Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-plugin-devgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-plugin-dev)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-plugin-dev"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-plugin-dev/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-plugin-dev"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-plugin-dev.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.03292 |
| Opus 5 | $0.00019 | $0.01646 |
| Sonnet 5 | $0.00008 | $0.00658 |
| Haiku 4.5 | $0.00004 | $0.00329 |
Grade A, and why
re-plugin-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ghidra / IDA 插件开发
何时使用 / 何时不用
- 用：重复性分析步骤需要固化成可复用工具（批量标注、解密循环、自定义格式解析、特殊协议字段标注）
- 用：需要交互式 UI（菜单/快捷键/面板）或"工程加载即自动执行"的常驻功能
- 用：团队内分发/多机器统一分析环境（[[re-ghidra]] / [[re-ida]] 脚本升级为工程化插件）
- 不用：一次性分析任务（脚本即用即走，[[re-ghidra]] 步骤 4 / [[re-ida]] 步骤 4 的轻量脚本足够）
- 不用：只是把已有逻辑换个语言重写（先确认场景，见步骤 1）
工具准备
静态分析工具开发可免沙箱；插件跑在分析工具进程内，不执行样本代码（免沙箱，[[platform-tips]] 静态优先）。
Ghidra —— Java 扩展 / Python 脚本
- Ghidra 安装（JDK 21+，Ghidra 11.3+ 要求）见 [[re-ghidra]] 工具准备
- GhidraDev Eclipse 插件（官方，GitHub
NationalSecurityAgency/ghidra仓库内 GhidraDev 目录）: 需要 Eclipse（Linuxapt install eclipse/ Fedoradnf install eclipse-platform/ Archpacman -S eclipse-java；macOSbrew install --cask eclipse-java；Windows 官网 zip 解压）；非必需——纯 Gradle 也能构建扩展；GhidraDev 版本与 Eclipse 版本有配套表，装不上先在官方 release notes 核对组合 - Gradle（可选，构建 Java 扩展）: Debian/Ubuntu
apt install gradle/ Fedoradnf install gradle/ Archpacman -S gradle；macOSbrew install gradle；Windowschoco install gradle；验证gradle --version；发行版仓库的 Gradle 可能过旧（构建 Ghidra 扩展失败）——优先用 GhidraDev 工程自带的 gradle wrapper（./gradlew） - 验证: Ghidra GUI Script Manager 能列出脚本；
File > Install Extensions能看到安装的扩展
IDA —— idapython 插件
- IDA 安装见 [[re-ida]] 工具准备（idapython 内置，无需单独安装）
- 插件目录: Windows
%APPDATA%\Hex-Rays\IDA Pro\plugins\（或 IDA 安装目录plugins\）；Linux/macOS~/.idapro/plugins/ - 验证: 插件文件放入目录后 IDA 启动日志出现
Loading plugin ...；File > Script command执行print(idaapi.IDA_SDK_VERSION)输出 SDK 版本
操作步骤
按顺序执行；每个插件产物（源码/构建产物/测试样本与输出）存档 sha256 + 路径，供报告与复用（[[re-ioc]] 证据链要求）。
-
场景识别（批处理脚本 vs 交互插件）：
- 一次性/简单重复 → 脚本（[[re-ghidra]] 的 GhidraScript / [[re-ida]] 的 idapython 脚本）
- 常驻/需 UI/加载即执行/多机分发 → 插件（Ghidra Java Extension / IDA idapython 插件）
- 判据四条，命中其一即该做插件: ① 需要交互 UI（菜单/快捷键/对话框）② 工程加载后自动执行 ③ 团队多机分发（版本统一）④ 需要与外部服务/API 集成
- 记录决策: 场景 + 工具链 + 维护责任人（坑 4 的维护成本先摊开说）
-
Ghidra 插件骨架（Java 扩展 / 程序脚本）：
- Python 脚本（最轻）:
@category头注释 + 存 GhidraScripts 目录，Script Manager 运行（注意内置 Jython 2.7，见坑 2 与 [[re-ghidra]] 坑） - Java 扩展（工程化）: GhidraDev
New > Ghidra Module Project选 Extension → 实现Plugin类（覆写init/dispose，在init里注册菜单动作）→ Gradlegradle buildExtension产出 .zip → 目标机器File > Install Extensions安装 - 骨架要点: 动作注册用
ToolAction/AbstractAction挂到菜单；无头环境用-postScript测试（[[re-ghidra]] 步骤 4）；脚本与扩展的边界见 [[re-ghidra]] 坑（脚本 vs 扩展选型） - 扩展结构: 构建产物 .zip 内含 extension.properties（声明适用的 Ghidra 版本范围）——装到范围外版本会被拒载，分发时注明版本并锁范围
- 验证: 安装后在菜单触发动作；无头
analyzeHeadless ... -postScript MyPluginTest.java跑通输出；gradle buildExtension产出 zip 后先查 extension.properties 版本范围再分发
- Python 脚本（最轻）:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 107 lines · 39 tokens per session scan A b35123f94dcc
re-plugin-dev is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 39 tokens to every session and 3,292 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.