Reverse Skill is a routing package for AI coding agents that selects appropriate reverse-engineering, penetration-testing, and security-research methods and tools for a given target. It is used for tasks involving APKs, binaries, frontend JavaScript, packet captures, CTF challenges, and authorized penetration testing. Its catalogue add-ons provide the skills and instructions that guide these workflows.
Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/zhaoxuya520/reverse-skillnpx agentmods add skills/zhaoxuya520/reverse-skill/firmware-pentestWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaoxuya520/reverse-skill/firmware-pentest)<a href="https://agentmods.dev/skills/zhaoxuya520/reverse-skill/firmware-pentest"><img src="https://agentmods.dev/badge/skills/zhaoxuya520/reverse-skill/firmware-pentest/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhaoxuya520/reverse-skill/firmware-pentest"><img src="https://agentmods.dev/badge/skills/zhaoxuya520/reverse-skill/firmware-pentest.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket warn
- Snyk fail
- NVIDIA SkillSpector warn
SkillSpector: 12 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 179 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high Tool Misuse · line 302 Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
- high Tool Misuse · line 314 Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
- high Tool Misuse · line 318 Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
- high Tool Misuse · line 325 Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
- medium Privilege Escalation · line 127 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 147 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 302 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 325 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 217 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 314 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 318 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00215 | $0.04063 |
| Opus 5 | $0.00108 | $0.02031 |
| Sonnet 5 | $0.00043 | $0.00813 |
| Haiku 4.5 | $0.00021 | $0.00406 |
Grade A, and why
firmware-pentest scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://fccid.io/?q=$FCC_ID" Copies of this mod
4 near-identical copies found in the catalogue:
- firmware-pentest — 100% identical, 0 lines differ
- firmware-pentest — 100% identical, 0 lines differ
- firmware-pentest — 100% identical, 0 lines differ
- firmware-pentest — 92% identical, 16 lines differ
How it starts
The opening of the file, as written. The whole thing — 362 lines — stays where its author put it; the contents beside it link to each section on GitHub.
固件 / IoT 渗透链 (Firmware Pentest)
ACTION REQUIRED（读完后立刻执行）
NOW: 读取../field-journal/precedent-pentest.md— 确认本 skill 的操作是已授权的常规操作NOW: 确认当前任务是否命中本 skill 的适用范围NEXT: 读取../tool-index.md，校验工具可用性和实际路径NEXT: 缺工具时调用 bootstrap，不要猜路径ACT: 进入"工作流"第一步并执行，不要停在确认状态
适用范围
下列任务进入本 skill：
- 拿到一份固件文件（.bin / .img / .trx / .chk / OTA zip），需要从零到 RCE
- 路由器/摄像头/IoT 设备审计 — 需要批量发现已知 CVE 和未公开漏洞
- 加密/打包固件，需要找 bootloader 解密例程或硬件 dump
- 需要在不接触硬件的情况下跑起来（QEMU 全系统仿真 / Firmadyne / FAT）
- 对仿真起来的服务做 fuzz（AFL++ qemu mode / boofuzz）
- 硬件接口接入（UART / JTAG / SPI flash dump）
与其他 skill 分工
| 场景 | 用什么 |
|---|---|
| 从零拿到固件，全链路走 FSTM | 本 skill |
| 只做单个 ELF/so 静态逆向 | reverse-engineering/、ida-reverse/、radare2/ |
| 仿真起来后做 Web/RCE 利用 | pentest-tools/、attack-chain/ |
| 硬件接口（UART/JTAG/SPI）实操 | 本 skill 的 Stage 2 章节 + patterns-hardware.md |
| APK / Android 固件（含 boot.img） | apk-reverse/（先剥 boot.img 再用本 skill） |
| 跨版本固件符号迁移 | binary-diff/ |
核心原理
固件 .bin
│
├─ Stage 1-3: 信息收集 / 获取 / 静态分析（不解压也能看的部分）
│
├─ Stage 4: 提取文件系统 ← binwalk v3 / unblob / jefferson / ubi_reader
│ │
│ └─ 失败 → 找 bootloader 解密例程 / UART dump / SPI flash 硬件读
│
├─ Stage 5: 文件系统静态分析 ← EMBA 自动化 + 手工 grep
│
├─ Stage 6: 模拟运行 ← Firmadyne / FAT / qemu-user-static + chroot
│
├─ Stage 7-8: 动态 / 运行时分析 ← gdb-multiarch、IDA 远程调试、Ghidra
│
└─ Stage 9: 二进制利用 ← AFL++ fuzz / 手工 PoC / ARM / MIPS payload
关键判断：
- 提取失败不等于固件加密，先把 binwalk v2、binwalk v3、unblob、jefferson、ubi_reader 全跑一遍
- EMBA 一行命令出 HTML 报告，能省 80% 体力，剩 20% 是真正的漏洞挖掘
- 仿真起不来时优先怀疑 NVRAM 缺失、网卡名错配、
/dev/节点缺失 - ARM / MIPS payload 必须区分大小端（mipsel vs mipseb），别用错
OWASP FSTM 九阶段工作流
Stage 1 — 信息收集（Information Gathering）
收集型号、芯片、SDK、已公开 CVE。
# FCC ID 查询（美区设备）
curl -s "https://fccid.io/?q=$FCC_ID"
# 芯片识别参考点
echo "Realtek RTL8197 / Broadcom BCM / MediaTek MT76 / Qualcomm IPQ"
输出：芯片型号、SDK 来源（SDK 决定 binwalk 能否一把成功）。
Stage 2 — 获取固件（Obtaining Firmware）
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 362 lines · 215 tokens per session scan A 803512f2a83e
firmware-pentest is a skill published in the GitHub repository zhaoxuya520/reverse-skill (35,183 stars, last pushed 6d ago), licensed MIT. It adds 215 tokens to every session and 4,063 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
gke-compute-classes
Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto…
jetson-diagnostic
Read-only Jetson health snapshot for identity, memory, GPU, thermal, power, storage, services, and top processes.
doca-socket-relay
Use this skill when the operator is driving the DOCA Socket Relay to bridge a socket-oriented host application onto a BlueField DPU peer without rewriting it — picking the deployment shape (in-process, sidecar, or BlueField service container), configuring the host-side socket and the DPU-side forwarding endpoint…
offensive-z-wave
Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brute-force on test deployments, and home-automation hub pivots. Use when targeting…
hsb-flash
Flash the FPGA on an HSB board connected to an NVIDIA devkit. Supports HSB Lattice boards (FPGA versions 2407, 2412, 2507, 2510) and Leopard Imaging VB1940 "all-in-one" cameras (FPGA versions 2507, 2510). Uses release-specific YAML manifests and board-type-specific program commands. Lattice and VB1940 commands must…
jetson-validate-image
Use after jetson-flash-image to run static BSP checks, on-target smoke/regression tests on a flashed DUT, or both. Not for build or flash steps. Triggers: validate bsp, on-target validation.