Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-mobilegit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-mobile)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-mobile"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-mobile/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-mobile"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-mobile.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00004 | $0.02171 |
| Opus 5 | $0.00002 | $0.01086 |
| Sonnet 5 | $0.00001 | $0.00434 |
| Haiku 4.5 | $0.00000 | $0.00217 |
Grade A, and why
re-mobile scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
移动应用分析
完整工作流
- 初勘：[[re-triage]] —— file/哈希/熵确认输入类型（APK 与 IPA 都是 ZIP 容器，
file报 ZIP；纯.so/ Framework dylib 直接进第 4 步）；未走 [[re-analyze]] 入口则先补做，读取RE_*会话变量 - 静态：
- Android：[[re-apk]] —— apktool 解包、AndroidManifest 入口/权限/组件、jadx 反编译 Java、smali 补丁思路、加固识别
- iOS：[[re-ios]] —— ipa 解包与签名检查、class-dump 头文件、加密二进制脱壳
- 动态：[[re-frida]] —— 需要运行时行为（解密、hook、绕过证书/检测、观察调用链）时 spawn/attach 插桩；iOS 断点调试走 [[re-lldb]]
- 原生库：移动 App 含原生代码（Android
lib/*.so、iOS Framework 内 dylib）→ [[re-binary-core]]：[[re-format-elf]]（Android）/ [[re-format-macho]]（iOS）解析格式，[[re-ghidra]] 反编译 JNI/OC 底层逻辑；Android native 深挖（JNI 注册还原、so 逻辑）走 [[re-android-native]]；iOS 越狱环境（越狱检测 / tweak / 动态调试）走 [[re-ios-jb]] - 加固/带壳：[[re-apk]] 识别加固后转脱壳域（[[re-anti-analysis]]，Android）；iOS App Store 加密二进制按 [[re-ios]] 脱壳（frida-ios-dump 思路）。脱壳产物回到步骤 2 复跑
- 产出：结论/报告（按
RE_REPORT），哈希与证据存档（见 [[re-triage]]）
每步结果存档（证据路径 + sha256，见 [[re-triage]]），供报告引用；发现恶意样本/回连随时转 [[re-malware]]。
何时用哪个原子技能（选择树）
- 输入是 APK / 目标为 Android → [[re-apk]] 静态 → 需要运行时 → [[re-frida]]
- 输入是 IPA / 目标为 iOS → [[re-ios]] 静态 + 脱壳 → 断点调试 [[re-lldb]] / 插桩 [[re-frida]]
- 目标含原生库（.so / dylib）→ [[re-binary-core]]（[[re-format-elf]] / [[re-format-macho]] / [[re-ghidra]]）；Android native 专项（JNI/so）→ [[re-android-native]]
- 目标有越狱检测 / 要 tweak 分析 / 越狱设备动态调试 → [[re-ios-jb]]
- 需要解密 / 绕过证书 / hook 函数 / 观察调用链 → [[re-frida]]
- 加固/带壳：Android → [[re-anti-analysis]]（先经 [[re-apk]] 识别）；iOS 加密 → [[re-ios]] 脱壳
- Android 加固脱壳专项（乐固/360/梆梆/爱加密）→ [[re-mobile-pack]]（识别后运行/静态脱壳 + DEX 修复）
- Flutter / React Native 混合应用 → [[re-hybrid-app]]（引擎识别 → blutter / hermes-dec）
- 提取运行时内存中的 DEX/密钥 → [[re-memdump]]（DEX 提取见该技能）
跨域联合
- 移动 App 含原生库：[[re-mobile]] → [[re-binary-core]]（[[re-format-elf]] / [[re-ghidra]] 反编译 JNI/OC 底层逻辑）；Android native 专项 [[re-android-native]]；iOS 越狱环境 [[re-ios-jb]]（越狱检测 / tweak / lldb 远程）
- 移动 App 加固/带壳：[[re-mobile]] → [[re-anti-analysis]]（Android 脱壳）；iOS 加密二进制 [[re-ios]] 脱壳
- 动态分析默认沙箱：模拟器快照 / 受控越狱设备 + 网络隔离（[[platform-tips]] 最高原则）
- 移动恶意样本/回连：[[re-mobile]] → [[re-malware]]（行为分析见 [[re-sandbox]]）
- 本网关被 [[re-analyze]] 的 triage.md「移动 App 分析」路径调用（re-mobile → re-apk / re-ios → re-frida → 若含原生库 re-binary-core）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 65 lines · 95 tokens per session scan A fbfa992ef3be
re-mobile is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 4 tokens to every session and 2,171 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
redteam-mobile-detail-pack
Domain routing and boundary guidance for authorized mobile application security testing, including insecure storage, certificate pinning bypass, exposed components, and binary reverse engineering. Use when a task belongs to the mobile testing domain and needs scope, evidence, pivot, or exit criteria.
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
android-pentest
A guide for authorized security testing of Android apps, covering APK inspection, runtime testing, traffic capture, code review, and function hooking. An APK is the installable package used by an Android app.
rule-gen
Generate a Quark Engine detection rule from a behavior description and decompiled code. Validates the rule against a real APK before outputting it.