Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-pythongit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-python)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-python"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-python/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-python"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-python.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.03661 |
| Opus 5 | $0.00034 | $0.01831 |
| Sonnet 5 | $0.00014 | $0.00732 |
| Haiku 4.5 | $0.00007 | $0.00366 |
Grade A, and why
re-python scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Python 打包样本分析（PyInstaller / PyArmor / pyc）
何时使用 / 何时不用
- 用：PyInstaller 单文件/目录 exe、PyArmor 加固样本、.pyc 文件、Nuitka/Cython 编译产物、Python 恶意软件打包样本
- 不用：纯 .py 源码混淆（base64/编码包装）→ 转 [[re-script-deob]]；Python 模型权重（pkl/onnx）→ [[re-ai-model]]
工具准备
参考 [[platform-tips]]——解包/反编译为静态步骤，免沙箱；动态取明文（[[re-sandbox]]）按最高原则进沙箱。
python3（基础运行时，必备）
- Linux:
apt install python3/dnf install python3/pacman -S python - macOS:
brew install python（系统自带） - Windows: 官网安装包或
choco install python - 验证:
python3 --version
pyinstxtractor（PyInstaller 归档提取）
- 多平台:
pip install pyinstxtractor-ng或 GitHub 脚本python pyinstxtractor.py - 验证:
pyinstxtractor-ng <目标.exe>运行无报错（无独立 --help 命令）
PyArmor-Unpacker（PyArmor 加固解包）
- 多平台:
git clone https://github.com/Svenskithesource/PyArmor-Unpacker，按 README 按 PyArmor 版本选三方法之一 - 验证: 仓库内 python 脚本可运行
pycdc / pycdas（pyc 反编译）
- Linux/macOS:
git clone https://github.com/zrax/pycdc && cd pycdc && cmake . && make - Windows: 预编译二进制或 WSL 编译
- 验证:
./pycdc --help
file（打包器识别辅助，通用）
- 各系统自带（Linux binutils / macOS / Windows 需额外装或跳过）
- 验证:
file --version
操作步骤
按顺序执行，每步产物存档（路径 + sha256，见 [[re-triage]]）。
-
识别打包器：
file sample.exe strings sample.exe | grep -iE 'PyInstaller|_MEIPASS|pyi-|PyArmor|pyarmor' | head- PyInstaller 特征：
PyInstaller版本串、_MEI临时目录名、pyi-前缀引导器 - PyArmor 特征：
pyarmorruntime 字符串 - Nuitka/Cython：无 pyc、纯编译产物（
file显示普通可执行，无 Python runtime 打包特征） - 识别失败但确认 Python 相关 → 按可疑 PyInstaller 处理
- PyInstaller 特征：
-
PyInstaller 解包：
- pip 安装用户：
pyinstxtractor-ng sample.exe；GitHub 脚本用户：python pyinstxtractor.py sample.exe
python pyinstxtractor.py sample.exe # 输出 sample.exe_extracted/ 目录，含 PYZ-00.pyz（依赖归档）与主脚本 .pyc- 定位主 .pyc（名字与入口脚本对应）；PYZ 内模块自动解出至
PYZ-00.pyz_extracted/；模块清单可用 archive_viewer.py 查看
- pip 安装用户：
-
PyArmor 解包（步骤 1 检测到 PyArmor 时）：
- 按 PyArmor 版本选 PyArmor-Unpacker 三方法之一（README 判断版本 → 对应方法）
- 解包产物仍为 pyc 或源码，继续下一步
-
pyc 版本识别：
python3 -c "import struct,sys; print(struct.unpack('<H', open('main.pyc','rb').read(2))[0])"- magic 对照（小端 2 字节，常见值；以本机 MAGIC_NUMBER 为准）：
0d33=3.6、0d42=3.7、0d55=3.8、0d61=3.9、0d6f=3.10、0da7=3.11、0dcb=3.12- 3.13+：不写死数值，按本机 MAGIC_NUMBER 换算（
python3 -c "import importlib.util; print(hex(int.from_bytes(importlib.util.MAGIC_NUMBER[:2],'little')))"）
- pyc 头布局（3.7+ 统一 16 字节）：magic(4) + flags(4) + mtime(4) + size(4)，code 对象从偏移 16 开始；flags 低 1 位 = hash-based（PEP 552，mtime/size 无意义）；PyInstaller 解出的 pyc 头 flags/mtime/size 全 0（清零是正常现象，不是损坏）
- 版本决定 marshal 格式：3.14 起 marshal 升到 v5，code 对象内部布局与旧版不同——手写 marshal 解析须按 magic 版本分派；pycdc 等工具对 3.13+ 支持滞后，优先用匹配版本 python 的
dis/marshal兜底 - 版本匹配目标则用对应版本 python 或 pycdc 反编译；不匹配先装匹配版本再试
- magic 对照（小端 2 字节，常见值；以本机 MAGIC_NUMBER 为准）：
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 114 lines · 69 tokens per session scan A 35699183151d
re-python is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 69 tokens to every session and 3,661 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-windows-prefetch-with-python
Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file/volume lists. Use when investigating renamed or masquerading binaries, verifying program execution timelines, or hunting for suspicious execution patterns in incident…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-windows-prefetch-with-python
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
analyzing-windows-prefetch-with-python
Use when parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns. Use when working with analyzing windows prefetch with python.
opencrow-crypto-toolbox
Use the best available portable Python runtime and installed crypto tooling for CTF tasks that fit normal Python or CLI cracking rather than SageMath. Prefer a detected ctf environment. Use when an agent needs z3, fpylll, pycryptodome, hashcat, john, or quick FactorDB lookups.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.