REA is a reverse-engineering toolkit that lets coding agents investigate how software works, from app behavior to native binaries, even when source code is unavailable. It is for examining features, collecting evidence, explaining implementations, and building adapted versions for another stack. The catalogue add-ons connect coding agents to REA’s investigation workflow.
Borrowing it
Nothing to install: this file belongs to morluto/rea. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/morluto/rea/main/.agents/skills/reverse-engineer-anything/SKILL.mdgit clone --depth 1 https://github.com/morluto/reaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/morluto/rea/reverse-engineer-anything)<a href="https://agentmods.dev/skills/morluto/rea/reverse-engineer-anything"><img src="https://agentmods.dev/badge/skills/morluto/rea/reverse-engineer-anything/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/morluto/rea/reverse-engineer-anything"><img src="https://agentmods.dev/badge/skills/morluto/rea/reverse-engineer-anything.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
- Socket pass
- Snyk warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 73 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 74 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.07826 |
| Opus 5.5 | $0.00033 | $0.03130 |
| Sonnet 5.5 | $0.00017 | $0.01565 |
| Haiku 4.5 | $0.00008 | $0.00783 |
Grade A, and why
reverse-engineer-anything scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 510 lines — stays where its author put it; the contents beside it link to each section on GitHub.
REA
Use REA when a claim depends on a shipped binary or package, decompilation, requested runtime evidence, or comparison with behavior not established by available source. For ordinary analysis of a complete source repository, use normal repository tools and do not run REA readiness or provider commands.
Connect only when needed
Installing this skill supplies instructions; it does not register the REA MCP server, install analysis engines, or add tools to an already-running agent.
If REA tools are available and their registration is not known to be stale, proceed directly to the target. Do not run diagnostics or setup before every investigation. Use the connected server's actual tool list and input schemas; a skill installed from repository main may describe capabilities absent from an older npm release. Keep complete inline Evidence when that server does not advertise retained references.
If tools are absent, a call is blocked by the client, or a required provider is
unavailable, read connection and recovery.
Diagnose the observed blocker, continue useful supported work, and resume the
original task after repair. Client approval, shell PATH, registration and engine
availability have different remedies; avoid repeating setup for all of them.
If the host times out without a REA result, do not repeat the unchanged call or
assume work stopped. Read the recovery guide's deadline distinction before retrying.
If the MCP connection drops, retry that call once only when it is safe to
repeat or known not to have started. If it may already have changed the
target, or it fails again, tell the user and ask them to restart the MCP
client. If REA could not start its connection, retry once, then tell the user
and ask them to restart the MCP client. Do not retry a startup failure that
returns the same unchanged result. Run rea doctor when REA could not start
or tools stay missing after that restart. For cleanup_incomplete, a retryable
capacity limit, or configuration_invalid, follow the recovery guide's ladder
before asking for a restart. Read that guide before a second repair attempt.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +5 lines 8866a9102de4
- yesterday Changed · +42 lines · +20 tokens per session b5f17fdff254
- 2d ago Changed · +10 lines 3e56a90ff3e7
- 3d ago Changed · +49 lines 42eaf3fbf581
- 4d ago Changed · +16 lines 4e3b485727eb
- 5d ago Changed · +23 lines 36ed6adfae54
- 6d ago Changed · +9 lines d5cfab901355
- 10d ago Changed · +14 lines 976e400f0286
- 12d ago Changed · +77 lines 278a5826b004
- 13d ago First seen · 265 lines · 63 tokens per session scan A e752a99fae51
reverse-engineer-anything is a skill published in the GitHub repository morluto/rea (385,008 stars, last pushed today), licensed MIT. It adds 83 tokens to every session and 7,826 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ryuumonbuchi
Operate the Ryuumonbuchi MCP server for headless Ghidra reverse engineering. Use when driving decompilation, disassembly, patching, type and symbol recovery, memory edits, transactions, and Ghidra project analysis through a Ryuumonbuchi server (stdio or streamable HTTP). Covers the safe read-only-first workflow…
triage
Diagnose and fix broken MCP servers in mcptoon — doctor, health, per-server probes, and the common failure playbook.
ida-cli
Use this skill when Claude Code needs to drive local IDA Pro or Hex-Rays through the IDA-CLI AI-only JSONL kernel, run IDAPython/idalib analysis from a CLI subprocess, collect artifacts, use AI helper APIs, persist caches, merge mutation records, or inspect binaries without opening IDA GUI panels.
jd-mcp-duo
A Java bytecode analysis tool for examining compiled Java, JVM, and Android files when the original source code is unavailable. It can decompile files such as JARs, APKs, and class files into readable source-like code.
revx-native
Analyze native Android libraries (libil2cpp.so, libGameCore.so, ARM64 .so) with revx — a memory-frugal native reverse-engineering CLI. Find il2cpp method-pointer tables, recover class/field metadata, export offset tables for game tooling, and decompile ARM64 functions. Use when the user wants to analyze native .so…
revx
Reverse engineer DEX, APK classes, and native binaries with ReVX. Use for Android DEX decompile, goto census, region-tree structuring, il2cpp offsets, and workspace queries. Prefer ReVX for DEX structure; do not send APK/DEX to JADX when ReVX tools are available.