Borrowing it
Nothing to install: this file belongs to dslsdzc/rev-skills. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dslsdzc/rev-skills/main/.claude/skills/re-tls/SKILL.mdgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-tls)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-tls"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-tls/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-tls"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-tls.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.03952 |
| Opus 5 | $0.00025 | $0.01976 |
| Sonnet 5 | $0.00010 | $0.00790 |
| Haiku 4.5 | $0.00005 | $0.00395 |
Grade A, and why
re-tls scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- 特征清单: ① 指纹聚类——JA3/JA4 新簇或命中已知恶意库（curl/python requests 原生栈也是常见信号）② 异常证书——自签名/短有效期/SNI 与 IP 不匹配/证书 CN 是 IP ③ 信标节奏——固定间隔短连接（与 [[re-behavior]] 时间线对齐）④ SNI 异常——随机子域名/高熵 SNI/无 SNI（硬编码 IP 直连，[[re-netcap]] DoH 坑同源）⑤ 混合协议——443 How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TLS/加密流量深度分析
何时使用 / 何时不用
- 用：TLS/HTTPS 流量要"解密看明文"（有 keylog 或中间人）——C2 通信、固件回连、加密应用协议
- 用：只有密文 pcap 也要做深度——ClientHello/证书指纹聚类、异常 TLS 特征判定
- 用：证书链验证/证书内容分析（openssl x509）
- 不用：只抓包不深入（那是 [[re-netcap]]）
- 不用：流量已解密、无 TLS 层（直接 [[re-proto-rev]] 重建状态机）
- 不用：非标准 TLS 的自定义加密（走 [[re-crypto-id]] → [[re-crypto-keys]] → [[re-crypto-decrypt]]）
- 注意：本技能处理流量与密钥文件，不运行样本，默认可免沙箱；抓包环节按 [[re-netcap]] 在隔离环境进行（[[re-analyze/platform-tips]] 最高原则）
工具准备
所有工具先验证再使用。
tshark / wireshark —— 解析、指纹、解密主力（安装见 [[re-netcap]]）
- Linux:
apt install wireshark tshark/dnf install wireshark-cli wireshark/pacman -S wireshark-cli wireshark-qt - macOS:
brew install --cask wireshark（含 tshark CLI）；Windows:choco install wireshark - 验证:
tshark --version；tshark -r out.pcap -Y 'tls.handshake.type == 1' | head -1能解析 ClientHello - JA3 字段（Wireshark 3.6+ 内置）与 JA4 字段（Wireshark 4.2+ 原生，仅客户端）: 验证
tshark -r out.pcap -T fields -e tls.handshake.ja4 | head -1有输出；本机字段存在性以tshark -G fields | grep -iE 'ja3|ja4'为准
openssl —— 证书解析与 TLS 交互（跨 OS）
- Linux:
apt install openssl/dnf install openssl/pacman -S openssl（多数预装） - macOS:
brew install openssl（keg-only，PATH 加/opt/homebrew/opt/openssl@3/bin（Apple Silicon）或/usr/local/opt/openssl@3/bin（Intel）） - Windows:
choco install openssl.light（PATH 需手动加，见包说明）或 Git for Windows 自带openssl.exe - 验证:
openssl version
python3 —— 指纹聚类/批量分析脚本（可选）
- 安装与验证见 [[re-proto-rev]] 工具准备（python3）
SSLKEYLOG 环境 —— Chrome/Firefox 密钥导出（非独立工具）
- Chrome: 启动前设置环境变量
SSLKEYLOGFILE=/tmp/keys.log（Linux/macOS）或set SSLKEYLOGFILE=C:\keys.log（Windows） - Firefox: 同样环境变量（设置后需重启浏览器）
- Wireshark: 编辑 → 首选项 → Protocols → TLS → (Pre)-Master-Secret log filename 指向该文件；tshark 侧用
-o tls.keylog_file:... - 验证: 设置后访问 HTTPS 站点，keys.log 出现
CLIENT_HANDSHAKE_TRAFFIC_SECRET等行（TLS 1.3）或CLIENT_RANDOM行（TLS 1.2）
mitmproxy —— 中间人解密（可选，安装见 [[re-netcap]]）
- 场景: 无 keylog 权限的第三方程序（自实现 TLS 栈、证书固定见坑 4）
- 验证:
mitmdump --version
操作步骤
按顺序执行，每步产物（指纹表/证书/解密流量）存档 sha256 + 路径（[[re-ioc]] 证据链要求）。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed 4768b968ede3
- 9d ago First seen · 137 lines · 50 tokens per session scan A c1d6c14e14f0
re-tls is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed today), licensed Apache-2.0. It adds 50 tokens to every session and 3,952 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.