Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/SeaOf0/dsh-redteam-modelnpx agentmods add skills/seaof0/dsh-redteam-model/dumpapkpackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seaof0/dsh-redteam-model/dumpapkpack)<a href="https://agentmods.dev/skills/seaof0/dsh-redteam-model/dumpapkpack"><img src="https://agentmods.dev/badge/skills/seaof0/dsh-redteam-model/dumpapkpack.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00153 | $0.05464 |
| Opus 5 | $0.00077 | $0.02732 |
| Sonnet 5 | $0.00031 | $0.01093 |
| Haiku 4.5 | $0.00015 | $0.00546 |
Grade A, and why
dumpapkpack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 448 lines — stays where its author put it; the contents beside it link to each section on GitHub.
APK Packer Unpacker (dumpapkpack)
本 skill 是一个脱壳方案路由器：识别壳类型 → 探测环境 → 评估壳防御能力 → 选择策略 → 执行脱壳。
工作流程
输入 APK
│
▼
[1] 壳识别 (解包 + 特征指纹匹配)
│
▼
[2] 环境探测 (adb / root / 模拟器 / 标准Frida / 隐蔽注入 / BlackDex)
│
▼
[3] 壳防御评估 (反Frida能力 / 反调试能力 / 签名校验强度)
│
▼
[4] 策略路由 (壳类型 × 环境能力 × 壳防御能力 → 最优方案)
│
▼
[5] 执行脱壳 (引用 packer-*.md 中的具体方案)
│
▼
[6] 验证产物 (DEX magic + endian tag + class 数量)
│
▼
[7] 反编译输出 (jadx → src/)
1. 壳识别
解包 APK，检查特征指纹：
识别特征表
| 特征文件 / 特征 | 壳类型 | 详情文件 |
|---|---|---|
assets/libjgcrqc*.so 存在 |
360加固保 | packer-360jiagu.md |
DEX 头部 magic qh\x00\x01 |
360加固保 VIP | packer-360jiagu.md |
AndroidManifest Application 为 com.stub.StubApp 或反包名路径 |
360加固保 | packer-360jiagu.md |
assets/ijiami.dat 存在 |
爱加密 V3+ | packer-ijiami.md |
assets/ijm_lib/*/libexec.so + libexecmain.so |
爱加密 V3+ | packer-ijiami.md |
com.ijm.dataencryption.DETool 在 classes.dex 中 |
爱加密 V3+ | packer-ijiami.md |
s.h.e.l.l.A 壳入口类 |
爱加密 V3+ | packer-ijiami.md |
assets/libijiami*.so |
爱加密 (旧版) | packer-ijiami.md |
lib/jiagu/*.so 或 assets/libjiagu*.so |
梆梆加固 | packer-bangcle.md (待添加) |
lib/libshell-super.*.so |
腾讯乐固 | packer-legu.md (待添加) |
assets/libtprt.so |
网易易盾 | packer-yidun.md (待添加) |
assets/libsecmain.so |
腾讯御安全 | packer-tencent.md (待添加) |
assets/libkwscmm.so |
几维安全 | packer-kiwisec.md (待添加) |
assets/libsgmain.so |
阿里聚安全 | packer-ali.md (待添加) |
| 无明显壳特征 | 可能无壳或未知壳 | 按无壳处理 |
识别步骤
# 解包
unzip -o <input.apk> -d /tmp/apk_check > /dev/null 2>&1
# 检查特征文件
find /tmp/apk_check/assets/ -name "*.so" -o -name "*.dat" -o -name "*.jar" | head -20
find /tmp/apk_check/lib/ -name "*.so" | head -20
# 检查 DEX 头部
xxd -l 8 /tmp/apk_check/classes.dex
# 检查壳入口类
strings /tmp/apk_check/classes.dex | grep -iE "stub|shell|jiagu|ijiami|ijm|bangcle|secneo|dataencryption"
# 检查 AndroidManifest Application 类（需 apktool 或 aapt 解码二进制 XML）
strings /tmp/apk_check/AndroidManifest.xml | head -60
# 动态识别（安装后）
adb shell dumpsys package <pkg> | grep -E "primaryCpuAbi|versionName"
adb shell "su -c 'ls /data/app/*/<pkg>*/'"
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 448 lines · 153 tokens per session scan A 5ca23c7934a1
dumpapkpack is a skill published in the GitHub repository SeaOf0/dsh-redteam-model (293 stars, last pushed 3d ago), licensed MIT. It adds 153 tokens to every session and 5,464 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
figma-swiftui
SwiftUI ↔ Figma translation. Use whenever the user mentions Swift, SwiftUI, iOS, iPhone, or iPad — in EITHER direction — translating a Figma design into SwiftUI (design → code), or pushing SwiftUI views / screens / tokens back into a Figma file (code → design). Triggers on phrases like 'implement this Figma design in…
dart-flutter-patterns
Production-ready Dart and Flutter patterns covering null safety, immutable state, async composition, widget architecture, popular state management frameworks (BLoC, Riverpod, Provider), GoRouter navigation, Dio networking, Freezed code generation, and clean architecture. Use when writing or reviewing Dart and Flutter…
liquid-glass-design
Patterns for implementing Apple's Liquid Glass — a dynamic material that blurs content behind it, reflects color and light from surrounding content, and reacts to touch and pointer interactions. Covers SwiftUI, UIKit, and WidgetKit integration.
foundation-models-on-device
Apple FoundationModels framework for on-device LLM — text generation, guided generation with @Generable, tool calling, and snapshot streaming in iOS 26+. Use when adding on-device LLM features with Apple FoundationModels on iOS 26+.
android-clean-architecture
Clean Architecture patterns for Android and Kotlin Multiplatform projects — module structure, dependency rules, UseCases, Repositories, and data layer patterns. Use when structuring modules, layers, or data flow in an Android or KMP project.
flutter-dart-code-review
Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture. Use when reviewing Flutter or Dart code, whatever state management library the…