Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-format-machogit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-format-macho)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-format-macho"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-format-macho/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-format-macho"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-format-macho.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.02714 |
| Opus 5 | $0.00019 | $0.01357 |
| Sonnet 5 | $0.00008 | $0.00543 |
| Haiku 4.5 | $0.00004 | $0.00271 |
Grade A, and why
re-format-macho scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 131 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mach-O 格式解析
何时使用 / 何时不用
- 用：目标是 macOS/iOS 的 Mach-O 二进制（可执行文件/.dylib/.bundle/Framework），需要理解结构、load commands、入口、代码签名、动态库依赖链
- 用：检查 dylib 注入（LC_LOAD_DYLIB 异常条目）、签名/公证状态、通用二进制多架构片
- 不用：PE（走 [[re-format-pe]]）、ELF（走 [[re-format-elf]]）
- 不用：只需函数逻辑（直接反编译技能）；iOS 越狱环境问题属 [[re-mobile]] 域
工具准备
参考 [[platform-tips]] macOS 分支——attach/调试受 SIP 与 TCC 限制；静态解析不受影响。
otool（Apple 自带）
- macOS: Xcode Command Line Tools:
xcode-select --install - 验证:
otool --version - Linux 替代:
llvm-otool（apt install llvm/brew install llvm/pacman -S llvm），功能覆盖 otool 常用子命令
llvm-objdump（跨平台）
- macOS:
brew install llvm；Linux:apt install llvm/dnf install llvm/pacman -S llvm - 验证:
llvm-objdump --version - 用法:
llvm-objdump --macho --private-headers sample（Linux 上可直接解析 Mach-O，与 macOS 输出一致）
jtool2（深入 Mach-O 结构，macOS）
- macOS: 从 GitHub（intezer/jtool2）clone 后
make，或下载 release 二进制 - 验证:
jtool2 -h sample输出 load commands
codesign / lipo（macOS 自带）
- 验证:
codesign --version；lipo -info sample - Linux 替代:
llvm-lipo -info sample（llvm 自带）
dyld_shared_cache_util（macOS）
- 系统自带（
/usr/bin/dyld_shared_cache_util）；用途: 解析 dyld 共享缓存中的系统 dylib 时把单个库抽出来
操作步骤
-
初勘（先确认类型与架构）：
file sample # 可执行文件 / dylib / 通用二进制 / 字节序 lipo -info sample # 通用二进制列出各架构片；单架构提示 "non-fat file" xxd -l 16 sample # 魔数: cffaedfe=64位小端, feedfacf=64位大端, cebafaed=32位小端, cafebabe=fat魔数（文件里看到的字节）：
cffa edfe（MH_MAGIC_64）、cefa edfe（MH_MAGIC 32 位）、cafe babe（FAT，后跟 4 字节架构数）。通用二进制先lipo -thin <arch> -output piece sample提取单片再解析。 -
mach_header 与 load commands（核心）：
otool -h sample # magic/cputype/filetype/ncmds/flag 一行全出 otool -l sample | head -80 # 全部 load commands64 位 mach_header 固定 32 字节（32 位为 28 字节）：magic(4) + cputype(4) + cpusubtype(4) + filetype(4) + ncmds(4) + sizeofcmds(4) + flags(4) + reserved(4，仅 64 位)。load commands 是 Mach-O 的"节表+导入表+入口+签名"综合体——从头到尾按
cmdsize顺序遍历，ncmds计数、sizeofcmds为总字节数，两者互相校验。filetype: 2=MH_EXECUTE 6=MH_DYLIB 8=MH_BUNDLE。常见 LC 值与字段表见 [[layout]]。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 131 lines · 38 tokens per session scan A 3ba61f8bb8ae
re-format-macho is a skill published in the GitHub repository dslsdzc/rev-skills (50 stars, last pushed 11d ago), licensed Apache-2.0. It adds 38 tokens to every session and 2,714 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.