Reverse Engineer Anything (REA) Skill for Claude Code

Makes Claude investigate apps and binaries with the REA toolset and explain how a feature works, with evidence for each claim.

Installs: 14K; on skills.sh
Stars: 418.5K; on GitHub
Files: 7; besides SKILL.md
Updated: Nov 2026; last repo commit

REA is a set of tools that lets your agent inspect programs without their source code: native binaries, JavaScript and Electron apps, .NET assemblies, Android APKs, firmware, packet captures and web apps. This skill tells Claude which REA tool to use for each kind of target, how to work summary-first, and how to label every conclusion as an observation, an inference or an unknown.

Installing the skill alone does not connect REA. You also need the REA MCP server, which guided setup adds. Use it only on software you own or are authorized to examine. Runtime features launch or interact with the target using your user permissions.

Good for

Security and reverse-engineering researchers inspecting software they are authorized to examine
Developers who want to understand how a shipped app or Electron feature works
Teams building agent test environments from a live web app or a HAR capture

Install reverse-engineer-anything

Claude Code

Copy this prompt.

Install the reverse-engineer-anything skill in Claude Code. Run this command:

npx rea-agents setup

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js and npm.

The skill is instructions for the REA MCP server, so the skill alone gives Claude no analysis tools. Guided setup is what connects them. The Claude Code and Codex plugin routes are not offered here, see the permissions section. Native analysis can use an existing Hopper, Ghidra, IDA or Kuna install; static JavaScript analysis needs none.

From the project README. Source.

What's in the skill

When it loads

Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live instance or a capture. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.

Sections in SKILL.md

Connect only when needed
Route the target first
Work summary-first
Plan broader investigations
Read only the relevant guide
Finish the task

Key facts

Author: morluto
Repository: morluto/rea
Installs on skills.sh: 13,966 as of 2026-11-02
GitHub stars: 418,454 for the whole morluto/rea repo
License: MIT (README)
Last repo commit: 2026-11-01
What is inside: 8 files including SKILL.md: 7 reference guides (Android, connection and recovery, environments, evidence workflows, JavaScript, native and artifacts, runtime observation). It bundles no scripts.
skills.sh audits: Gen Agent Trust Hub: pass; Socket: pass; Snyk: pass
Skill version: 59 in the SKILL.md frontmatter
Needs: The REA MCP server (npm package rea-agents) and Node.js. Native analysis can also use Hopper, Ghidra, IDA or Kuna
Official sources: github.com/morluto/rea, rea.tools and the rea-agents npm package, per the README

What it includes

Analyze an ASAR or extracted tree, trace features, compare versions
analyze_javascript_application reads the supplied files without running the app. The skill also uses inspect_electron_fuses and list_electron_targets for an Electron app you have open.
Try: “Understand how search works in this Electron app and show me the evidence.”
Read · JavaScript and Electron apps
ZIP, APK, IPA, MSIX, DMG, PyInstaller, Bun executables
open_binary and inspect_artifact inventory package members. inspect_android_package covers APK code, classes and methods. inspect_apk_signature reports signing schemes and signer fingerprints.
Read · Archives, packages and Android
Open, decompile and compare through Hopper, Ghidra, IDA or Kuna
open_binary binds a binary to an analysis engine, then focused tools such as analyze_function work on it. For a Ghidra startup timeout, a deadline recovery section is in native-and-artifacts.md.
Runs code · Native binaries
Inspect regions and extract images
inspect_firmware_regions and extract_firmware use caller-supplied Binwalk or Unblob on Linux. Extraction goes to a new absolute output directory you choose.
Files · Firmware
Run or attach to a target and watch what it does
runtime-observation.md covers LLDB call observation, Frida sessions and scripts, gdb and Rizin debug sessions and process capture. These launch or interact with the target using your user permissions, and closing a debugger does not necessarily kill it.
Runs code · Runtime observation
Drive a browser scenario, read HAR, SAZ, pcap and qlog files
capture_browser_scenario performs declared actions such as click and type. inspect_web_network_capture, inspect_packet_capture and inspect_pcap_capture read recorded files; the SKILL.md says they do not capture live traffic.
Runs code · Browser and network captures
WASM, PE, ELF, EVM, Go, Rust, GGUF, SQLite, pyc and more
Single-purpose tools that read one file you name, for example inspect_wasm_artifact, inspect_pe_imports, inspect_elf_notes, inspect_evm_interface, inspect_model_artifact and inspect_sqlite_database.
Read · Target-free file inspectors
Record a web app and export a practice bundle
environments.md records a live app or HAR with capture_browser_scenario and writes a bundle with export_environment_bundle. It says to ask before any scenario that writes, and to pass credentials only as environment variables the user names.
Runs code · Agent environments (AgentEnv)
Summary-first results with retained evidence IDs
Start with the summary, page the retained Evidence with inspect_analysis_view, export a bundle with export_evidence_bundle and clear state with reset_investigation, optionally saving first.
Files · Evidence handling
Diagnose missing tools instead of re-running setup
If REA tools are missing, the skill reads connection-and-recovery.md and uses rea doctor for setup-owned installs. Plugin installs follow separate recovery steps. REA setup does not install Node.js, Java, Ghidra, IDA or similar prerequisites.
Runs code · Connection and recovery

