Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-stegogit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-stego)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-stego"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-stego/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-stego"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-stego.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.02763 |
| Opus 5 | $0.00030 | $0.01381 |
| Sonnet 5 | $0.00012 | $0.00553 |
| Haiku 4.5 | $0.00006 | $0.00276 |
Grade A, and why
re-stego scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
隐写术检测与提取
何时使用 / 何时不用
- 用：隐写怀疑（CTF 题/取证对象）、文件尾异常、图片/音频异常（尺寸/噪声/文件结构不匹配）
- 用：文件结构异常（IEND 后仍有数据/EXIF 段超长/像素数与文件大小不匹配）
- 用：多载体组合（题目/取证场景常见——多文件各藏一部分）
- 用：取证场景未分配空间/文件系统残留扫描（与 [[re-disk-forensics]] 配合）
- 不用：正常文件分析（各归各域技能）；加密数据解密（密文 ≠ 隐写，载荷解密转 [[re-crypto-decrypt]]）；未知文件类型识别（[[re-triage]] 先行）
- 不用：无载体线索的漫无目的扫描（先有怀疑特征再动手，见 [[decision-tree]]）
工具准备
zsteg（图片 LSB 扫描）
- 多平台:
gem install zsteg或源码（GitHub） - 验证:
zsteg -h或gem list zsteg - 覆盖范围：PNG/BMP 支持好，GIF 支持有限——GIF 载体换 python 脚本路径
steghide（图片/音频隐写）
- Linux:
apt install steghide/dnf install steghide；macOS:brew install steghide - 验证:
steghide --version；steghide info file.jpg（查看是否嵌入数据，无需密码）
binwalk（尾部扫描）
- 安装与验证见 [[re-fw-extract]] 工具准备
其他检测/提取工具
- exiftool（EXIF/元数据）：Linux
apt install libimage-exiftool-perl/dnf install perl-Image-ExifTool；macOSbrew install exiftool；验证exiftool -ver - pngcheck（PNG 结构校验/异常）：Linux
apt install pngcheck；macOSbrew install pngcheck；验证pngcheck -v - sox（音频处理/频谱图）：Linux
apt install sox；macOSbrew install sox；验证sox --version - foremost（数据雕刻，取证场景）：
apt install foremost/brew install foremost - stegsolve（逐位平面查看，Java GUI）：GitHub 下载 jar（
java -jar stegsolve.jar） - outguess（JPEG DCT 域，旧工具）：Linux
apt install outguess - ffmpeg（音频格式转换，可选）：
apt install ffmpeg/brew install ffmpeg - python3（位操作/验证脚本 + PIL）：安装见 [[re-python]]；
pip install pillow；验证python3 -c "from PIL import Image"
操作步骤
按顺序执行，每步产物存档（路径 + sha256，见 [[re-triage]]）。
- 文件尾附加检测：
binwalk sample.png | tail -20 # 附加数据扫描 hexdump -C sample.png | tail -10 # 尾部目检- 尾部附加：文件正常但尾部有多余数据（衔接尾部附加经验（[[re-patching]] 补丁制作思路））
- 结构核对：
pngcheck -v sample.png看 IEND 位置与文件尾差距（差值 ≈ 附加数据量） - 弱线索快速扫：
strings -a sample.png | grep -iE 'flag|ctf|http' - 大小核对：与声称内容明显不符（如 3MB 的「小图」）是弱线索
- 提取：binwalk 自动分割或 dd 按偏移提取（
dd if=sample.png of=tail.bin bs=1 skip=<偏移>）→ magic 检查（[[re-triage]]） - EXIF 查看：
exiftool -a sample.jpg（全段列出，异常字段/大块注释可疑） - 其他文件冗余区：EXIF 元数据（exiftool 查看）、文件头保留区、压缩文件未用空间
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 118 lines · 60 tokens per session scan A 7185bec3c4c8
re-stego is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 60 tokens to every session and 2,763 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.