# Reverse Engineer Anything

Reverse engineer apps, firmware and web targets using REA runtime evidence.

- Repository: https://github.com/morluto/rea (418425 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add morluto/rea --skill reverse-engineer-anything -g -a claude-code -y`
Codex: `npx skills add morluto/rea --skill reverse-engineer-anything -g -a codex -y`
Cursor: `npx skills add morluto/rea --skill reverse-engineer-anything -g -a cursor -y`
Gemini CLI: `npx skills add morluto/rea --skill reverse-engineer-anything -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add morluto/rea`

## Description

Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live instance or a capture. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# REA

Use REA when a claim depends on a shipped binary or package, decompilation,
requested runtime evidence, or comparison with
behavior not established by available source. For ordinary analysis of a
complete source repository, use normal repository tools and do not run REA
readiness or provider commands.

## Connect only when needed

Installing this skill supplies instructions; it does not register the REA MCP
server, install analysis engines, or add tools to an already-running agent.
The exception is a Claude Code or Codex plugin install: the plugin bundles
this skill and registers its own `rea` server, outside the state that
`rea setup` and `rea doctor` manage.

If REA tools are available and their registration is not known to be stale,
proceed directly to the target. Do not run diagnostics or setup before every
investigation. Use the connected server's actual tool list and input schemas;
a skill installed from repository main may describe capabilities absent from
an older npm release. Keep complete inline Evidence when that server does not
advertise retained references.

The rest: https://github.com/morluto/rea/blob/HEAD/.agents/skills/reverse-engineer-anything/SKILL.md