Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-vulngit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-vuln)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-vuln"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-vuln/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-vuln"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-vuln.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.02188 |
| Opus 5 | $0.00058 | $0.01094 |
| Sonnet 5 | $0.00023 | $0.00438 |
| Haiku 4.5 | $0.00012 | $0.00219 |
Grade A, and why
re-vuln scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.
漏洞挖掘（覆盖率引导 fuzzing / 崩溃定位）
完整工作流
按顺序执行；每步产物（目标/输入面结论、fuzz 运行目录、崩溃样本、定位证据）记录证据路径 + sha256（存证方法见 [[re-triage]]），供报告引用。
- 目标与输入面识别 —— 先弄清"fuzz 什么、输入从哪进"（见坑 1）：
- 目标形态：本地文件解析（图像/压缩/文档/自定义格式）、网络服务（监听端口收包）、库函数（被调用的解析 API）、命令行工具（argv/stdin）
- 输入面：fuzz 输入通道（文件 / 文件内容 / 网络包 / stdin / argv）与解析入口函数
- 初勘：
file/strings/ 熵 / checksec（[[re-triage]]）；静态定位解析入口（[[re-binary-core]] 底座，[[re-ghidra]] 反编译找主处理函数） - 决策：fuzz 引擎与插桩方式（源码可插桩 / 无源码 QEMU 模式），见「选择树」
- 覆盖率引导 fuzzing → [[re-fuzzing]] —— 插桩 + 语料 + 跑起来：
- 源码可用：AFL++ 编译器包装器 + ASAN 构建（
afl-clang-fast -fsanitize=address）；库函数写 harness；无源码-Q（QEMU 模式） - 初始化语料（最小有效样本，
afl-cmin去重），afl-fuzz多实例跑（-M main/-S secondary） - 覆盖率监控（afl-cov / afl-whatsup），观察 paths 增长；加字典 / 结构化输入提速
- 源码可用：AFL++ 编译器包装器 + ASAN 构建（
- 崩溃分析 → [[re-crash-triage]] —— 出现 crash 立即处理：
- 确定性复现（同一输入重跑必崩）；ASAN 报告解读（堆溢出 / 越界 / UAF / double-free）
- 输入最小化（afl-tmin / afl-cmin）→ 最小 PoC
- 非确定性崩溃用 rr 录制重放
- 逆向定位（[[re-binary-core]] 底座） —— 把崩溃翻译成漏洞根因：
- [[re-triage]]：崩溃输入 sha256 存证 + 目标基线记录
- [[re-ghidra]]（或 [[re-ida]] / [[re-radare2]]）：gdb 回溯栈中无符号帧用反编译补（见坑 5）；定位崩溃函数与输入数据流向
- 确认：越界/悬垂发生在哪段逻辑、输入是否可控、路径是否真实可达（见坑 3）
- 崩溃 core（进程已死 / 已有 core dump）→ [[re-memdump]] 分析
- 报告：
- 记录：崩溃类型、复现命令、最小 PoC（文件 + sha256）、根因（函数/行/偏移）、可达性分析、影响（越界读/写、RCE/DoS）、修复建议
- 产出：PoC / 崩溃特征可进 [[re-ioc]]
何时用哪个原子技能（选择树）
按目标输入形态 / 当前状态分支：
- 本地文件解析（输入是一个文件：图像/压缩/文档/自定义格式解析器）→ [[re-fuzzing]] 用 AFL++（源码插桩 + ASAN；无源码
-QQEMU 模式） - 库函数（目标是库的 API，如 libpng 的
png_read_*、自定义 parser 函数）→ [[re-fuzzing]] 用 libFuzzer（-fsanitize=fuzzer,address+ fuzz target harness），或 AFL++ 持久模式 harness - 网络服务（监听端口、协议解析）→ 网络 fuzz：[[re-netcap]] 抓真实流量做种子，写 harness 重放喂解析函数（见 [[re-fuzzing]] 坑 5）；fuzz 的是解析器不是网络栈
- 已有崩溃 / 崩溃输入（无需重跑 fuzz）→ 直接 [[re-crash-triage]]：确定性复现 → 最小化 → 定位
- 崩溃已定位、要读函数逻辑 → [[re-binary-core]] 底座（[[re-ghidra]] / [[re-ida]] / [[re-radare2]]）
- 崩溃是 core 文件（进程已死）→ [[re-memdump]] 分析 core，再按需逆向
- 目标无输入解析（纯算法/纯逻辑） → fuzz 不适合，符号执行更优（[[re-angr]] / [[re-z3]]）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 70 lines · 116 tokens per session scan A 80272a853355
re-vuln is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 13d ago), licensed Apache-2.0. It adds 116 tokens to every session and 2,188 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
race-condition-exploit
A guide to testing race-condition vulnerabilities, where two or more requests arrive at nearly the same time and bypass checks that should happen in order.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.