Borrowing it
Nothing to install: this file belongs to dslsdzc/rev-skills. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dslsdzc/rev-skills/main/.claude/skills/re-ti/SKILL.mdgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-ti)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ti"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ti/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ti"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ti.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 28 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium MCP Rug Pull · line 43 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- medium Data Exfiltration · line 96 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.02820 |
| Opus 5 | $0.00026 | $0.01410 |
| Sonnet 5 | $0.00010 | $0.00564 |
| Haiku 4.5 | $0.00005 | $0.00282 |
Grade A, and why
re-ti scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
### curl —— API 请求 How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
威胁情报查询与关联
何时使用 / 何时不用
- 用：拿到样本 hash / 域名 / IP 要查已知恶意背景（"这个样本是什么""哪个家族"）；沙箱报告解读；家族/团伙关联；MISP 事件关联；情报进报告
- 用：分析完成后用情报验证结论（[[re-malware]] / [[re-forensics]] 的线索需要外部佐证）
- 不用：只想跑行为分析——那走 [[re-sandbox]] / [[re-behavior]]，沙箱查询只是情报手段之一
- 不用：纯离线环境无外网（只能做静态本地匹配）；VT 无结果≠干净（见坑 1）
工具准备
本技能以查询/解读为主，不运行样本；上传到沙箱的动态执行须在 [[re-sandbox]] 内（默认沙箱最高原则，见 [[re-analyze/platform-tips]]）。
VirusTotal（核心查询，网页 + API）
- 网页: https://www.virustotal.com/ —— 查 hash/域名/IP，无安装
- API key: https://www.virustotal.com/gui/my-apikey 生成；存环境变量
VT_API_KEY（export VT_API_KEY=...，Windows 用setx） - 验证:
[ -n "$VT_API_KEY" ] && echo ok；带 key 请求返回 JSON（401/403 说明 key 无效或配额用完） - 隐私注意：查私有样本前确认数据策略——VT 是共享情报，上传会向第三方公开，内部样本先问归属/权限（见坑 2）
curl —— API 请求
- Linux:
apt install curl/dnf install curl/pacman -S curl（多数自带） - macOS: 自带
- Windows/WSL: Windows 10+ 自带 curl.exe；WSL 用 Linux 包
- 验证:
curl --version
Any.run / hybrid-analysis（沙箱报告，网页）
- Any.run: https://any.run/ 注册即可查/提交（网页交互式沙箱，有公开报告库）
- hybrid-analysis: https://www.hybrid-analysis.com/ 注册即可查/提交（API 免费额度）
- 无安装；上传样本前同样确认数据公开策略
MISP（可选，团队自建情报库）
- 部署（Linux）:
docker run -d --name misp -p 8080:80 harvarditsecurity/misp（社区镜像，正式部署按官方文档） - 验证: 浏览器打开 https://localhost:8080 能登录（默认账号 [email protected] / admin）
- 没有现成 MISP 实例时跳过本环节，不阻塞查询
jq（可选，解析 API JSON）
- Linux:
apt install jq/dnf install jq/pacman -S jq - macOS:
brew install jq - Windows:
winget install jqlang.jq - 验证:
jq --version
操作步骤
按顺序执行；步骤 1-3 对每个线索（hash/域名/IP）都过一遍，记下结果与查询时间（证据）。
- 哈希/域名/IP 查询（VT）：
curl -s --request GET \ --url "https://www.virustotal.com/api/v3/search?query=<sha256_or_domain_or_ip>" \ -H "x-apikey: $VT_API_KEY" | jq '.data[0].attributes | {last_analysis_stats, names, tags, popular_threat_category}'- 网页同样可查：hash 页看检测数（
last_analysis_stats的 malicious 计数）、厂商命中、tags、popular_threat_category - 域名/IP 页看解析记录、历史检测、关联样本；查不到检测不直接判干净（见坑 1）
- 隐私选项：上传/查询私有对象用 VT 的私有 API（企业版）或先确认数据公开风险（见坑 2）
- 网页同样可查：hash 页看检测数（
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines 999f4a9eac2f
- 9d ago First seen · 129 lines · 51 tokens per session scan A 4e97fe99c99d
re-ti is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed today), licensed Apache-2.0. It adds 51 tokens to every session and 2,820 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.