Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-filelessgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-fileless)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-fileless"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-fileless/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-fileless"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-fileless.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 48 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.03213 |
| Opus 5 | $0.00024 | $0.01606 |
| Sonnet 5 | $0.00010 | $0.00643 |
| Haiku 4.5 | $0.00005 | $0.00321 |
Grade A, and why
re-fileless scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 117 lines — stays where its author put it; the contents beside it link to each section on GitHub.
无文件恶意软件分析
何时使用 / 何时不用
- 用：样本不落盘（无文件）——内存执行、PowerShell 下载执行、WMI/计划任务、注册表运行键承载载荷
- 用：回答"无文件载荷怎么进来、怎么执行、怎么持久化"三条链
- 用：杀软/EDR 告警只有行为与网络特征、没有文件物证的分析（与 [[re-evasion]] 的 AMSI/ETW 对抗衔接）
- 不用：有落盘样本的常规行为分析（那是 [[re-behavior]]）；纯脚本静态解码（那是 [[re-script-deob]]）
- 不用：只分析载荷本体不关心执行链（转 [[re-binary-core]] / [[re-shellcode]]）
- 注意：本技能以 Windows 为主（无文件/注册表/WMI/计划任务均为 Windows 生态）；Linux/macOS 的对应物（bash/python 内存执行、LD_PRELOAD、systemd timer/crontab）按同一"执行链还原"框架套用
工具准备
无文件分析 = 动态执行 + 内存取证 + 脚本解码三线并行，全程在沙箱内（[[re-sandbox]] 强制前置，[[platform-tips]] 最高原则）。所有工具先验证再使用。
动态分析环境（强制前置）
- [[re-sandbox]]: VM 快照 + 网络隔离（INetSim / fake DNS / 断网）——无文件样本常实时外联下载下一层，隔离必须先行
- [[re-tracing]]: 系统调用/进程行为跟踪（Windows procmon / Linux strace）
- 验证: 沙箱内
ping 8.8.8.8不通；procmon/strace 能记录样本进程事件
内存转储与提取（[[re-memdump]] 联动）
- gcore（Linux）/ procdump（Windows）: 默认转储优先，见 [[platform-tips]]「直读 vs 转储」决策表
- 验证:
gcore --help（安装见 [[re-memdump]] 工具准备）；Windows 侧 Sysinternals procdump（choco install sysinternals套件内）
PowerShell 分析（[[re-script-deob]] 联动）
- pwsh: Windows 内置；Linux:
apt install powershell（Microsoft 源）或snap install powershell；macOS:brew install --cask powershell - 验证:
pwsh --version；静态解码细节（-enc 解码、IEX 链、AST 提取）见 [[re-script-deob]]
Sysinternals 套件（Windows 行为与持久化主力）
choco install sysinternals（procmon / Process Explorer / autoruns / procdump）- 验证: 管理员运行 Procmon64.exe 能记录事件；
autorunsc64.exe -a * -c能导出全部启动项 - 补充（可选）: Sysmon（微软官网下载）配置 ProcessCreate（事件 1，记录父进程+命令行）与 NetworkConnect（事件 3）
Windows 内置命令（零安装）
reg query（运行键）、schtasks /query /fo csv /v（计划任务）、Get-WinEvent（PowerShell 事件 4104 ScriptBlock 日志）、netstat -ano（回连）- Linux/macOS 侧:
ps -ef --forest、systemctl list-timers、crontab -l、cat /proc/<pid>/maps
操作步骤
按顺序执行，每步产物（转储/日志/还原脚本）存档 sha256 + 路径（[[re-ioc]] 证据链要求）。
- 识别无文件迹象（无落盘/注册表载荷）：
- 输入信号: 杀软/EDR 告警"行为检测、无文件"；沙箱运行后磁盘无新增样本但进程异常；网络层看到 powershell/rundll32 实时下载
- 静态线索: 邮件/URL 附件是 .ps1/.hta/.docm（脚本链）；注册表 Run 键或计划任务指向 powershell/wscript/mshta 命令行而非 exe 路径
- 证据采集: 沙箱内运行（[[re-sandbox]]）→ procmon 全量记录文件/注册表/进程 → PowerShell 提前开 ScriptBlock 日志（事件 4104）与模块日志 → 启动前先 [[re-memdump]] 基线转储（见坑 2 时机）
- 判定: "无文件" = 载荷不落盘或只在 %TEMP% 短暂中转——磁盘证据不足不代表没有执行链，内存与命令行才是主战场
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 117 lines · 49 tokens per session scan A 8a9dbc81bf6a
re-fileless is a skill published in the GitHub repository dslsdzc/rev-skills (50 stars, last pushed 11d ago), licensed Apache-2.0. It adds 49 tokens to every session and 3,213 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.