Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-protocolgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-protocol)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-protocol"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-protocol/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-protocol"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-protocol.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00122 | $0.02826 |
| Opus 5 | $0.00061 | $0.01413 |
| Sonnet 5 | $0.00024 | $0.00565 |
| Haiku 4.5 | $0.00012 | $0.00283 |
Grade A, and why
re-protocol scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
协议逆向
完整工作流
按顺序执行；每步产物（pcap/密钥/解密脚本/解析脚本）记录证据路径 + sha256，供报告引用（见 [[re-ioc]]）。
- 捕获：[[re-netcap]] —— 先定抓包点（本机/网关/中间人），沙箱内捕获优先（[[re-sandbox]] 网络隔离：INetSim / fake DNS / 断网，防真外联，见 [[platform-tips]] 最高原则）；tcpdump 过滤只留目标流再存盘，HTTPS/TLS 提前用 mitmproxy CA 做准备
- 加密识别：[[re-crypto-id]] —— 判断流量是明文还是密文：熵 >7.0 / 无结构 / 无 ASCII → 密文；再做常量表指纹（AES S-box / CRC 表）、XOR/ROL/ROR 单字节模式、常见算法流程特征
- 密钥：[[re-crypto-keys]] —— 静态优先（strings / 交叉引用找硬编码、资源文件、导入表 Crypt* 附近），静态没有再上动态（[[re-memdump]] 默认转储后搜 16/32 字节熵块与可打印口令），PBKDF 类按派生函数还原
- 解密：[[re-crypto-decrypt]] —— 定位解密函数（交叉引用密文输入点）→ 反编译还原算法 → 重写为独立 python 脚本 → 用已知明文/已知头部验证 → 把捕获的密文流解成明文流量流
- 状态机重建：[[re-proto-rev]] —— 明文流量才做这一步：分组统计与聚类（长度/方向/时序）→ 定位固定头（magic/长度字段）→ 字段推断（类型/长度/CRC）→ Scapy 写解析器 → 状态机推演（握手/心跳/结束）
前置检查：密文未解密不要进入状态机重建（会拿乱码当结构）；明文流量跳过步骤 2-4。
何时用哪个原子技能（选择树）
按输入特征/目标分支：
- 有流量（pcap / 实时抓包） → [[re-netcap]]（捕获）→ 看是否密文：
- 密文（熵高/无结构）→ [[re-crypto-id]] → [[re-crypto-keys]] → [[re-crypto-decrypt]] → 明文后再 [[re-proto-rev]]
- 明文 → [[re-proto-rev]] 直接重建状态机
- 工控/SCADA 协议（Modbus/DNP3/OPC UA，端口 502/20000/4840） → [[re-ics]]（工控流量解析与点表；安全测试边界见 [[re-sandbox]]）
- 物联网设备协议（MQTT/CoAP/BLE/Zigbee，1883/5683/2.4GHz 频段） → [[re-iot-proto]]（设备语义解析 + 固件联动 [[re-firmware]]）
- 只有二进制样本没有流量（"协议实现逻辑是什么"）→ 从静态找加密实现 [[re-crypto-id]] → [[re-crypto-keys]] → [[re-crypto-decrypt]]；逻辑深挖转 [[re-binary-core]]（[[re-ghidra]] / [[re-ida]] / [[re-radare2]]）
- 要理解交互语义（"客户端和服务端怎么对话""握手过程"）→ [[re-proto-rev]]
- 只要解密一个已知算法的 blob（算法/密钥已知）→ 直接 [[re-crypto-decrypt]]
- 只要找密钥（"样本里有没有硬编码密钥"）→ [[re-crypto-keys]]（静态优先，见 [[platform-tips]] 最高原则的静态优先思路）
- 白盒加密（大段查表代码、无标准库调用、密钥藏在表里）→ [[re-whitebox]]（识别 → 表提取 → 密钥恢复，衔接加密三件套）
- 流量捕获环境未就绪 → 先 [[re-sandbox]] 网络隔离（INetSim / fake DNS）再回来 [[re-netcap]]
- 标准 TLS/加密流量深度（ClientHello 指纹、SSLKEYLOG 解密、TLS 1.2/1.3）→ [[re-tls]]（标准 TLS 栈；自实现加密转 crypto 三件套）
跨域联合
- C2 通信分析（[[re-malware]]）：本网关是 re-malware 工作流第 4 步（捕获回连流量 → 重建协议 → 识别并解密通信加密）；加密三件套（crypto-id / crypto-keys / crypto-decrypt）被 C2 解密路径直接引用；捕获依赖 [[re-sandbox]] 的 INetSim / fake DNS 网络隔离
- 固件通信分析（[[re-firmware]]）：本网关是 re-firmware 工作流第 6 步（固件回连 / 自定义协议 / 加密通信），[[re-netcap]] 从仿真环境的虚拟网卡抓包，binwalk 解出的协议线索供 [[re-proto-rev]] 参考
- 行为分析衔接（[[re-behavior]]）：行为分析记录到网络连接（回连域名/IP/端口）后转本网关做协议层分析
- IOC 产出（[[re-ioc]]）：C2 域名/IP/端口、协议指纹、解密出的配置明文进 IOC 列表与 YARA 特征
- 二进制深挖（[[re-binary-core]]）：加密实现/解密函数反编译走 [[re-ghidra]] / [[re-ida]] / [[re-radare2]]；密钥在内存走 [[re-memdump]]
- 白盒加密（[[re-whitebox]]）：加密识别/密钥链路遇到白盒实现（无显式密钥的大段查表加密）时转入——常规 [[re-crypto-keys]] 路径失效的分支
- TLS 专项（[[re-tls]]）：标准 TLS 流量深度分析——JA3/JA4 指纹、SSLKEYLOG 解密（TLS 1.2/1.3）、证书链分析；解密后的明文流量继续 [[re-proto-rev]]
- 入口调度：本网关被 [[re-analyze]] 的 triage.md「分析网络流量 / 未知协议」路径调用（re-protocol → netcap → crypto-* → proto-rev）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 67 lines · 122 tokens per session scan A d488456891fa
re-protocol is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 122 tokens to every session and 2,826 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.