Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-fluttergit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-flutter)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-flutter"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-flutter.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.06119 |
| Opus 5 | $0.00030 | $0.03060 |
| Sonnet 5 | $0.00012 | $0.01224 |
| Haiku 4.5 | $0.00006 | $0.00612 |
Grade A, and why
re-flutter scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl http://127.0.0.1:8181/getVM How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Flutter / Dart AOT 逆向（快照解析 / 符号还原 / VM 动态分析）
何时使用 / 何时不用
- 用：Android 包内发现
lib/<abi>/libapp.so（Dart AOT 快照）与libflutter.so（引擎）——业务逻辑在 libapp.so - 用：iOS 的
App.framework/App（AOT 快照嵌入 Mach-O，Flutter.framework为引擎） - 用：debug 构建的
assets/flutter_assets/kernel_blob.bin（Dart kernel 二进制，含类/函数名与 AST） - 用：需要还原 Flutter App 的 Dart 业务逻辑（网络接口、签名/加密算法、协议、MethodChannel 通道）
- 不用：纯原生 Android App（无 libapp.so / kernel_blob，走 [[re-apk]]）
- 不用：纯原生 iOS App（无 App.framework，走 [[re-ios]]）
- 不用：Flutter Web（产物是 JS/WASM 而非快照，走 [[re-wasm]]）
- 不用：引擎层本身（libflutter.so / Flutter.framework 内部逻辑，见步骤 4）
- 注意：动态步骤在受控设备 / 模拟器快照内执行（[[platform-tips]] 最高原则）；静态优先（大型样本原则）
工具准备
参考 [[platform-tips]]——Flutter 产物大（libapp.so 数十 MB 起），遵循「静态优先（大型样本）」：先静态定位、动态按需补充；动态（运行 / 重打包 App）默认在受控设备 / 模拟器快照内。
python3（快照头部 / 分区解析主力）
- Linux:
apt install python3/dnf install python3/pacman -S python - macOS: 自带；Windows: 官方安装器或
choco install python - 验证:
python3 --version
binutils（readelf / strings / objcopy，快照定位与段提取）
- Debian/Ubuntu:
apt install binutils；Fedora:dnf install binutils；Arch:pacman -S binutils - macOS: Xcode 命令行工具自带（
xcode-select --install） - Windows: 无自带 binutils——用 WSL，或 Ghidra 内置解析替代
- 验证:
readelf --version && strings --version
Ghidra（指令段反汇编 / 反编译与交叉引用）
- 装法与验证见 [[re-ghidra]]；无 Ghidra 时 IDA / radare2 等价（[[re-ida]] / [[re-radare2]]）
- 验证: 导入 libapp.so 后能定位
_kDart*符号
frida（动态侧，Dart VM 入口 hook）
- 安装、frida-server 部署与版本匹配见 [[re-frida]] 工具准备（主机与设备版本必须一致）
- 验证:
frida --version；frida-ps -U列出设备进程
blutter（AOT 快照自动还原，可选）
- release libapp.so 的类/函数/对象池自动还原，安装与用法见 [[re-hybrid-app]] 工具准备；本技能步骤 2 以手动解析为核心方法，blutter 作自动化替代与核对
- 验证: 输出目录出现
pp.txt且含目标 App 类名
操作步骤
按顺序执行；每步产物（段提取 / 解析脚本 / hook 脚本 + sha256）存档。
- 识别构建模式（debug / release）：
unzip -l app.apk | grep -E 'kernel_blob|libapp|libflutter' # Android 容器内定位 file lib/arm64-v8a/libapp.so readelf -sW lib/arm64-v8a/libapp.so | grep _kDart # release: AOT 快照符号 xxd -l 32 assets/flutter_assets/kernel_blob.bin # debug: "KERNEL" magic strings -n 6 libapp.so | grep -c SNAPSHOT # AOT 数据段 magic 命中- debug:
assets/flutter_assets/kernel_blob.bin存在（头部 "KERNEL" magic，Dart kernel 二进制，类/函数名与 AST 保留，还原成本低）→ 直接步骤 3 - release: 无 kernel_blob，业务代码在 libapp.so 的
_kDartIsolateSnapshotData（数据）/_kDartIsolateSnapshotInstructions（指令）→ 步骤 2 - iOS:
Payload/<App>.app/Frameworks/App.framework/App（业务）与Flutter.framework/Flutter（引擎），Mach-O 内同段名，otool -l/ strings 定位
- debug:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 157 lines · 60 tokens per session scan A e05f25e72612
re-flutter is a skill published in the GitHub repository dslsdzc/rev-skills (46 stars, last pushed 9d ago), licensed Apache-2.0. It adds 60 tokens to every session and 6,119 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
redteam-mobile-detail-pack
Domain routing and boundary guidance for authorized mobile application security testing, including insecure storage, certificate pinning bypass, exposed components, and binary reverse engineering. Use when a task belongs to the mobile testing domain and needs scope, evidence, pivot, or exit criteria.
android-pentest
A guide for authorized security testing of Android apps, covering APK inspection, runtime testing, traffic capture, code review, and function hooking. An APK is the installable package used by an Android app.
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
rule-gen
Generate a Quark Engine detection rule from a behavior description and decompiled code. Validates the rule against a real APK before outputting it.