Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add xAmirHamza77/ReverseOps-Skill --skill competition-firmware-layoutgit clone --depth 1 https://github.com/xAmirHamza77/ReverseOps-SkillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xamirhamza77/reverseops-skill/competition-firmware-layout)<a href="https://agentmods.dev/skills/xamirhamza77/reverseops-skill/competition-firmware-layout"><img src="https://agentmods.dev/badge/skills/xamirhamza77/reverseops-skill/competition-firmware-layout/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xamirhamza77/reverseops-skill/competition-firmware-layout"><img src="https://agentmods.dev/badge/skills/xamirhamza77/reverseops-skill/competition-firmware-layout.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00110 | $0.00647 |
| Opus 5.5 | $0.00044 | $0.00259 |
| Sonnet 5.5 | $0.00022 | $0.00129 |
| Haiku 4.5 | $0.00011 | $0.00065 |
Grade A, and why
competition-firmware-layout scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
98% identical to competition-firmware-layout — 2 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Competition Firmware Layout
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the hard part is understanding how a firmware image is structured, booted, updated, and turned into reachable device behavior.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Preserve the original image, extracted partitions, unpacked filesystems, and patched copies as separate artifacts.
- Map outer container, partition table, bootloader, kernel, rootfs, config, and update metadata before editing anything.
- Track the boot or update chain in order instead of jumping straight to the most interesting file.
- Record keys, signatures, offsets, partition boundaries, and init entrypoints in one compact evidence chain.
- Reproduce the decisive secret, branch, or reachable service from the smallest extracted path.
Workflow
1. Establish Image Layout
- Identify container type, partition headers, compression, filesystem type, and any appended or nested images.
- Record offsets, sizes, hashes, mount points, and partition names before extraction mutates anything.
- Separate bootloader, kernel, initramfs, rootfs, config blobs, and update metadata as different layers.
2. Trace Boot Or Update Flow
- Map how control moves from bootloader to kernel to init to services, or from update package to verifier to installer.
- Note which credentials, certificates, passwords, seeds, or config files are consumed at each stage.
- Distinguish checked-in firmware intent from the live behavior the extracted files actually support.
3. Reduce To The Decisive Path
- Show the smallest chain from image boundary to service exposure, auth bypass, debug interface, credential recovery, or flag artifact.
- Keep extracted filesystems, derived configs, and patch experiments separate from pristine inputs.
- If the challenge becomes mostly about native crash behavior or exploit primitives after extraction, switch back to the broader ReverseOps.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 51 lines · 110 tokens per session scan A 56ac28e17bc7
competition-firmware-layout is a skill published in the GitHub repository xAmirHamza77/ReverseOps-Skill (5 stars, last pushed 2mo ago), licensed MIT. It adds 110 tokens to every session and 647 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 98% identical to competition-firmware-layout, differing in 2 lines, and is treated as a copy.
Other skills, from other repositories
building-mcp-servers
Use this skill whenever the user wants to design, build, harden, review, or debug an MCP (Model Context Protocol) server — including "build me an MCP server for X", connecting an AI agent/Claude to a database or API, adding tools/resources to an existing MCP server, reviewing a contributor PR against an MCP server, or…
lab-hardware-cad
Designs custom laboratory hardware as parametric build123d models and exports fabrication artifacts as STEP, STL, and DXF files - microfluidic chips and molds, optomechanical mounts and breadboard adapters, cuvette and microplate holders, tube racks, animal-behavior rigs, and 3D-printed instrument fixtures. Use when a…
pylabrobot
Develops and reviews PyLabRobot lab-automation resources, liquid-handling plans, offline simulations, and supported-device integrations. Supports PyLabRobot protocols and API questions; keep physical execution behind an explicit operator safety gate.
offensive-wifi
Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons…
offensive-iot
IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential…
offensive-bluetooth-classic
Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive…