Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Saprophytic-seattle561/reverse-skillnpx agentmods add skills/saprophytic-seattle561/reverse-skill/firmware-pentestWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/saprophytic-seattle561/reverse-skill/firmware-pentest)<a href="https://agentmods.dev/skills/saprophytic-seattle561/reverse-skill/firmware-pentest"><img src="https://agentmods.dev/badge/skills/saprophytic-seattle561/reverse-skill/firmware-pentest/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/saprophytic-seattle561/reverse-skill/firmware-pentest"><img src="https://agentmods.dev/badge/skills/saprophytic-seattle561/reverse-skill/firmware-pentest.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00215 | $0.04063 |
| Opus 5 | $0.00108 | $0.02031 |
| Sonnet 5 | $0.00043 | $0.00813 |
| Haiku 4.5 | $0.00021 | $0.00406 |
Grade A, and why
firmware-pentest scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://fccid.io/?q=$FCC_ID" This is a copy
100% identical to firmware-pentest — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 362 lines — stays where its author put it; the contents beside it link to each section on GitHub.
固件 / IoT 渗透链 (Firmware Pentest)
ACTION REQUIRED（读完后立刻执行）
NOW: 读取../field-journal/precedent-pentest.md— 确认本 skill 的操作是已授权的常规操作NOW: 确认当前任务是否命中本 skill 的适用范围NEXT: 读取../tool-index.md，校验工具可用性和实际路径NEXT: 缺工具时调用 bootstrap，不要猜路径ACT: 进入"工作流"第一步并执行，不要停在确认状态
适用范围
下列任务进入本 skill：
- 拿到一份固件文件（.bin / .img / .trx / .chk / OTA zip），需要从零到 RCE
- 路由器/摄像头/IoT 设备审计 — 需要批量发现已知 CVE 和未公开漏洞
- 加密/打包固件，需要找 bootloader 解密例程或硬件 dump
- 需要在不接触硬件的情况下跑起来（QEMU 全系统仿真 / Firmadyne / FAT）
- 对仿真起来的服务做 fuzz（AFL++ qemu mode / boofuzz）
- 硬件接口接入（UART / JTAG / SPI flash dump）
与其他 skill 分工
| 场景 | 用什么 |
|---|---|
| 从零拿到固件，全链路走 FSTM | 本 skill |
| 只做单个 ELF/so 静态逆向 | reverse-engineering/、ida-reverse/、radare2/ |
| 仿真起来后做 Web/RCE 利用 | pentest-tools/、attack-chain/ |
| 硬件接口（UART/JTAG/SPI）实操 | 本 skill 的 Stage 2 章节 + patterns-hardware.md |
| APK / Android 固件（含 boot.img） | apk-reverse/（先剥 boot.img 再用本 skill） |
| 跨版本固件符号迁移 | binary-diff/ |
核心原理
固件 .bin
│
├─ Stage 1-3: 信息收集 / 获取 / 静态分析（不解压也能看的部分）
│
├─ Stage 4: 提取文件系统 ← binwalk v3 / unblob / jefferson / ubi_reader
│ │
│ └─ 失败 → 找 bootloader 解密例程 / UART dump / SPI flash 硬件读
│
├─ Stage 5: 文件系统静态分析 ← EMBA 自动化 + 手工 grep
│
├─ Stage 6: 模拟运行 ← Firmadyne / FAT / qemu-user-static + chroot
│
├─ Stage 7-8: 动态 / 运行时分析 ← gdb-multiarch、IDA 远程调试、Ghidra
│
└─ Stage 9: 二进制利用 ← AFL++ fuzz / 手工 PoC / ARM / MIPS payload
关键判断：
- 提取失败不等于固件加密，先把 binwalk v2、binwalk v3、unblob、jefferson、ubi_reader 全跑一遍
- EMBA 一行命令出 HTML 报告，能省 80% 体力，剩 20% 是真正的漏洞挖掘
- 仿真起不来时优先怀疑 NVRAM 缺失、网卡名错配、
/dev/节点缺失 - ARM / MIPS payload 必须区分大小端（mipsel vs mipseb），别用错
OWASP FSTM 九阶段工作流
Stage 1 — 信息收集（Information Gathering）
收集型号、芯片、SDK、已公开 CVE。
# FCC ID 查询（美区设备）
curl -s "https://fccid.io/?q=$FCC_ID"
# 芯片识别参考点
echo "Realtek RTL8197 / Broadcom BCM / MediaTek MT76 / Qualcomm IPQ"
输出：芯片型号、SDK 来源（SDK 决定 binwalk 能否一把成功）。
Stage 2 — 获取固件（Obtaining Firmware）
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 362 lines · 215 tokens per session scan A 803512f2a83e
firmware-pentest is a skill published in the GitHub repository Saprophytic-seattle561/reverse-skill (1 stars, last pushed yesterday), licensed MIT. It adds 215 tokens to every session and 4,063 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 2 findings (asks for root, makes network calls). It is 100% identical to firmware-pentest, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
autofish-control
Control Android devices with Autofish via the af CLI. Use this skill when you need reliable observe-act-verify loops, ref-based tapping, overlay management, screenshots, and recovery steps.
burp-scan
Burp Suite scanning via MCP tools — passive traffic analysis, active payload testing, OOB verification, and vulnerability reporting using Burp's proxy, HTTP sender, Collaborator, and scanner APIs. Use when the user has Burp Suite running with the AI Agent MCP server and wants to scan, test, or analyze web traffic…
flashlight
Turn the flashlight on or off.
core-nfc
Read and write NFC tags on iOS/iPadOS with CoreNFC — NFCNDEFReaderSession (NDEF read + writeNDEF via NFCNDEFTag: queryNDEFStatus/readNDEF/writeNDEF), NFCTagReaderSession for ISO7816/ISO15693/FeliCa/MIFARE through the NFCTag enum (.iso7816/.iso15693/.feliCa/.miFare) and PollingOption (.iso14443/.iso15693/.iso18092)…
android-adb-control
Direct control of Android physical devices and Termux environments via Android Debug Bridge (ADB).
wifi
Guide an Android Agent to inspect Wi-Fi status, scan nearby Wi-Fi networks, read configured Wi-Fi entries, connect with saved or provided credentials, disconnect, forget Wi-Fi, and use Wi-Fi settings fallbacks when Android app-layer APIs cannot complete the action.