Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-wasmgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-wasm)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-wasm"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-wasm/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-wasm"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-wasm.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.03332 |
| Opus 5 | $0.00018 | $0.01666 |
| Sonnet 5 | $0.00007 | $0.00666 |
| Haiku 4.5 | $0.00004 | $0.00333 |
Grade C, and why
re-wasm scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- 官方安装器（全平台，装到 `~/.wasmtime/bin`）: `curl https://wasmtime.dev/install.sh -sSf | bash` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- 官方安装器（全平台，装到 `~/.wasmtime/bin`）: `curl https://wasmtime.dev/install.sh -sSf | bash` How it starts
The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.
WebAssembly 逆向（WABT / wasmtime / Chrome DevTools）
何时使用 / 何时不用
- 用：.wasm 模块还原逻辑（网页前端加密/校验、浏览器插件、游戏、恶意网页/供应链 JS 加载的 wasm 载荷）
- 用：
WebAssembly.instantiate/WebAssembly.Module/.wasmfetch 出现的样本——wasm 与 JS 胶水一体分析 - 不用：非 wasm（native 走 [[re-binary-core]]、.NET 走 [[re-dotnet]]、Java 走 [[re-java]]、纯 JS/脚本走 [[re-script-deob]]）
- 不用：wasm 模块本身可读性尚可、只需读逻辑——直接
wasm2wat读 WAT 即可，无需完整流程 - 注意：动态运行默认沙箱（[[platform-tips]] 最高原则）；wasm 模块相对隔离，但宿主 JS 胶水会调 DOM/网络等敏感 API——JS 侧先还原（[[re-script-deob]]）
工具准备
参考 [[platform-tips]]——wasm 解析/反编译为静态步骤，免沙箱；动态运行（wasmtime/wasm3/浏览器加载）按最高原则进沙箱（至少断网）。
WABT（wasm2wat / wasm-decompile / wasm-objdump，解析与反编译主力）
- Debian/Ubuntu:
apt install wabt；Fedora:dnf install wabt；Arch:pacman -S wabt - macOS:
brew install wabt；Windows:choco install wabt或 GitHubWebAssembly/wabtrelease 的 bin 目录 - 验证:
wasm2wat --version && wasm-decompile --version && wasm-objdump --version
wasmtime（WASI CLI 运行时，--invoke 直调导出函数）
- 官方安装器（全平台，装到
~/.wasmtime/bin）:curl https://wasmtime.dev/install.sh -sSf | bash - Debian/Ubuntu: 无官方包——用官方安装脚本/二进制（install.wasmtime.dev）或源码构建；Fedora: 官方仓库无 CLI 包——用官方安装脚本或第三方仓库（GetPageSpeed/COPR）；Arch:
pacman -S wasmtime；macOS:brew install wasmtime；Windows:winget install BytecodeAlliance.Wasmtime - 验证:
wasmtime --version
wasm3（轻量解释器，无 WASI 依赖也可跑，嵌入式/快速验证场景）
- Arch: 官方仓库无 wasm3——AUR（如 wasm3 包）或源码构建；macOS:
brew install wasm3 - Debian/Ubuntu/Fedora 无官方包 → GitHub
wasm3/wasm3release 下载对应平台单文件二进制，或源码构建:git clone --depth 1 https://github.com/wasm3/wasm3 && cmake -B build -S wasm3 && cmake --build build - 验证:
wasm3 --version
Chrome DevTools（浏览器侧动态分析）
- Chrome/Chromium: Debian/Ubuntu
apt install chromium（Chrome 用官方 deb）；Fedoradnf install chromium；Archpacman -S chromium；macOSbrew install --cask google-chrome；Windows 官方安装器 - 验证: 启动浏览器
F12打开 DevTools → Sources 面板能展开 .wasm 文件 - 本地起服务供浏览器加载:
python3 -m http.server 8000
binaryen（wasm-opt 优化/混淆还原，wasm-dis 反汇编）
- Debian/Ubuntu:
apt install binaryen；Fedora:dnf install binaryen；Arch:pacman -S binaryen - macOS:
brew install binaryen；Windows:choco install binaryen或 GitHubWebAssembly/binaryenrelease - 验证:
wasm-opt --version
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 122 lines · 36 tokens per session scan C 47cfff341915
re-wasm is a skill published in the GitHub repository dslsdzc/rev-skills (50 stars, last pushed 11d ago), licensed Apache-2.0. It adds 36 tokens to every session and 3,332 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.