From the official docs

Permissions

High risk

The skill drives tools that can run, debug and instrument the program you analyze, using your own user permissions, and setup edits your agent configuration. Use a disposable machine or VM for unknown software, and only analyze software you are authorized to examine.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Runtime tools run or attach to the target
The README says runtime capture runs or interacts with the selected target using your user permissions. runtime-observation.md covers Frida, gdb, LLDB and process capture, and notes a closed debugger may leave the target running. Use an isolated VM for unknown software. github.com
Setup edits your agent configuration
installation.md says setup writes mcpServers.rea in ~/.claude.json and installs the skill under ~/.claude/skills for Claude Code, making REA available in every project. It asks before changing config, makes backups and can install Hopper with approval. github.com
Recording a web app can write data in that app
environments.md says to ask before any scenario that writes. Credentials come from environment variables you name, never from chat, and declared secrets are redacted as the capture records. github.com
Use is limited to authorized software
The README states that REA is for lawful research and for software you own or are authorized to examine, and that you must legally obtain any commercial tools it connects to. github.com
The Claude Code and Codex plugin is not offered here
docs/installation.md says the plugin becomes installable after the first qualified npm release that contains its manifests. When we listed the published rea-agents 6.8.0 package on 2026-11-02, it had no .claude-plugin/plugin.json, and the marketplace file pins that version. Use guided setup until the plugin works for you. The doc also says to use a plugin or a setup registration for a client, not both. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No global read-only switch. Static file inspectors only read the files you name, but runtime tools execute the target.
Talks to	npm registry (npx rea-agents, package install). The sites and apps you ask REA to browse or record. Your model provider receives the tool results the agent sees
Sign-in and keys	Setup writes the REA registration into your agent configuration. Site credentials for recordings are passed as environment variables you name, per environments.md.
Data retention	Evidence stays in memory on the MCP connection unless you export a bundle or pass a save path.
Scopes	The REA MCP server and its tools, registered by setup or the plugin Runtime tools that launch, debug or instrument a target with your user permissions Writes to the output paths you choose for firmware extraction and environment bundles

Questions

What does the Reverse Engineer Anything skill do?

It guides Claude to use the REA toolset to inspect a binary, app, package, firmware image or capture. It picks the right tool for the target, works summary-first and separates what was observed from what was inferred.

How do I install it?

Use the install box above. Guided setup (npx rea-agents setup) adds both the REA server and this skill. The skills-only command installs just the instructions, which do not connect REA by themselves.

Why does Claude say it has no REA tools?

The skill does not register the REA MCP server. If you installed only the skill, run guided setup, then restart your agent. The skill’s own recovery guide covers other causes.

Does it upload my app?

The README says REA analyzes targets locally, and your agent receives the tool results. Your model provider has its own data policy, so treat results as shared with that provider.

Do I need Ghidra, IDA or Hopper?

Only for native-binary analysis. Static JavaScript and Electron analysis needs no native engine, per the README. REA can use an existing Hopper, Ghidra, IDA or Kuna installation and can install Hopper with your approval.

Can I use it on any software?

The README says REA is for lawful research, education, interoperability, software preservation and analysis of software you own or are authorized to examine. You must be allowed to use any commercial tools it connects to.

Is it safe?

Static analysis reads files you point it at. Runtime tools run or attach to the target program with your user permissions, so analyze unknown or hostile software only in an isolated environment. Setup also edits your agent configuration. Read the permissions section first.

Information

updated Nov 2, 2026

Repository: morluto/rea
Folder: .agents/skills/reverse-engineer-anything

morluto/rea skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 5

morluto/rea README · github.com
REA installation guide · github.com
reverse-engineer-anything SKILL.md · github.com
environments.md · github.com
runtime-observation.md · github.com