Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-mobile-forensicsgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-mobile-forensics)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-mobile-forensics"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-mobile-forensics/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-mobile-forensics"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-mobile-forensics.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 9 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 60 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 70 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 72 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 74 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 75 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 76 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 78 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 86 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 108 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.03154 |
| Opus 5 | $0.00028 | $0.01577 |
| Sonnet 5 | $0.00011 | $0.00631 |
| Haiku 4.5 | $0.00006 | $0.00315 |
Grade A, and why
re-mobile-forensics scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
移动设备取证
何时使用 / 何时不用
- 用：设备备份/镜像的数据提取、应用数据取证、删除恢复、时间线重建
- 用：应用数据落盘路径解析（数据库/偏好/缓存）——App 结构理解配合 [[re-mobile]]
- 用：时间点对比取证（备份前后数据变化/已删除记录比对）
- 用：轻量定向提取（单应用单表数据——直接 run-as/单应用备份，不必全量）
- 用：删除数据可恢复性评估（先判定再动手，避免无效耗时）
- 用：设备已离线/损坏时（备份文件仍可解析——备份解析不依赖设备在线）
- 不用：App 逆向分析（[[re-mobile]]）；通用文件系统分析（[[re-disk-forensics]]）；运行中进程动态提取（[[re-frida]]）
- 不用：云备份/云同步数据（Google/iCloud 云侧不在本技能，取证范围需另行授权）
- 不用：无授权设备（红线：仅授权设备；设备隔离与保全原则见 [[gotchas]]）
工具准备
adb（Android 设备接口）
- Linux:
apt install adb/dnf install android-tools；macOS:brew install android-platform-tools；Windows: 官方平台工具 - 验证:
adb --version；adb devices需设备开启 USB 调试并授权（屏幕弹窗确认）
libimobiledevice（iOS 设备接口）
- Linux:
apt install libimobiledevice-utils；macOS:brew install libimobiledevice；Windows: 官方构建 - 验证:
idevice_id -l（列出设备）
备份解析工具
- Android: abe（Android Backup Extractor，Java jar，GitHub
nelenkov/android-backup-extractor：java -jar abe.jar unpack backup.ab backup.tar）或等价 python 脚本；验证:java -jar abe.jar --help（需 Java，安装见 [[re-java]]） - iOS:
idevicebackup2+ manifest 解析（见步骤 2） - sqlite3（数据库读取——Linux:
apt install sqlite3；macOS:brew install sqlite3；Windows: 官方构建）；验证:sqlite3 --version - foremost（数据雕刻——Linux:
apt install foremost；macOS:brew install foremost）；验证:foremost -h - python3（解析脚本）：安装见 [[re-python]] 工具准备
操作步骤
按顺序执行；设备操作遵循授权边界（红线：仅授权设备）。取证顺序：隔离（断网/飞行模式）→ 记录设备状态（版本/解锁/加密/网络）→ 只读提取优先 → 产物存档。每步产物存档（路径 + sha256，见 [[re-triage]]）；远端擦除与保全细节见 [[gotchas]]。
- Android 提取：
adb backup -f backup.ab -all # 全量备份（应用需允许备份） adb backup -f app.ab -apk -noobb com.target.app # 单应用备份（按包名） adb shell run-as com.target.app ls data # 应用沙箱（debuggable 应用） # root 设备：dd 镜像关键分区 / adb pull /data 直接提取- 备份可行性预检：
adb shell bmgr list transports（确认系统备份服务可用；无输出/报错 → adb backup 不可用，换路径） - 设备状态记录：版本（
adb shell getprop ro.build.version.release）+ 加密/解锁状态（影响后续解析路径） adb backup现状：Android 12 起官方弃用，targetSDK 31+ 的应用数据不再导出（仅 targetSDK<31 或 debuggable 应用有效，Play 商店新应用基本不可用）——失效时换 root/镜像提取（判据见 [[decision-tree]]）- ab 格式：魔数
ANDROID BACKUP+ 版本/标志字节（压缩/加密位）+ 可选 AES-256-CBC 加密参数 + tar（可 deflate 压缩）负载 - 备份解析：ab 头 → 解包 tar（加密备份需备份密码；无密码标注不可提取）；产物先用
file backup.ab验魔数与大小 - 产物存放：独立目录 + 命名含设备标识/时间（防多设备混淆）
- 解析组合套路：
abe unpack backup.ab backup.tar（加密备份密码为末尾位置参数：abe unpack backup.ab backup.tar <密码>，或设ABE_PASSWD环境变量）→tar tf列内容 → sqlite3/plist 分析 - 应用沙箱：
run-as（debuggable）/ root 设备直接读；allowBackup=false的应用备份为空且无警告（见坑 2） - run-as 二进制安全拉取：
adb exec-out run-as com.target.app cat files/x.db > x.db（exec-out 不做终端转义） - root 镜像注意：先查分区表（
adb shell ls /dev/block/by-name/或cat /proc/partitions）再 dd 目标分区；镜像产物大，先确认磁盘空间 - 硬件 Keystore 密钥不可通过备份导出（绑定设备硬件，标注局限）
- 数据库提取 → sqlite3（[[re-disk-forensics]] 的 SQLite 页结构方法）
- 备份可行性预检：
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 121 lines · 56 tokens per session scan A 21edcd1c8662
re-mobile-forensics is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 56 tokens to every session and 3,154 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
redteam-mobile-detail-pack
Domain routing and boundary guidance for authorized mobile application security testing, including insecure storage, certificate pinning bypass, exposed components, and binary reverse engineering. Use when a task belongs to the mobile testing domain and needs scope, evidence, pivot, or exit criteria.
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
android-pentest
A guide for authorized security testing of Android apps, covering APK inspection, runtime testing, traffic capture, code review, and function hooking. An APK is the installable package used by an Android app.
rule-gen
Generate a Quark Engine detection rule from a behavior description and decompiled code. Validates the rule against a real APK before outputting it.