Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add skillmds/skillmd --skill dotnet-reversegit clone --depth 1 https://github.com/skillmds/skillmdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/skillmds/skillmd/dotnet-reverse)<a href="https://agentmods.dev/skills/skillmds/skillmd/dotnet-reverse"><img src="https://agentmods.dev/badge/skills/skillmds/skillmd/dotnet-reverse/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/skillmds/skillmd/dotnet-reverse"><img src="https://agentmods.dev/badge/skills/skillmds/skillmd/dotnet-reverse.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00144 | $0.02981 |
| Opus 5.5 | $0.00058 | $0.01192 |
| Sonnet 5 | $0.00029 | $0.00596 |
| Haiku 4.5 | $0.00014 | $0.00298 |
Grade A, and why
dotnet-reverse scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to dotnet-reverse — 1 line differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 194 lines — stays where its author put it; the contents beside it link to each section on GitHub.
.NET / C# 逆向作业规范
ACTION REQUIRED（读完立刻执行）
NOW: 用 DIE/file/CLR 头确认目标是 .NET 托管（否则 SWITCH 到ida-reverse//reverse-engineering/）NOW: 若疑似混淆 → 先de4dot脱壳，产出*-clean.exe，保留原始样本NEXT: dnSpyEx（或 dnSpy MCP /ilspycmd）静态：C# 浏览 + IL 视图看关键判断ACT: 需要明文/C2 时动态调试；需要改逻辑时 IL patch 优先于 C# 重编译- 阶段结束给用户 3–6 项下一步菜单（含导出报告）
适用范围
当任务属于以下场景时优先使用本 skill：
- 识别并逆向 .NET / C# 编译产物（托管 PE / .exe / .dll）
- 分析红队 Sharp* 工具链（Rubeus、SharpHound、SharpShell 等）
- 脱混淆 ConfuserEx / SmartAssembly / Babel / Eazfuscator / .NET Reactor 等壳
- 逆向 .NET loader / info-stealer / RAT 的解密与 C2 逻辑
- 对 C# 程序做 patch（改判断、改常量、keygen）
- 分析 IL2CPP 之前的 Mono/Unity 托管层（注意：IL2CPP 编译后是 native，走
reverse-engineering/+ seed-014）
如果目标是纯 native 二进制（C/C++/Go/Rust 编译、无 CLR），请改用 reverse-engineering/、ida-reverse/ 或 radare2/。
核心原则
- 先识别再下手：先确认是 .NET 托管程序（PE 头 CLR +
#~/#Strings流 + mscoree_CorExeMain），再决定走 dnSpy 而非 IDA - IL 优先于 C#：dnSpyEx 的 C# 反编译器会丢失/扭曲信息（编译器生成的状态机、async/await、yield），关键判断与 patch 必须切到 IL 编辑器，C# 视图只用于快速浏览
- de4dot 先行：遇到混淆器先
de4dot脱一轮再做静态分析，否则字符串/控制流全是乱的 - MCP 联动：环境里若注册了 dnSpy MCP（
dnspy_*工具），优先走 MCP 面做 decompile / IL inspection，避免来回切 GUI - 证据化输出：脱混淆产物、提取的配置/C2/key、patch diff 都要落盘
工具链映射
| 能力 | 首选 | 备注 |
|---|---|---|
| 反编译 + 调试 + patch | dnSpyEx | 王牌，唯一带 IL 编辑器的 GUI；老 dnSpy 已停更，用 Ex 分支 |
| 轻量 CLI / headless 反编译 | ILSpy (ilspycmd) |
适合批量、脚本化、Linux/macOS |
| 脱混淆 | de4dot | ConfuserEx 全家桶、SmartAssembly 等主流壳的默认解 |
| 混淆器识别 | Detect It Easy (DIE) / file | 先判断壳类型再决定 de4dot 参数 |
| 编程化操作 IL | dnlib | 写 C# 脚本批量改 metadata / 字符串解密器 |
| AI 直接操作 | dnSpy MCP | dnspy_decompile / dnspy_inspect_il 等工具面 |
前置：Windows 主机装 dnSpyEx + de4dot（choco 或 release）；Linux/macOS 用
ilspycmd+dotnet runtime。详见references/sharp-tools.md的安装矩阵。
六阶段工作流
1. Identify（识别 .NET）
确认目标是托管程序，别把 native PE 当 .NET 分析：
# Windows
file target.exe # "PE32 executable ... for MS Windows" 不够
# 关键：看有没有 CLR
powershell -c "[System.Reflection.AssemblyName]::GetAssemblyName('target.exe')"
# 或
dnSpyEx 直接拖进去 —— 能打开就是托管
# 通用
strings target.exe | grep -iE "mscoree|_CorExeMain|mscorlib|System\\."
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 194 lines · 144 tokens per session scan A d7e207e843fe
dotnet-reverse is a skill published in the GitHub repository skillmds/skillmd (1 stars, last pushed yesterday), licensed MIT. It adds 144 tokens to every session and 2,981 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to dotnet-reverse, differing in 1 line, and is treated as a copy.
Other skills, from other repositories
skills
Version: 1.0.0 Target: .NET 8.0+ with Blazor Server/WebAssembly UI Library: Microsoft Fluent UI Blazor Components Purpose: Fast lookup for common Blazor patterns and best practices.
dotnet-framework
Framework: .NET 8+ with ASP.NET Core For Agent: backend-developer Purpose: Fast lookup of common .NET patterns and conventions.
blazor
Use for Blazor Server development with Fluent UI Blazor, Razor components, layouts, pages, scoped UI services, culture switching, localization, forms, loading/empty/error states, and Studio-style dashboard workflows.
cli
Use for .NET command-line tool development with Spectre.Console/Spectre.Console.Cli, Microsoft.Extensions.Hosting, dependency injection, localized help text, command settings, aliases, examples, terminal output, exit codes, and stdio-safe command paths.
codegen
Use for .NET code generation work with Roslyn, Microsoft.OpenApi, Razor templates, DTO/manager/controller generation, REST API generation, C# HttpClient generation, Angular/Axios TypeScript request clients, generated formatting, and deterministic output.
dotnet
Use for .NET application development involving services, managers, dependency injection, Microsoft.Extensions.Hosting, dependency direction, MiniDb persistence, DTOs, Mapster mapping, shared entities/helpers, MCP tools, module workflows, solution analysis, cancellation, logging, and logic shared by CLI and Blazor.