Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-fluttergit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-flutter)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-flutter"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-flutter/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-flutter"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-flutter.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.06821 |
| Opus 5.5 | $0.00024 | $0.02728 |
| Sonnet 5.5 | $0.00012 | $0.01364 |
| Haiku 4.5 | $0.00006 | $0.00682 |
Grade A, and why
re-flutter scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl http://127.0.0.1:8181/getVM How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Flutter / Dart AOT 逆向（快照解析 / 符号还原 / VM 动态分析）
何时使用 / 何时不用
- 用：Android 包内发现
lib/<abi>/libapp.so（Dart AOT 快照）与libflutter.so（引擎）——业务逻辑在 libapp.so - 用：iOS 的
App.framework/App（AOT 快照嵌入 Mach-O，Flutter.framework为引擎） - 用：debug 构建的
assets/flutter_assets/kernel_blob.bin（Dart kernel 二进制，含类/函数名与 AST） - 用：需要还原 Flutter App 的 Dart 业务逻辑（网络接口、签名/加密算法、协议、MethodChannel 通道）
- 不用：纯原生 Android App（无 libapp.so / kernel_blob，走 [[re-apk]]）
- 不用：纯原生 iOS App（无 App.framework，走 [[re-ios]]）
- 不用：Flutter Web（产物是 JS/WASM 而非快照，走 [[re-wasm]]）
- 不用：引擎层本身（libflutter.so / Flutter.framework 内部逻辑，见步骤 4）
- 注意：动态步骤在受控设备 / 模拟器快照内执行（[[re-analyze/platform-tips]] 最高原则）；静态优先（大型样本原则）
工具准备
参考 [[re-analyze/platform-tips]]——Flutter 产物大（libapp.so 数十 MB 起），遵循「静态优先（大型样本）」：先静态定位、动态按需补充；动态（运行 / 重打包 App）默认在受控设备 / 模拟器快照内。
python3（快照头部 / 分区解析主力）
- Linux:
apt install python3/dnf install python3/pacman -S python - macOS: 自带；Windows: 官方安装器或
choco install python - 验证:
python3 --version
binutils（readelf / strings / objcopy，快照定位与段提取）
- Debian/Ubuntu:
apt install binutils；Fedora:dnf install binutils；Arch:pacman -S binutils - macOS: Xcode 命令行工具自带（
xcode-select --install） - Windows: 无自带 binutils——用 WSL，或 Ghidra 内置解析替代
- 验证:
readelf --version && strings --version
Ghidra（指令段反汇编 / 反编译与交叉引用）
- 装法与验证见 [[re-ghidra]]；无 Ghidra 时 IDA / radare2 等价（[[re-ida]] / [[re-radare2]]）
- 验证: 导入 libapp.so 后能定位
_kDart*符号
frida（动态侧，Dart VM 入口 hook）
- 安装、frida-server 部署与版本匹配见 [[re-frida]] 工具准备（主机与设备版本必须一致）
- 验证:
frida --version；frida-ps -U列出设备进程
blutter（AOT 快照自动还原，可选）
- release libapp.so 的类/函数/对象池自动还原，安装与用法见 [[re-hybrid-app]] 工具准备；本技能步骤 2 以手动解析为核心方法，blutter 作自动化替代与核对
- 验证: 输出目录出现
pp.txt且含目标 App 类名
操作步骤
按顺序执行；每步产物（段提取 / 解析脚本 / hook 脚本 + sha256）存档。
- 识别构建模式（debug / release）：
unzip -l app.apk | grep -E 'kernel_blob|libapp|libflutter' # Android 容器内定位 file lib/arm64-v8a/libapp.so readelf -sW lib/arm64-v8a/libapp.so | grep _kDart # release: AOT 快照符号 xxd -l 32 assets/flutter_assets/kernel_blob.bin # debug: 前 4 字节应为 ef cd ab 90（kernel magic 0x90abcdef 的小端） readelf -sW libapp.so | grep -c _kDartIsolateSnapshot # AOT 段符号（data/instructions），比按 ASCII 串搜可靠- debug:
assets/flutter_assets/kernel_blob.bin存在（header 共 8 字节 = magic0x90abcdef+ formatVersion，Dart kernel 二进制，类/函数名与 AST 保留，还原成本低）→ 直接步骤 3 - release: 无 kernel_blob，业务代码在 libapp.so 的
_kDartIsolateSnapshotData（数据）/_kDartIsolateSnapshotInstructions（指令）→ 步骤 2 - iOS:
Payload/<App>.app/Frameworks/App.framework/App（业务）与Flutter.framework/Flutter（引擎），Mach-O 内同段名，otool -l/ strings 定位
- debug:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +5 lines 8d523b714458
- 1mo ago Changed · +1 lines e1e15bbcd6ec
- 2mo ago First seen · 157 lines · 60 tokens per session scan A e05f25e72612
re-flutter is a skill published in the GitHub repository dslsdzc/rev-skills (225 stars, last pushed 24d ago), licensed Apache-2.0. It adds 60 tokens to every session and 6,821 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
redteam-mobile-detail-pack
Domain routing and boundary guidance for authorized mobile application security testing, including insecure storage, certificate pinning bypass, exposed components, and binary reverse engineering. Use when a task belongs to the mobile testing domain and needs scope, evidence, pivot, or exit criteria.
android-pentest
A guide for authorized security testing of Android apps, covering APK inspection, runtime testing, traffic capture, code review, and function hooking. An APK is the installable package used by an Android app.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
analysis
Run Quark Engine analysis on an APK file — produces summary, detail, JSON, web, call graph, behavior map, and classification reports.