource 或 nvm 装新版）；macOS:brew install node；Windows: 官方安装器或choco install nodejs；跨平台: nvm（nvm install <version>）按需切换 Node 版本 - 验证:
node --version && npm --version - nvm: 官方安装脚本（GitHub nvm-sh/nvm）；Windows 用 nvm-windows 或官方安装器
@electron/asar —— asar 归档解包（现维护的官方包）
npm install -g @electron/asar或免安装npx @electron/asar ...（npx 首次自动下载；旧包名asar已弃用但 CLI 兼容仍可用）- 验证:
npx @electron/asar --help（应列出pack / list / extract-file / extract子命令） - 用法:
npx @electron/asar extract app.asar out/（整包解出）、npx @electron/asar list app.asar（列目录）、npx @electron/asar extract-file app.asar path/to/file（单文件） - 免工具直读：asar 头部内嵌 JSON 目录（
{"files":{...}}，每文件含size/offset/integrity），JSON 字符串自偏移 16 起（前 12 字节为 pickle 嵌套大小字段，offset 12 为头字符串长度，均 uint32 LE）——strings app.asar | grep '"files"'或小脚本JSON.parse定位，无需任何工具
strings / grep —— 文本线索
- Linux: binutils 自带（
apt install binutils等）；macOS: 自带（或brew install binutils）；Windows: WSL 内或 Sysinternals strings - 验证:
strings --version
chrome-remote-interface —— CDP 客户端（动态调试主力）
- 项目内
npm install chrome-remote-interface（官方 npm 包，Chrome DevTools Protocol 客户端） - 验证:
node -e "require('chrome-remote-interface')"不报错即装好；实际连通见操作步骤 6 - 备选: 纯 curl + Node 内置 ws，无需装包（
curl http://127.0.0.1:<port>/json/list拿webSocketDebuggerUrl后连 WebSocket 发 JSON-RPC）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 169 lines · 91 tokens per session scan A be60d67dba35
re-electron is a skill published in the GitHub repository dslsdzc/rev-skills (50 stars, last pushed 11d ago), licensed Apache-2.0. It adds 91 tokens to every session and 5,182 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.