Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-netcapgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-netcap)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-netcap"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-netcap/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-netcap"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-netcap.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 11 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Privilege Escalation · line 33 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 65 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 67 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 68 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 69 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 70 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 106 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 107 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 108 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 113 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 114 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.03517 |
| Opus 5 | $0.00021 | $0.01758 |
| Sonnet 5 | $0.00008 | $0.00703 |
| Haiku 4.5 | $0.00004 | $0.00352 |
Grade B, and why
re-netcap scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Linux: `apt install wireshark tshark` / `dnf install wireshark-cli wireshark` / `pacman -S wireshark-cli wireshark-qt`（Arch 已拆分为 wireshark-cli + wireshark-qt；Debian 安装时选"允许非 root 抓包"，或 `sudo dpkg-reconfigure wireshark- How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
网络流量捕获
何时使用 / 何时不用
- 用：任何需要拿到网络流量的任务——恶意样本回连观察、固件通信分析、协议逆向的原料获取
- 用：已有 pcap 需要导出/统计/过滤（tshark 环节）
- 用：HTTPS/TLS 通信需要解密看明文（mitmproxy 中间人）
- 不用：流量已解密/无加密且只要协议语义（直接 [[re-proto-rev]]）
- 不用：样本不联网（静态分析先做 [[re-triage]]）
- 不用：只要抓一个包的 quick look（
tcpdump -i any -c N一次搞定，不必搭全流程）
工具准备
所有工具先验证再使用。运行样本抓包默认在沙箱内（[[re-sandbox]] 网络隔离，[[platform-tips]] 最高原则）——捕获环境与隔离环境要同时就绪。
tcpdump —— 命令行抓包主力
- Linux:
apt install tcpdump/dnf install tcpdump/pacman -S tcpdump - macOS:
brew install tcpdump（或系统自带版本） - Windows/WSL: WSL 内 Linux 版；Windows 本机用 Wireshark 或 Npcap 自带 dumpcap
- 验证:
tcpdump --version；tcpdump -D列出接口
wireshark / tshark —— GUI + CLI 分析（tshark 用于导出与统计）
- Linux:
apt install wireshark tshark/dnf install wireshark-cli wireshark/pacman -S wireshark-cli wireshark-qt（Arch 已拆分为 wireshark-cli + wireshark-qt；Debian 安装时选"允许非 root 抓包"，或sudo dpkg-reconfigure wireshark-common后把用户加入 wireshark 组） - macOS:
brew install --cask wireshark（含 tshark CLI；或brew install wireshark仅 CLI） - Windows:
choco install wireshark（或官方安装包）；WSL 内用 Linux 版 - 验证:
tshark --version；tshark -D列出接口；dumpcap -D - 同族 CLI：
capinfos（pcap 元信息：包数/时长/截断）、mergecap（合并）、editcap（切分/去重/改写时间戳），随 Wireshark 一起安装
mitmproxy —— HTTPS/TLS 中间人解密
- 全平台:
pip install mitmproxy（Python 3.10+） - macOS:
brew install mitmproxy - Windows: pip 版即可（或官方安装包）；WSL 内 pip 版
- 验证:
mitmproxy --version；mitmdump --version
nfqueue —— 内核态流量转发/中间人抓包点（Linux）
- Linux:
apt install iptables libnetfilter-queue1 python3-netfilterqueue/dnf install iptables libnetfilter_queue-devel python3-netfilterqueue/pacman -S iptables libnetfilter_queue python-netfilterqueue；或pip install NetfilterQueue（需内核 nfnetlink_queue 支持） - macOS/Windows: 不支持（用 WSL2 内核或 Linux VM 做转发点）
- 验证:
python3 -c "from netfilterqueue import NetfilterQueue"；iptables -L -n | grep -i NFQUEUE能看到规则
操作步骤
按顺序执行，每步记下结果。捕获产物（pcap 路径 + sha256）存档供 [[re-proto-rev]] / [[re-crypto-decrypt]] 使用。
- 选择抓包点（本机 / 网关 / 中间人）：
- 本机: 目标程序跑在本机 →
tcpdump -i eth0 host <目标IP>（或 Wireshark 选接口直接抓） - 网关/转发点: 目标在沙箱 VM / 其他主机 → 在网关主机或 VM 虚拟网卡（virbr0 / vboxnet0）抓，
tcpdump -i virbr0 - 中间人: 需要看 HTTPS 明文 → mitmproxy 透明代理把目标流量强制引到本机（见步骤 4、5）；纯包级截获（不拆 TLS）才用 nfqueue handler
- 沙箱场景: 抓包点在沙箱虚拟网卡 + [[re-sandbox]] 的 INetSim/fake DNS 落点（见步骤 5）
- 决策记录：写下抓包点与理由（为什么这个点能同时看到请求与响应）
- 本机: 目标程序跑在本机 →
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 134 lines · 42 tokens per session scan B b6d8c4bc8706
re-netcap is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 42 tokens to every session and 3,517 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
ot-ics-attack
A guide to assessing operational technology and industrial control systems such as SCADA, DCS, and PLC environments. These systems monitor and control physical processes and often use specialized network protocols.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.