leanrea Drives Local Reverse-Engineering Tools Without MCP

Use this Skill when the user already has reverse-engineering tools locally and wants to skip MCP servers and complex configuration. It is built on the open-source leanrea (MIT): an 8 KB SKILL.md that tells the Agent which command is fastest for each type of target, provides reconnaissance commands that can be pasted directly, and lists common pitfalls. The Agent runs the real tools itself through Bash, without adding any extra tool definitions.

Triggers

The user asks things like "how is this feature of the app implemented, show me the evidence", "take a look at this Electron app", "which dependencies does this Go binary use", "what does this APK call", or "unpack this firmware", and does not want to install a full MCP setup.

Hard rules

1. Only analyze your own targets, or targets with explicit authorization. If the scope of authorization is unclear, stop and ask the user before doing anything.
2. Do not scan, attack, bypass paywalls or access controls, or perform denial of service against live systems. Read-only and local analysis come first.
3. Tell the user before installing anything or changing configuration, and proceed only after they agree.
4. Conclusions fall into three categories: what was directly seen (with file and location), what was inferred, and what was not found (write "unknown", not "does not exist").
5. Do not output or record the full contents of any keys or tokens found; only report where they are.
6. Work on a copy. Each unpacking goes into a new directory under $TMPDIR/re/<name>.
7. Route by file and magic bytes first. Do the cheapest inventory first (strings, imports, exports), then decompile, then read the code.
8. Use rg -uu to search unpacked directories (Electron's .webpack/ and .vite/ are ignored by default). Do not cat large or minified files; use slices instead.
9. A missing tool is not a blocker: use the alternative on the same line, or run brew install with the user's consent.

Installation

npx skills add aicodeking/leanrea            # interactively choose which Agents to install to
npx skills add aicodeking/leanrea -g         # install at user level, available to all projects
npx skills add aicodeking/leanrea -a claude-code -y   # Claude Code only, no prompts
npx skills update leanrea                    # update later

For Agents without skills support, paste leanrea/SKILL.md as plain text into the rules. When analysis tools need installing (with the user's consent): brew install jadx apktool radare2 binwalk wabt wireshark ghidra, npm i -g @electron/asar, dotnet tool install -g ilspycmd, cargo install cargo-audit.

Choosing commands by target

Target	Fastest path
Electron app	npx -y @electron/asar extract app.asar X, check the entry point in package.json, then use rg -uu to search for IPC and exposeInMainWorld
Minified web bundle	Look for sourceMappingURL; if sourcesContent is present, export the source directly; otherwise format it and read by line slices
Mach-O	lipo -info, otool -L, nm -gU (exports), nm -u (imports, which form the capability map), strings
Go	go version -m file, one command that gives the toolchain and dependencies
Rust	Use cargo audit bin to read dependencies, and find the compiler commit hash in the strings
.NET	Decompile with ilspycmd, then rg
APK	jadx -d X a.apk then rg; libflutter.so indicates Flutter, libhermes.so indicates React Native
WASM	wasm-objdump, wasm2wat
Traffic capture	tshark -r file -q -z conv,tcp
Firmware	binwalk -e or unblob -e, then route each extracted file

Pacing

2 to 4 tool calls: one batched reconnaissance pass, one or two targeted slices, then answer. Once the evidence for each question is complete, stop; do not re-verify what has already been seen.

About its evaluation

The author ran 4 reverse-engineering tasks on Claude Code, 3 runs each, and reports 38% less time, 35% lower cost, and comparable accuracy compared with REA's MCP approach. This is the author's own test: each cell has only 3 runs, only one model and one machine were used, and the author states these limitations, so treat it as a reference only.

Output format

Label each conclusion seen (giving the file and offset, or the symbol or string) or inferred; write unknown where nothing was found. Static reading is not the same as observed runtime behavior.