How to use the Reverse Engineer Anything agent skill

What the skill makes the agent do

An agent skill is a folder of instructions that an AI agent reads when a task matches the skill's description. This one tells the agent when and how to use REA, a reverse-engineering toolkit, to answer questions about software whose source code you do not have.

The agent is told to pick the REA tool that fits the target, read the returned evidence carefully, and report what is actually established versus what remains unknown. It also covers recovering from connection problems with the REA server and building web application environment bundles (AgentEnv bundles) from a live instance or a recorded capture.

• Explain how a shipped program, mobile app or Electron app behaves
• Compare behavior between versions of a packaged application
• Decompile code or guide a reconstruction
• Build an agent environment from a web application's live instance or a capture

Install the skill (ZIP or Claude apps upload)

Download the ZIP of the skill from this page and unzip it. For a personal install, place the unzipped skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder instead.

If you use the Claude apps rather than Claude Code, upload the skill under Settings, then Capabilities, then Skills.

Installing the skill only adds instructions. The source states that it does not register the REA MCP server, install analysis engines, or add tools to an already-running agent. Those are separate steps, covered below.

Set up the REA server and engines

The skill needs REA tools to be available to your agent. You can get them from the REA MCP server or from the rea-agents npm package, which requires Node.js and npm. Claude Code, Codex or another MCP-capable client is needed to register the server.

Analysis depends on the target. The source names Ghidra, IDA, JADX and Kuna as native analysis engines, and says firmware extraction on Linux uses Binwalk or Unblob. REA setup does not install Node.js, npm, Homebrew, Java, Ghidra, IDA, JADX, Kuna, Binwalk or Unblob, so you must install whichever ones your target needs yourself.

If REA tools are already available to your agent, the skill proceeds directly to the target without running setup. Do not run diagnostics before every investigation.

• REA MCP server, or the rea-agents npm package (Node.js and npm)
• A native engine such as Ghidra, IDA, JADX or Kuna, depending on the target
• Binwalk or Unblob on Linux for firmware extraction
• Claude Code, Codex or another MCP-capable client

Trigger the skill with a natural request

You do not need special syntax. Describe the software and the question in plain language, and say what you are looking at. The skill's description covers shipped-artifact or requested runtime evidence, feature explanations, version comparisons, decompilation and reconstruction.

The agent routes by the kind of target you supply. An ASAR or extracted JavaScript tree goes to the JavaScript analysis tool, an APK goes to the Android tools, a .NET managed assembly goes to the managed-artifact tool, and a firmware image goes to the firmware tools. Give the agent the local path to the file or folder.

• Ask what a feature in a shipped app does, and provide the APK, binary or app folder
• Ask how two versions of a packaged application differ in behavior
• Ask for a decompiled view of a specific function or class from a provided file
• Ask for an agent environment from a web application you have a capture of

Run a quick JavaScript or ASAR analysis from the command line

For an operator-supplied JavaScript tree or ASAR, the source gives a CLI fallback that needs no MCP registration and no native engine. Replace the path with the absolute path to your app. The CLI returns the evidence record directly, and it does not establish that MCP is configured.

Read the returned evidence, graph, limitations and unknowns with the same care as an MCP result.

Build an agent environment from a web application

For a web application, the workflow records the application once with capture_browser_scenario, checks what the environment would serve, and then writes the bundle with export_environment_bundle. The result is a folder that agent-env deploys, whose MCP tools answer from what that recording observed.

For a HAR file you already have, skip the recording step and use inspect_web_network_capture, or run rea environment-build with the capture file and an output directory.

Before recording, the source says to use only an instance the user states is disposable or seeded for this purpose, because every write step creates, edits or deletes data. If that has not been stated, the agent should ask first.

• Use only disposable or seeded instances for recording write steps
• Ask before any scenario that changes data if the user has not said it is safe

Safety, scripts and network use

This skill runs scripts and uses the network. Decompiling or probing a target can breach licences or the law, so use it only on software you are authorized to inspect. The skill is also designed to avoid unnecessary actions: it says not to run REA for ordinary analysis of a complete source repository, and not to run setup before every investigation.

Live-target work has distinct launch, attach, mutation and cleanup effects. Runtime tools are not required to have a preliminary static session, but you should understand what each one does to the target before allowing it.

• Use only on software you have authorization to inspect
• Do not use it to analyse a full source repository; normal repository tools are better
• Check approval prompts from your client before allowing runtime or mutating actions