Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-ransomwaregit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-ransomware)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ransomware"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ransomware/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ransomware"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ransomware.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.02793 |
| Opus 5 | $0.00024 | $0.01396 |
| Sonnet 5 | $0.00010 | $0.00559 |
| Haiku 4.5 | $0.00005 | $0.00279 |
Grade A, and why
re-ransomware scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
勒索软件分析（加密识别 / 勒索信 / 解密恢复）
何时使用 / 何时不用
- 用：受害者文件被加密（扩展名变化、文件头损坏、熵升高）、出现勒索信（README/DECRYPT）的样本
- 用：需要判断"能不能恢复"并给出解密恢复路线（密钥提取 → 解密脚本 / 社区解密工具）
- 用：勒索样本的加密算法、密钥管理、C2 交互还原
- 不用：样本还没确认是勒索（先 [[re-triage]] 初勘 + [[re-behavior]] 行为确认）
- 不用：只分析加密算法本身（直接走 [[re-crypto-id]] / [[re-crypto-keys]]）
- 注意：运行样本 = 会真实加密文件，必须在沙箱快照内（[[re-sandbox]] 强制前置，[[platform-tips]] 最高原则）；静态分析可免沙箱
工具准备
所有工具先验证再使用。加密三件套与沙箱的完整装法见各技能，本技能直接复用；本技能独有的是文件系统快照工具（防样本加密破坏分析环境，坑 1）。
加密分析三件套（复用 crypto 域）
- [[re-crypto-id]]：算法识别（常量表指纹、自定义加密）
- [[re-crypto-keys]]：密钥提取（硬编码/内存/资源）
- [[re-crypto-decrypt]]：解密脚本（pycryptodome 装法见该技能）
- 验证:
python3 -c "from Crypto.Cipher import AES; print('ok')"（见 [[re-crypto-decrypt]]）
沙箱环境（运行前置）
- [[re-sandbox]]：VM 快照 + 网络隔离（INetSim / fake DNS）；勒索样本动态分析默认 VM 快照级别（加密行为破坏性强）
- 验证: 快照
VBoxManage snapshot <vm> list有 clean；网络ping 8.8.8.8不通
文件系统快照工具（加密前状态留底）
- Linux: btrfs 快照
snapper——Debian/Ubuntuapt install snapper/ Fedoradnf install snapper/ Archpacman -S snapper；验证:snapper --version。非 btrfs 用tar/rsync（自带）备份观察目录 - Windows: 卷影复制
vssadmin（系统自带）——vssadmin list shadows验证；快照也是解密恢复途径之一（步骤 5） - macOS: Time Machine
tmutil（自带）——tmutil listbackups验证 - 哈希/枚举:
sha256sum/find（coreutils 自带）
家族识别与解密工具调研（在线，无需安装）
- ID Ransomware（id-ransomware.malwarehunterteam.com）：上传勒索信/加密文件头识别家族
- No More Ransom（nomoreransom.org）：官方解密器集合（坑 4 时效性）
- [[re-ti]]：样本哈希查 VT / 社区报告，确认家族与已有分析结论
操作步骤
按顺序执行，每步记录证据（路径 + sha256，见 [[re-triage]]）。静态优先（[[platform-tips]] 静态优先原则）：先在宿主机做 1-2，需要运行时才进沙箱。
- 初始判断（扩展名变化 / 加密头特征 / 勒索信）：
sha256sum sample.exe 被加密文件 # 存证（[[re-triage]]） file 被加密文件 # 文件头是否被改写/替换 xxd -l 64 被加密文件 # 头部特征：固定前缀=感染 ID/密钥块，尾部特征同理 find / -xdev -iname "*README*" -o -iname "*DECRYPT*" -o -iname "*RECOVER*" 2>/dev/null find . -type f -mmin -60 -size +1k | head # 加密时间窗内被改动的文件- 判定信号：扩展名批量变化（.crypt/.locker/.encrypted）、原文件被删/被覆盖、目录出现勒索信、桌面壁纸被换
- 先给受害者文件整体哈希/目录清单留底（与快照互为备份）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 103 lines · 49 tokens per session scan A a432f7a3a629
re-ransomware is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 49 tokens to every session and 2,793 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.