Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-mem-forensicsgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-mem-forensics)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-mem-forensics"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-mem-forensics/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-mem-forensics"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-mem-forensics.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 5 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.03604 |
| Opus 5 | $0.00028 | $0.01802 |
| Sonnet 5 | $0.00011 | $0.00721 |
| Haiku 4.5 | $0.00006 | $0.00360 |
Grade A, and why
re-mem-forensics scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
内存取证（Volatility 3）
何时使用 / 何时不用
- 用：拿到 .raw/.mem/.core 内存转储做取证（进程列表、网络连接、注入检测、凭据哈希）；恶意样本内存残留分析；事件响应调查
- 用：取证要求可追溯的时间线（进程/网络/注册表事件序列，配合 timeliner）
- 不用：还没有转储——先按 [[re-memdump]] 取（默认转储优先，见 [[platform-tips]]「直读 vs 转储」决策表）
- 不用：实时交互调试（那是 [[re-gdb]] / [[re-x64dbg]] 的活）；文件系统/注册表静态分析（那是 [[re-binary-core]] / 主机取证工具）
工具准备
本技能只读转储文件、不运行样本；涉及动态确认的转 [[re-sandbox]]（默认沙箱最高原则，见 [[platform-tips]]）。
volatility3 —— 内存取证主力（Python 3.8-3.11）
- 全平台:
pip install volatility3（命令为vol）；官方要求 Python 3.8+（README 表述），2026 实测 2.28.0 在 Python 3.14 可安装且插件正常加载——先python3 --version确认，版本不匹配用 pyenv/venv 建对应环境再装 - Windows/WSL: 同上 pip 方案（WSL 内可分析 Windows dump，见 [[platform-tips]] WSL 分支）
- 验证:
vol -h；vol -f dump.raw windows.info能输出镜像信息且不报符号错误 - 符号文件：首次运行对应插件时从 https://downloads.volatilityfoundation.org/ 下载符号表（Linux 为
linux/下对应内核版本），网络受限或下载失败时用--offline+ 预置符号目录，否则插件报 MissingSymbol 类错误 - 依赖补充：凭据类插件（hashdump/lsadump/cachedump）需要 pycryptodome、yarascan 需要 yara-python——2026 实测 2.28.0 缺这两依赖时对应插件加载失败（
vol --help里直接缺失），装完pip install pycryptodome yara-python重试
7zip（可选，解 .7z 压缩转储）
- Linux:
apt install p7zip-full/dnf install p7zip-plugins/pacman -S p7zip - macOS:
brew install p7zip - Windows: 7-Zip 官网安装
- 验证:
7z --help
工具包补充（按平台）
- Windows dump 建议同时备 Sysinternals（procdump/DumpIt 取 dump 用，见 [[platform-tips]] Windows 分支）
- 深度提取
vol -f dump.raw windows.dumpfiles出的可疑对象，用 [[re-ghidra]] / [[re-ida]] 分析
操作步骤
按顺序执行，每步产物存档（路径 + sha256 + 时间戳，取证要求）。
- 确认 dump 来源与架构：
file dump.raw # 确认是内存转储（MEMORY_IMAGE 头 / crash dump），不是别的文件 vol -f dump.raw windows.info # Windows 镜像信息；Linux/macOS 无 info 插件——直接跑对应平台插件验证（如 linux.pslist / mac.pslist，符号表就位才正常输出）- 按转储来源选平台前缀：Windows 用
windows.*、macOS 用mac.*、Linux 用linux.*；volatility3 自动识别 profile（相比 vol2 手选 profile 已简化），但首次运行需下载对应符号文件（见工具准备） - 输入格式：raw 镜像（主格式）、LiME（lime 层自动识别）、Windows crash dump（crash 层）；VMware .vmem（vol 内置 vmware 层自动识别，可直接
-f）；休眠文件（hiberfil.sys）无内置层——先转 raw 或专用工具处理 - 进程级转储（[[re-memdump]] 的 gcore 是单进程 ELF core，非整机镜像）Volatility 无法解析——用 gdb/eu-stack 复盘（见 [[re-memdump]] 步骤 3），本技能只处理整机镜像
- 按转储来源选平台前缀：Windows 用
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 113 lines · 56 tokens per session scan A 9f08903e2ce6
re-mem-forensics is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 56 tokens to every session and 3,604 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.