Leanrea

Before you start: read this whole install prompt, tell me in a few lines what this skill does and what installing it involves, and wait for my go-ahead before you do anything else. Prerequisites: none for the install itself: no account, no API key, no paid service, and nothing else to install first. For using the skill afterwards you need local command line tools; many come with the platform (on macOS the Xcode Command Line Tools provide otool, nm and strings; on Linux, binutils provides readelf, objdump and nm), and SKILL.md ends with an optional tool list to install only on request. The playbook is written macOS-first (Mach-O, Electron, APFS copies) and also covers ELF and PE binaries, Go, Rust and .NET, Android APKs, WASM, SQLite, plists, pcap and HAR captures, firmware and websites. Install "leanrea" for me. It is a reverse-engineering playbook: a single SKILL.md that tells you the fastest local command for each kind of shipped software, the traps to avoid, and how to answer from evidence, marking every claim as seen, inferred or unknown. Repository: https://github.com/aicodeking/leanrea (the skill is the whole leanrea/ folder at the pinned commit: SKILL.md only) Pinned version: install the code at commit 09ba4aa0217f82cd880f855a60b877f59f39b22b exactly. Do not substitute a newer version. If this commit is unreachable, stop and tell me. 1. Clone https://github.com/aicodeking/leanrea into a temporary folder, check out commit 09ba4aa0217f82cd880f855a60b877f59f39b22b, and copy the leanrea/ folder from that checkout. Then compare every file in the folder with the fingerprints recorded for this listing on 2026-10-19: [FINGERPRINTS] - SKILL.md: SHA-256 53581bd7fb1fae4352ab43252e67b84667b68895a68e372b99d302b58d9c782d If a file does not match, it changed since the listing was prepared: do not install it yet, tell me what you found and let me decide. 2. Read SKILL.md in full and tell me in plain words: what the skill does when used, which services it connects to, whether it reads or sends any personal information or keys, and anything that seems unusual. Stop on any red flag and tell me before going further. Confirm these points from the files: - The skill folder holds one file only: SKILL.md (8,374 bytes). There is no code, no script and no dependency list in the folder: the skill is a playbook of local commands (file, otool, nm, strings, readelf, objdump, rg, jq, sqlite3, tshark and friends) plus routing rules per target type and speed patterns. - Nothing is sent anywhere during installation itself; the only download at install time is the skill folder from GitHub at the pinned commit. The file names no account, no API key, no telemetry and no remote service. - At use time, everything runs locally on targets I point you at: the skill says to work on a copy (extractions under $TMPDIR/re/), to inventory first (strings and imports before any disassembly), to slice big or minified files instead of reading them whole, and to mark each claim in the answer as seen (with the file and offset), inferred, or unknown. Two use-time network touches, both only on targets I name: the website route fetches the page and its scripts with curl -sL (or a headless browser with a network log), and the Electron and bundle routes use npx -y (@electron/asar, @electron/fuses, prettier), which downloads those packages from npm on first use. Runtime rows suggest lldb, frida or adb only against my own running apps and devices. - SKILL.md ends with an "Install (only on request)" line listing optional extra tools (brew install jadx apktool radare2 binwalk wabt wireshark ghidra, npm i -g @electron/asar, dotnet tool install -g ilspycmd, cargo install cargo-audit). Do not install any of them during this install: they are my decision, later, if I ever ask. - The scope is analysis of shipped software: explaining how a feature works, extracting versions and dependencies, comparing builds, or rebuilding a feature. The bench/ folder of the repository is the author's benchmark harness, not part of the skill, and is not installed. 3. When I say "yes, install", install it as a skill: copy the whole leanrea folder into the agent's skills directory, in a folder named "leanrea", keeping its file (SKILL.md). The upstream routes, npx skills add aicodeking/leanrea or a manual clone followed by copying the leanrea folder into ~/.claude/skills/, install the same single file; either route is fine as long as the file matches the fingerprint. 4. Verify with no network calls: frontmatter valid, file in place. 5. Report what was installed, where, and what I still need to do myself (for example: install the optional reverse-engineering tools myself, only if and when I want them, and provide any analysis target myself; using the skill is a separate step that only starts when I ask for it, and the use-time downloads disclosed above happen only then, on targets I name). GitHub is optional: if I have a GitHub account or the gh CLI, you may use it; otherwise public access is fine. Never require it unless it's in the prerequisites above. Rules: don't touch anything outside the temp folder and the install target. If anything looks off, stop and ask me.