Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-hypervisorgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-hypervisor)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-hypervisor"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-hypervisor.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 87 Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
- medium Rogue Agent · line 36 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Privilege Escalation · line 87 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.04673 |
| Opus 5 | $0.00025 | $0.02337 |
| Sonnet 5 | $0.00010 | $0.00935 |
| Haiku 4.5 | $0.00005 | $0.00467 |
Grade B, and why
re-hypervisor scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
echo 1 | sudo tee /sys/module/kvm_intel/parameters/nested # Intel（AMD 为 kvm_amd） How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
虚拟化逆向（VT-x / SVM / hypervisor 检测）
何时使用 / 何时不用
- 用：目标是 hypervisor / VMM 二进制或驱动（恶意 hypervisor、rootkit 虚拟化、VM-based 保护）
- 用：样本/程序检测自己是否运行在虚拟机或嵌套虚拟化中（CPUID 指纹、时序检测）
- 用：分析 VT-x（VMX）或 SVM 相关的启动代码、VMCS/VMCB 布局、EPT 相关操作
- 不用：普通 Windows 驱动/rootkit（走 [[re-kernel]]）；只要识别"我在不在 VM 里"（快速判断走 [[re-triage]] 思路或
virt-what） - 不用：无 CPU 虚拟化支持 / 无嵌套虚拟化环境时的动态验证（静态分析先行，见坑 1）
- 注意：动态实验（QEMU/KVM 嵌套）按 [[platform-tips]] 最高原则在沙箱内进行；hypervisor 样本具有高特权，只在与宿主隔离的实验环境运行
工具准备
静态分析（CPUID 检查 / 反编译）免沙箱；QEMU/KVM 动态实验属动态执行，默认沙箱 + 快照（[[platform-tips]] 最高原则）。
CPUID 检查工具（hypervisor 识别）
- Linux 内置：
grep -E 'vmx|svm' /proc/cpuinfo——VT-x/SVM 支持标志（零安装，先用它） cpuid工具（dump 各 CPUID 叶子的完整输出）：- Debian/Ubuntu:
apt install cpuid；Fedora:dnf install cpuid - Arch 无独立 cpuid 包 → 用
kcpuid（pacman -S kcpuid，linux-tools 组）或 libcpuid 附带的cpuid_tool（pacman -S libcpuid） - 验证:
cpuid -1输出含各叶子详情；cpuid -1 -l 0x40000000（hypervisor 厂商字符串叶子）
- Debian/Ubuntu:
- Windows 侧：WinDbg 内核调试下
!cpuid（[[re-windbg]] 扩展命令）
QEMU / KVM —— 嵌套虚拟化实验环境
- Debian/Ubuntu:
apt install qemu-system-x86（Debian 12+ 已移除 qemu-kvm 过渡包，直接装 qemu-system-x86 即含qemu-system-x86_64；Ubuntu 的 qemu-kvm 过渡包仍存在，装了等价于 qemu-system-x86；Ubuntu 另加libvirt-daemon-system） - Fedora:
dnf install qemu-system-x86-core libvirt virt-install（或dnf group install virtualization） - Arch:
pacman -S qemu-system-x86 libvirt virt-manager（启用systemctl enable --now libvirtd） - macOS:
brew install qemu（无 KVM，用 HVF） - 验证:
qemu-system-x86_64 --version；ls /dev/kvm（KVM 加速可用）；kvm-ok（Debian/Ubuntu 专用，来自 cpu-checker 包——先apt install cpu-checker）
反编译工作台（[[re-ghidra]] / [[re-ida]]）
- [[re-ghidra]]（默认）/ [[re-ida]]：导入 hypervisor 二进制（内核模块 / 裸二进制）
- 验证: 导入后能反编译出 VMXON / VMPTRLD / VMREAD / VMWRITE 调用点
Intel SDM / AMD APM（VMCS 字段编码参考，无安装）
- Intel SDM Volume 3C 附录 B（VMCS field encoding 表）；AMD APM Volume 2（VMCB 布局）
- 用途: VMREAD/VMWRITE 操作数解码、exit reason 编号对照（无独立包，官方文档）
操作步骤
按顺序执行，每步产物（CPUID 输出、VMCS 字段表、QEMU 配置）记录证据路径 + sha256（见 [[re-triage]]），供报告引用。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 121 lines · 50 tokens per session scan B 93095e6b24c9
re-hypervisor is a skill published in the GitHub repository dslsdzc/rev-skills (46 stars, last pushed 9d ago), licensed Apache-2.0. It adds 50 tokens to every session and 4,673 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
redteam-cloud-detail-pack
Domain routing and boundary guidance for authorized cloud security testing, including IAM misconfiguration, exposed storage, metadata services, and serverless injection. Use when a task belongs to the cloud testing domain and needs scope, evidence, pivot, or exit criteria.
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
azure-hybrid-lateral
A methodology for moving from a compromised Azure or Entra ID cloud account into an on-premises Active Directory network. Active Directory is commonly used to manage users and computers inside an organization.
gcp-workspace-pivot
A playbook for moving from Google Cloud Platform (GCP) into Google Workspace, the suite containing services such as Gmail, Drive, Calendar, and administration tools.