Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/morluto/rea/reverse-engineer-anythingnpx skills add morluto/rea --skill reverse-engineer-anythinggit clone --depth 1 https://github.com/morluto/reaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/morluto/rea/reverse-engineer-anything)<a href="https://agentmods.dev/skills/morluto/rea/reverse-engineer-anything"><img src="https://agentmods.dev/badge/skills/morluto/rea/reverse-engineer-anything.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00061 | $0.00909 |
| Opus 5 | $0.00030 | $0.00454 |
| Sonnet 5 | $0.00012 | $0.00182 |
| Haiku 4.5 | $0.00006 | $0.00091 |
Grade A, and why
reverse-engineer-anything scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
REA
Use REA when a claim depends on a shipped binary or package, decompilation, passive application runtime evidence, controlled replay, or comparison with behavior not established by available source. For ordinary analysis of a complete source repository, use normal repository tools and do not run REA readiness or provider commands.
Route the target first
Choose the first tool from the target the user supplied. Do not call
open_binary unless the target is native or an analysis database.
- ASAR or extracted JavaScript/Electron tree:
analyze_javascript_application. - Archive, application package, ZIP/APK/IPA/MSIX/AppX, or DMG:
open_binarywith the supplied local path, theninspect_artifactorinventory_artifact(both operate on the active target and accept no path). - Managed PE/CLI assembly:
inspect_managed_artifact. - User-owned browser page already open:
list_browser_targets. - User-owned Electron runtime already open:
list_electron_targets. - Native executable, library, or analysis database:
open_binary, thenbinary_overview.
If the app is missing, ask which app to inspect. Resolve a human-readable app name to one clear installed artifact when possible; ask only when matches are ambiguous. Never choose an example app on the user's behalf.
In a target-free session, use open_binary to bind any archive/package or
native target whose analysis tool operates on the active target. Do not call a
tool hidden from tools/list; inspect binary_session with
detail: "capabilities" for the exact remediation when a desired capability
is unavailable.
Work summary-first
Start with the default summary projection. Do not repeat an identical tool call. Do not fetch full Evidence or a full application graph unless a specific claim requires detail absent from the summary. For JavaScript graphs, follow the paged resource URIs returned by the summary and fetch only the relevant page.
Every conclusion must distinguish observations, inferences, and unknowns. Cite Evidence IDs, preserve limitations and incomplete coverage, and never imply that static analysis observed execution. Ask for approval only where a tool or policy requires it; approval never broadens a different authority boundary.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 85 lines · 61 tokens per session scan A 3ac40a7e19b7
reverse-engineer-anything is a skill published in the GitHub repository morluto/rea (393 stars, last pushed 5d ago), licensed MIT. It adds 61 tokens to every session and 909 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
idapython
IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida modules (50+), idautils iterators, and common…
ghidra-cli
Use ghidra-cli for reverse engineering tasks: binary analysis, decompilation, function inspection, cross-reference analysis, pattern discovery, binary patching, and type system management. Activate when the user requests: - Binary analysis or reverse engineering - Decompilation or disassembly - Function listing…
ryuumonbuchi
Operate the Ryuumonbuchi MCP server for headless Ghidra reverse engineering. Use when driving decompilation, disassembly, patching, type and symbol recovery, memory edits, transactions, and Ghidra project analysis through a Ryuumonbuchi server (stdio or streamable HTTP). Covers the safe read-only-first workflow…
ida-pro-mcp
Use IDA Pro through the action-specific ida MCP operations.
reverse-engineering-workbench
Coordinate EVOKORE reverse-engineering work across Ghidra-style static analysis, semantic recovery, and debugger-guided triage. Use when opening an unfamiliar binary, planning a decompilation workflow, or choosing between static and dynamic analysis paths.
html-ppt-zhangzara-coral
OpenDesign's community-growth campaign across GitHub, Discord, and X: the loops, the content calendar, and the pipeline math. Built as a decision-grade marketing & GTM deck for growth team, community lead.