Borrowing it
Nothing to install: this file belongs to N0zoM1z0/th08. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/N0zoM1z0/th08/main/.agents/skills/th08-library/SKILL.mdgit clone --depth 1 https://github.com/N0zoM1z0/th08Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/n0zom1z0/th08/th08-library)<a href="https://agentmods.dev/skills/n0zom1z0/th08/th08-library"><img src="https://agentmods.dev/badge/skills/n0zom1z0/th08/th08-library/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/n0zom1z0/th08/th08-library"><img src="https://agentmods.dev/badge/skills/n0zom1z0/th08/th08-library.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.00751 |
| Opus 5 | $0.00031 | $0.00376 |
| Sonnet 5 | $0.00012 | $0.00150 |
| Haiku 4.5 | $0.00006 | $0.00075 |
Grade A, and why
th08-library scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TH08 target-linked library recovery
This skill covers type=library rows inside the original Japanese TH08 1.00d
image. It does not cover 3rdparty/Detours, which only supports the optional
reconstruction DLL.
Preflight
-
Read
AGENTS.md,docs/RE_HANDOFF.md,docs/RE_WORKFLOW.md, anddocs/TOOLS.md. -
Run:
python3 scripts/verify-target.py python3 scripts/validate-tracking.py --require-target python3 scripts/analysis/report-reconstruction-status.py \ --category library --state missing-size --sort addressThe current first-lane result is seven rows. If that count changes, trust the command and current ledgers rather than copying an old prose list.
-
Select one coherent runtime/D3DX family. Reconcile every start and extent against target control flow before editing
mapping.csv; imported Ghidra boundaries and the next CSV address are leads, not accepted sizes.
Evidence gates
- Identify the exact originating toolchain/library version and archive member. Record SHA-256 for each archive used as evidence. A same-name TH07 archive or a modern SDK library is not a substitute.
- Keep target facts, archive/member facts, inferred symbol names, and unknown boundaries distinct.
- Compare code only after replaying COFF relocations and accounting for archive member padding, COMDATs, jump tables, thunks, and linker-owned transformations.
- Prefer compiler/library source or extracted COFF evidence. Never recreate CRT or D3DX bodies with inline assembly, byte arrays, empty stubs, or copied target bytes.
Ledger boundary
No library exact ledger exists yet. config/implemented.csv,
config/matches.csv, and docs/PROGRESS.md currently describe authored work;
do not repurpose them for library percentages.
Before the first library acceptance, propose and review:
- an archive-provenance manifest with hashes and member identities;
- a library match-unit schema with target address, accepted extent, object or archive member, relocation replay, and evidence command;
- validation that works without private target bytes in public CI and a local target-required acceptance command;
- a separate library progress view that does not change authored totals.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 75 lines · 62 tokens per session scan A 481dfcf22f7d
th08-library is a skill published in the GitHub repository N0zoM1z0/th08 (159 stars, last pushed 3d ago), licensed MIT. It adds 62 tokens to every session and 751 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
idapython
IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida modules (50+), idautils iterators, and common…
analyzing-android-dex-malware
Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable Java, auditing the manifest for abused permissions and components, and locating dynamically loaded or native payloads. Activates for requests to analyze an APK, decompile DEX, or investigate a suspicious Android app.
analyzing-dotnet-malware-internals
Reverses .NET/managed malware: decompiling MSIL back to C#, defeating common .NET protectors and string encryptors, and tracing reflection-based loaders to recover the real payload. Activates for requests to analyze a .NET sample, decompile MSIL, or unpack a managed loader.
analyzing-java-jar-malware
Analyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) by inventorying the archive, reading the manifest entry point, detecting obfuscators and string encryption, and flagging suspicious runtime, reflection, and networking class usage. Activates for requests to analyze a malicious JAR, inspect Java…
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
scripting-ida-with-idapython
Automates IDA Pro analysis with IDAPython by generating scripts that enumerate functions, decode strings, rename by signature, and export analysis results, and by documenting the headless idat batch invocation. Activates for requests to script IDA Pro, write IDAPython automation, or run IDA in batch/headless mode.