Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SeaOf0/dsh-redteam-model --skill re-playbookgit clone --depth 1 https://github.com/SeaOf0/dsh-redteam-modelWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seaof0/dsh-redteam-model/re-playbook)<a href="https://agentmods.dev/skills/seaof0/dsh-redteam-model/re-playbook"><img src="https://agentmods.dev/badge/skills/seaof0/dsh-redteam-model/re-playbook/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/seaof0/dsh-redteam-model/re-playbook"><img src="https://agentmods.dev/badge/skills/seaof0/dsh-redteam-model/re-playbook.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 421 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00381 | $0.15348 |
| Opus 5 | $0.00191 | $0.07674 |
| Sonnet 5 | $0.00076 | $0.03070 |
| Haiku 4.5 | $0.00038 | $0.01535 |
Grade A, and why
re-playbook scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 560 lines — stays where its author put it; the contents beside it link to each section on GitHub.
二进制分析作战手册
本技能随 binary-analysis 预设走。 persona 中的硬规则（底线、证据标准、样本纪律、对抗性样本意识、表达纪律（拒答修复由宿主插件 dsh-refusal-guard 兜底）、claude 逻辑）不在此重复。
主观念锚点
主观念 = 病毒分析 · 逆向破解 · 脱壳还原代码，围绕三者自主扩展实施： ①病毒分析——行为/IOC/家族归属（动态观察 + 静态证据，IOC 输出 YARA/Sigma 可落地）； ②逆向破解——key/算法/授权逻辑还原（字节级证据 + 算法模拟）； ③脱壳还原代码——壳识别 → 脱壳 → IAT 修复 → 还原产物验证（B1 三验硬规则）。 还原/破解结论随报告交付完整 python 复现脚本（exp/.py：解密器/unpacker/ 校验逻辑模拟，参数化样本路径，只读运行，退出码 0=复现成功），供客户手动复现。
样本登记与活体处置 SOP
- 收到样本先登记：哈希（sha256）、来源、日期、获取方式，再开始任何分析。
- 一律视为活体恶意软件：不双击、不在非分析环境执行、默认断网。
- 样本与产物（脱壳文件、dump、trace）分开存放，目录以样本哈希命名。
家族指纹快筛路由（分诊后、假设循环前）
- 结构解析员识别出家族指纹（字符串特征/节区特征/导入表组合/PDB 路径/YARA 命中）后，
先查已知再立假设：对照
refs/behavior/已知行为面清单快筛——同家族已知行为 （C2 协议/持久化点/反分析手法）逐项作为候选假设进台账（标注来源=家族已知，非本轮新证）； - 已知行为核对完的剩余面才是「新假设」产出区——防对已充分研究的家族重复逆向；
- 指纹对不上已知家族（新家族/变种）→ 全量假设循环照走，报告标注「未匹配已知家族」。
多样本批次聚类（同事件多文件时）
- 收到一批样本先聚类再分工：按 壳类型 / 家族指纹 / C2 重合度 / 导入表相似度 分组；
- 每组选代表样本（特征最全/体积最大）走全量流程（假设循环+多视角）；
- 同组其余做变体快筛：只核代表结论的关键面（C2 地址/持久化点/差异函数），差异点才深看；
- 外推纪律：快筛结论标「外推自代表样本 <sha256 前 8>」——快筛 ≠ 等价全量；差异大的 变体升级为该组新代表补全量；
- 聚类结果落盘
artifacts/<批次>/clustering.md（组/成员哈希/分组依据），随报告交付。
分析形态（静态/动态）与动态隔离铁律
形态定义：
- 静态分析（默认形态）：以脱壳还原代码为前提，只从代码层分析（结构解析/多视角交叉/ 符号执行/算法还原）——一切结论不执行样本即得出。
- 动态分析：运行时分析必须在隔离 VM 内进行——开工按「虚拟化与沙箱公约」 （ecosystem-cooperation）检测虚拟化平面（VMware/Parallels/VirtualBox/Hyper-V/WSL/ qemu-KVM/multipass/UTM 等不限于）并走三级阶梯：已有合格纯隔离沙箱直接复用 （恢复基线快照）→ 有虚拟化软件则基于已有系统克隆纯隔离沙箱（新装 OS=系统级 绝不自动装，询问用户或由用户提供环境）→ 无虚拟化则静态优先 + 覆盖度台账登记缺口 收窄结论（未知样本严禁宿主机直接运行）。沙箱就绪后 把病毒/样本/木马后门/webshell 等丢入 VM，在 VM 内开始运行时分析；frida 插桩、调试器附加等一切「让样本 执行」的动作同属动态分析，同受本节约束。
动态隔离铁律（persona 硬规则）：
- VM 与物理机完全隔离——网络 host-only 或完全断开、DNS 解析与网络服务全部虚拟化 （伪造 DNS/伪造服务，INetSim/FakeNet 类思路），禁止桥接真实局域网、禁止共享宿主 DNS、 禁止接触宿主资源；防木马/病毒/勒索逸散到本地，并谨记样本的虚拟机逃逸技术——共享 文件夹/剪贴板/拖放/3D 加速/guest tools 等攻击面全部关闭或最小化。
- 反虚拟化检测处理：样本带虚拟化检测（CPUID/硬件指纹/驱动存在性/时序差）→ 先尝试 hook 掉检测点再分析；绕不过则如实记录「样本检测到虚拟环境」，回静态路径，不硬跑。
- 一次性与可回滚：分析 VM 先打快照，分析完还原或整台丢弃；VM 内不存放任何宿主凭据 或真实数据。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 560 lines · 381 tokens per session scan A 12874f849c8d
re-playbook is a skill published in the GitHub repository SeaOf0/dsh-redteam-model (354 stars, last pushed yesterday), licensed MIT. It adds 381 tokens to every session and 15,348 once invoked, about $0.0019 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agentdebug
Use AgentDebugX for trajectory diagnosis only when the user explicitly asks to use AgentDebug, AgentDebugX, or the agentdebug skill. Do not invoke for generic debugging, diagnosis, inspection, or trajectory-review requests.
agentdebug
Use AgentDebugX only when the user explicitly asks for AgentDebug, AgentDebugX, or the agentdebug skill. Do not invoke for generic debugging or trajectory review.
github-ci-debug
Diagnose failing GitHub Actions runs from bounded run, job, and step evidence, propose a focused fix, and modify the local checkout only when the requested task includes implementation.
sentry-fix-verification
Verify a production fix by linking the changed code and release to Sentry issue state and post-release event trends without resolving issues prematurely.
sentry-issue-investigation
Investigate a Sentry issue from bounded event, stack, tag, environment, release, and timeline evidence before proposing a code change.
sentry-regression-monitoring
Compare bounded Sentry windows and releases to identify new issues, regressions, frequency changes, and user-impact changes.