Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-fuzzinggit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-fuzzing)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-fuzzing"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-fuzzing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-fuzzing"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-fuzzing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 12 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Privilege Escalation · line 24 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 25 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 26 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 39 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 40 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 41 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 28 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 33 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 59 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 62 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 63 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 70 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00106 | $0.03188 |
| Opus 5.5 | $0.00042 | $0.01275 |
| Sonnet 5.5 | $0.00021 | $0.00638 |
| Haiku 4.5 | $0.00011 | $0.00319 |
Grade B, and why
re-fuzzing scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Debian/Ubuntu: `sudo apt install afl++` How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
覆盖率引导模糊测试（AFL++ / libFuzzer / honggfuzz）
何时使用 / 何时不用
- 用：目标有明确输入面（文件解析 / 库函数 / 网络协议解析），要自动化找崩溃；有源码可插桩（或无源码愿意用 QEMU 模式）；需要持续回归找新 bug
- 不用：目标无输入解析（纯算法/纯逻辑 → 符号执行 [[re-angr]] / [[re-z3]]）；已有崩溃只需分析（→ [[re-crash-triage]]）；目标是内核/驱动（走 [[re-kernel]] 域思路，不在用户态 fuzz 范围）
- 不用：只有单个崩溃样本要复现（直接走 [[re-crash-triage]]，无需重跑 fuzz）
工具准备
所有工具先验证再使用。fuzz 是动态执行，一律在沙箱内跑（[[re-analyze/platform-tips]] 最高原则，见 [[re-sandbox]]）。
AFL++ —— 覆盖率引导 fuzz 主力
- Debian/Ubuntu:
sudo apt install afl++ - Fedora:
sudo dnf install american-fuzzy-lop american-fuzzy-lop-clang（包即 AFL++ fork）；或源码编译拿最新版（见下） - Arch:
sudo pacman -S afl++ - macOS:
brew install afl++ - Windows: WSL2 内
sudo apt install afl++（AFL++ 官方支持 WSL；Windows 本机不可直接跑） - 源码编译（推荐，版本最新、含全部模式）:
git clone https://github.com/AFLplusplus/AFLplusplus && cd AFLplusplus make distrib # 需要 clang/LLVM 工具链 sudo make install - 验证:
afl-fuzz -h（打印 usage 即 OK）；afl-clang-fast --version
clang / LLVM —— libFuzzer 宿主 + ASAN 编译器
- Debian/Ubuntu:
sudo apt install clang - Fedora/RHEL:
sudo dnf install clang - Arch:
sudo pacman -S clang - macOS: Xcode 自带（
xcode-select --install补命令行工具），或brew install llvm - Windows: WSL2 内 Linux 版；本机 Visual Studio 的 clang-cl 亦可（MSVC 支持
/fsanitize=fuzzer） - 验证:
clang --version
libFuzzer —— 库函数 / 单函数 fuzz（随 clang 附带）
- 无需单独安装：clang 自带，
-fsanitize=fuzzer即启用 - 验证:
输出含clang -fsanitize=fuzzer -x c /dev/null -o /tmp/fztest && /tmp/fztest -runs=1INFO: libFuzzer即 OK（/tmp/fztest用完可删）
honggfuzz —— 硬件计数器 / 多线程 fuzz 备选
- Debian/Ubuntu: 无官方包 → 源码编译：
sudo apt install build-essential binutils-dev libunwind-dev libblocksruntime-dev clang git clone https://github.com/google/honggfuzz && cd honggfuzz && make - Fedora/RHEL:
sudo dnf install honggfuzz - Arch:
sudo pacman -S honggfuzz（或 AUR 包honggfuzz） - macOS: 无 brew 公式 → 源码编译（需 Xcode + libblocksruntime）
- Windows: WSL2 内 Linux 版
- 验证:
honggfuzz --help
afl-cov —— 覆盖率统计（gcov/lcov 前端）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +1 lines aac40668a870
- 2mo ago First seen · 154 lines · 106 tokens per session scan B 6092d4362059
re-fuzzing is a skill published in the GitHub repository dslsdzc/rev-skills (207 stars, last pushed 18d ago), licensed Apache-2.0. It adds 106 tokens to every session and 3,188 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
reverse-engineering-shellcode
Analyzes position-independent shellcode: disassembling raw bytes at the right architecture, recognizing PEB-walk API resolution and egg hunters, and emulating execution to recover behavior and payloads. Activates for requests to analyze shellcode, disassemble raw position-independent code, or emulate a shellcode blob.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.