Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-javacardgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-javacard)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-javacard"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-javacard/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-javacard"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-javacard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.04817 |
| Opus 5 | $0.00043 | $0.02409 |
| Sonnet 5 | $0.00017 | $0.00963 |
| Haiku 4.5 | $0.00009 | $0.00482 |
Grade A, and why
re-javacard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Java Card / SIM 卡 applet 逆向（CAP 组件解析与字节码还原）
何时使用 / 何时不用
- 用：拿到 Java Card applet 的 CAP 文件（Converted Applet Package，.cap）——来自 EEPROM dump、固件镜像、资料包或读卡提取
- 用：SIM / USIM / 银行卡等智能卡应用分析——包 AID 与 applet AID、安装参数、install() 初始化、process(APDU) 分派逻辑还原
- 用：CAP 字节码（Java 子集 + 卡片扩展指令）反汇编、方法体还原、CLA/INS 指令表重建
- 不用：APDU 协议交互与抓包、ISO14443 链路、MIFARE/DESFire 卡族弱点（走 [[re-iot-proto]]）
- 不用：通用 .class/.jar Java 字节码逆向（走 [[re-java]]）；CAP 内嵌原始 .class 可配合 javap 对照，但不替代本技能
- 不用：CAP 尚未取到手——先走读卡器物理交互（[[re-hardware-io]] / [[re-iot-proto]] APDU）或固件提取（[[re-firmware]] / [[re-fw-extract]]），拿到文件再回来
- 不用：只需读/写卡片数据或抓 APDU 流量（[[re-iot-proto]]）
工具准备
所有工具先验证再使用。静态解析可免沙箱；涉及真实卡片与读卡器交互先确认授权边界（卡片归属与分析目的），动态执行默认沙箱（[[platform-tips]] 最高原则）。
CAP 文件解析（开源解析器或自写脚本）
- capfile（Java 库，martinpaljak，CAP 解析/验证，ant-javacard 生态）：
git clone https://github.com/martinpaljak/ant-javacard（capfile 已并入其中）；作为库引用构建。验证：解析样例 CAP 无异常 - caprunner（Python，CAP 解析 + 字节码执行器，benallard）：
git clone https://github.com/benallard/caprunner+git clone https://github.com/benallard/pythoncard（pythoncard/pythoncardx 目录放入 caprunner 同级路径）；验证：python3 readcap.py <file.cap>能列出组件信息 - pysim 的 javacard.py（osmocom，生产级 SIM 工具链组件）：
git clone https://github.com/osmocom/pysim；pySim/javacard.py的 CapFile 类——校验 Header 魔数 0xDECAFFED、读包 AID/applet AID、拼安装顺序 load file；验证：python3 -c "import sys; sys.path.insert(0,'pysim'); from pySim.javacard import CapFile; print(CapFile('x.cap').get_loadfile_aid())" - GlobalPlatformPro（gp，Java，与卡交互/装应用/列应用 AID）：GitHub releases 下载 JAR（Java 11+）：
java -jar gp.jar --version；java -jar gp.jar --list（列卡上应用与 AID） - 自写解析器要点：CAP 是 ZIP，组件以文件形式存放，逐文件按「tag + size + info」解析即可，不依赖单一偏移表（结构见操作步骤 2-5）
javap —— 原始 .class 对照（JDK 自带）
- Linux:
apt install default-jdk/dnf install java-17-openjdk/pacman -S jdk-openjdk；macOS:brew install openjdk；Windows: 官方 JDK 安装包 - 验证:
javap -version - 用途：CAP JAR 内常带编译期等价产物
APPLET-INF/classes/**/*.class（SDK 转换器打包，unzip -l可见），unzip -p x.cap APPLET-INF/classes/com/example/Foo.class > Foo.class && javap -c -p Foo.class拿到 Java 视图，与 CAP 字节码互相对照（注意操作码编号与指令名差异，见坑 3）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 127 lines · 85 tokens per session scan A 2e4fdbdf94f9
re-javacard is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 85 tokens to every session and 4,817 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
003-skills-inventory
Use when you need to generate a checklist document with Java system prompts from skills.xml, following the embedded section template and producing INVENTORY-SKILLS-JAVA.md. This should trigger for requests such as Create Java system prompts checklist; Generate INVENTORY-SKILLS-JAVA.md; Use @003-skills-inventory…
001-commands-inventory
Use when you need to generate a checklist document with embedded commands inventory, following the embedded template exactly and producing INVENTORY-COMMANDS-JAVA.md in the project root. This should trigger for requests such as Create embedded commands inventory checklist; Generate INVENTORY-COMMANDS-JAVA.md; Use…
002-agents-inventory
Use when you need to generate a checklist document with embedded agents inventory, following the embedded template exactly and producing INVENTORY-AGENTS-JAVA.md in the project root. This should trigger for requests such as Create embedded agents inventory checklist; Generate INVENTORY-AGENTS-JAVA.md; Use…
java-framework-audit
A Java source-code audit for security problems in common frameworks and libraries.
java-auth-config-audit
A guide to auditing authentication and security settings in Java source code. It covers access controls, tokens, encryption, information exposure, and business-process flaws.