Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-harmonyosgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-harmonyos)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-harmonyos"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-harmonyos/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-harmonyos"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-harmonyos.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.02532 |
| Opus 5 | $0.00032 | $0.01266 |
| Sonnet 5 | $0.00013 | $0.00506 |
| Haiku 4.5 | $0.00006 | $0.00253 |
Grade A, and why
re-harmonyos scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
鸿蒙应用逆向（HarmonyOS / hap / ArkTS）
何时使用 / 何时不用
- 用：拿到 hap（应用发布包）/ hsp（共享包）/ har（静态库归档），需要看模块配置、资源、ArkTS 业务逻辑
- 用：需要还原 .abc 字节码（ArkCompiler 产物）中的业务逻辑——字符串定位、反汇编、混淆还原
- 用：鸿蒙应用含 native 库（libs/ 下 .so），需要静态/动态联动分析
- 不用：普通 Android APK（走 [[re-apk]]；dex/smali 体系与本技能不同）
- 不用：纯 Web/前端应用（非鸿蒙容器，脚本/Web 路径走 [[re-script-deob]] 或 [[re-browser-ext]]）
- 注意：动态执行默认沙箱（[[platform-tips]] 最高原则）——静态解包/反汇编免沙箱；模拟器/真机运行观察必须进 [[re-sandbox]]
工具准备
参考 [[platform-tips]]——静态分析（解包、字符串、反汇编）免沙箱；动态步骤按最高原则进沙箱。
hap 解包（zip 容器，通用思路）
- hap = zip 容器，与 APK 同源（同属 zip/jar 家族）——任何通用 zip 解包工具都能解（unzip / 7-Zip / python3 zipfile 模块），不绑死单一实现
- 流程与 [[re-apk]] 同源：先列清单（
unzip -l）→ 再解包 → 验证完整性（CRC/文件数对照） - 专业解包工具（集成 module.json 解析与资源提取）可作备选，注意按发行版本选择对应版本
- 验证: 解包后目录结构完整（对照步骤 1 的清单）
python3（字符串提取与脚本）
- Linux:
apt install python3/dnf install python3/pacman -S python；macOS: 自带；Windows: 官方安装器 - zipfile 为标准库：
python3 -m zipfile -l app.hap列清单、python3 -m zipfile -e app.hap out/解包 - 验证:
python3 --version
字符串/资源提取工具
strings（binutils 自带）与grep：捞 .abc 与资源中的 URL、密钥、提示语- 资源文件（布局、图片、rawfile）先用
file判断类型再提取
ArkCompiler 反汇编器（针对 abc 的替代，泛化描述）
- [[re-java]] 的 jadx 类思路复用：Android 用 jadx 解 dex，鸿蒙侧对应的是 ArkCompiler 反汇编工具——官方工具链（随 SDK 发行）与开源实现均可，选能输出指令级汇编（指令助记符 + 操作数/常量引用）的实现即可，多个实现可交叉验证
- 版本匹配：先识别编译版本再选工具（见坑 2）
操作步骤
按顺序执行；每步产物（解包目录、反汇编输出 + sha256）存档（见 [[re-triage]]）。
-
包结构识别与解包：
file app.hap unzip -l app.hap | head -30 unzip -o app.hap -d out/- hap ≈ APK 变体：
module.json（模块配置，等价 manifest：入口/权限/组件声明）、resources/（资源，等价 res/）、ets/（ArkTS 编译产物所在，.abc 字节码）、libs/（native .so）、assets/（rawfile 等原始资源） - hsp / har 同为 zip 容器，结构类似（hsp 含 .abc，har 为静态库归档），解包流程一致
- zip 容器解包流程与 APK 同源（[[re-apk]]）：列清单 → 解包 → 校验；发现嵌套容器则递归解（见坑 4）
- hap ≈ APK 变体：
-
字节码识别（.abc）：
find out/ -name "*.abc" | head xxd out/ets/modules.abc | head -10 # 看文件头.abc是 ArkCompiler（方舟编译器）字节码文件，业务逻辑主体；文件头含固定魔数与版本字段，其后为段结构（字符串段/字面量段/指令段等，具体布局随编译版本演进）- 旧版本布局有差异（模块文件命名/位置不同）——以解包清单为准；
file识别不出时用xxd/python3 读头部，先识别编译版本再定工具（见坑 2）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 103 lines · 64 tokens per session scan A 13aa6d322994
re-harmonyos is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 12d ago), licensed Apache-2.0. It adds 64 tokens to every session and 2,532 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
redteam-mobile-detail-pack
Domain routing and boundary guidance for authorized mobile application security testing, including insecure storage, certificate pinning bypass, exposed components, and binary reverse engineering. Use when a task belongs to the mobile testing domain and needs scope, evidence, pivot, or exit criteria.
android-pentest
A guide for authorized security testing of Android apps, covering APK inspection, runtime testing, traffic capture, code review, and function hooking. An APK is the installable package used by an Android app.
analysis
Run Quark Engine analysis on an APK file — produces summary, detail, JSON, web, call graph, behavior map, and classification reports.