Reverse Engineer Anything

Before you start: read this whole install prompt, tell me in a few lines what this skill does and what installing it involves, and wait for my go-ahead before you do anything else. Prerequisites — Reinforced framing — reverse-engineering subject matter, read this first: this skill teaches an agent to investigate shipped software artifacts (native binaries, managed assemblies, Electron/JavaScript packages, firmware, browser targets) that you own or are authorized to examine; the upstream project's own DISCLAIMER.md limits it to lawful analysis (security research, malware and incident analysis, interoperability, debugging your own software) and refuses DRM/license-check circumvention, game cheats, and bypassing access controls on systems you are not authorized to test. Installing this listing only copies the folder: no MCP server is registered, no analysis engine is installed, and no client configuration is written during installation. At use time only, and only if you choose to connect it, the skill works through an `rea-agents` MCP server launched with `npx -y rea-agents@latest` (npx downloads that package from npm and writes to the npm cache), and it drives external bring-your-own analysis engines you supply yourself (for example Ghidra or Hopper for native code, a JADX MCP JAR 0.7.1 plus Java 17+ for Android, Binwalk/Unblob for firmware, TShark/Wireshark, WABT, sigrok, Wakaru, pwntools — REA setup never installs or upgrades Node.js, Java, Ghidra, IDA, JADX or any of these). Before any configuration repair, the skill requires a read-only dry-run plan showing the exact paths, backups and changes, and your approval before setup writes configuration or installs Hopper. No account or payment is needed to copy the folder. Install "Reverse Engineer Anything" for me. It is the main REA (Reverse Engineer Anything) skill: a router and working method for investigating shipped artifacts — native binaries, managed PE/CLI assemblies, Electron and JavaScript/ASAR applications, packaged apps, firmware images, and browser or Electron targets already open — through the REA MCP tools, working summary-first, citing artifact Evidence for every claim, and separating observations, inferences and unknowns. It routes each target type to the right tool (binary opening, Android package inspection, firmware regions, packet and signal captures, WASM, model files, IL2CPP metadata and many built-in inspectors), explains how to connect and recover when the MCP server or a provider is missing, and states its own guardrails: installing the skill supplies instructions only, setup starts from a read-only dry-run plan and needs approval before it writes configuration or installs Hopper, and REA setup never installs unrelated software. Its folder holds the main SKILL.md plus six reference guides (connection and recovery, native and artifacts, JavaScript applications, Android applications, runtime observation, evidence workflows) that are read only when the target needs them. Repository: https://github.com/morluto/rea (the skill is the whole .agents/skills/reverse-engineer-anything/ folder at the pinned commit: SKILL.md plus 6 reference files, 7 files in total) Pinned version: install the code at commit 6dc0f60faa0928e20b2395ba1a93ff8e497143f7 exactly. Do not substitute a newer version. If this commit is unreachable, stop and tell me. 1. Clone https://github.com/morluto/rea into a temporary folder, check out commit 6dc0f60faa0928e20b2395ba1a93ff8e497143f7, and copy the .agents/skills/reverse-engineer-anything/ folder from that checkout. Then compare every file in the folder with the fingerprints recorded for this listing on 2026-10-22: [FINGERPRINTS] - SKILL.md: SHA-256 e0c692482522f43404e40b0ca64b2df84a23a24cb9cedd09fb8a1b7932ff5b78 - references/android-applications.md: SHA-256 ae78da20a572e92a1d5fac3f9fdf10caa7ed09fe0b6c9132b4e878470c28f9c0 - references/connection-and-recovery.md: SHA-256 f7cde6dde3638fa39278464414133dd6b14e56ddcf3799c665fdb503b15f11ef - references/evidence-workflows.md: SHA-256 229da00674c160b45d0618d2d0fc03a85a23552f34a54866735f6f733d2d8f40 - references/javascript-applications.md: SHA-256 9003206fb2bb70d0db65c6cb49d3e62b7a4e46d8697100b683d11e9a4e9b0dbd - references/native-and-artifacts.md: SHA-256 8b9eb84712a578b188eda944e3bac304fe3df394d39f6e7a824a79dc34b28e35 - references/runtime-observation.md: SHA-256 da6728e31648a47444d3282fdb3fd17eaab38c0715ac987b6d410c0473ec8036 If a file does not match, it changed since the listing was prepared: do not install it yet, tell me what you found and let me decide. 2. Read SKILL.md in full, and tell me in plain words: what the skill does when used, what it connects to, whether it reads or sends any personal information or credentials, and anything that seems unusual. Stop on any red flag and tell me before going further. Confirm these points from the files: - The folder holds 7 files: the main SKILL.md (30,929 bytes, frontmatter name reverse-engineer-anything, metadata version "45") and 6 Markdown reference guides under references/ (android-applications, connection-and-recovery, evidence-workflows, javascript-applications, native-and-artifacts, runtime-observation). There is no executable code in the folder; it is instructions and guides only. - Nothing is sent anywhere and nothing is installed during installation itself; the only download at install time is the skill folder from GitHub at the pinned commit. No MCP server is registered, no engine is installed, and no client configuration is written by this install. - At use time the sends and executions belong to the separate REA connection step, not to this install: `npx -y rea-agents@latest` downloads the rea-agents package from npm, diagnosis and setup commands run locally, setup writes client configuration only after a read-only dry-run plan and approval, and analysis runs against artifacts I supply, with passive browser captures that omit credential header values and storage values. None of that happens during this installation. - Do not run `rea doctor`, do not run any setup (dry-run or otherwise), do not register any MCP server, do not install Hopper or any engine, and do not analyze any artifact during this install: connecting REA and using the skill are separate steps that only start when I ask for them later. 3. When I say "yes, install", install it as a skill: copy the whole reverse-engineer-anything folder into the agent's skills directory, in a folder named exactly "reverse-engineer-anything", keeping its 7 files in their original relative layout (SKILL.md at its root). 4. Verify with no network calls: frontmatter valid (name: reverse-engineer-anything), the 7 files in place with matching fingerprints. Do not run anything from the folder and do not use the skill to verify. 5. Report what was installed, where, and what I still need to do myself (for example: that using it is a separate step: the skill alone registers no MCP server and installs no engine, connecting REA means running the npx rea-agents server and, for most target types, supplying my own analysis engines (such as Ghidra/Hopper, JADX plus Java for Android), that any setup first shows a read-only dry-run plan and needs my approval before writing configuration, and that REA is for artifacts I own or am authorized to examine, under the limits in the project's DISCLAIMER.md). GitHub is optional: if I have a GitHub account or the gh CLI, you may use it; otherwise public access is fine. Never require it unless it's in the prerequisites above. Rules: don't touch anything outside the temp folder and the install target. If anything looks off, stop and ask me.