leanrea: Reverse Engineer Software with Agent Skills and CLI Tools

Overview

leanrea is a compact skill for coding agents doing reverse engineering. Instead of adding an MCP server and a large collection of tool definitions, it guides an agent to use plain CLI tools through Bash, including tools such as otool, nm, asar, jadx, and sqlite3.

It is aimed at developers who want an agent to investigate software artifacts with less setup and context overhead. The project supplies commands and investigation practices; the agent runs the tools itself. Its benchmark reports better speed and cost than REA on a small set of tasks, but the README also notes that the gain over using no skill is smaller.

Key Features

• Routes common artifact types to suggested command-line tools, from Electron apps and Mach-O binaries to APKs, firmware, SQLite databases, and packet captures.
• Provides ready-to-run first-pass commands for Electron apps and native binaries.
• Advises agents to inspect file types and magic bytes before choosing an analysis path.
• Recommends searching extracted trees with rg -uu to find code in hidden directories.
• Encourages batching probes and slicing minified files rather than reading them whole.
• Asks agents to distinguish observed evidence from inference and unknowns.
• Includes benchmark scripts, results, and task answer keys for reproducing the comparison with REA.

Use Cases

• A desktop-app developer wants an agent to trace an Electron feature through an app archive, preload code, and IPC channels.
• A macOS developer needs an initial inventory of a native add-on's exports, imports, or permission checks.
• A security or reverse-engineering practitioner wants an agent to inspect a binary or firmware image using locally available CLI tools.
• A team already using a skills-compatible coding agent wants reusable investigation guidance without installing an MCP server.

Getting Started

Install with the skills CLI:

npx skills add aicodeking/leanrea

Then ask your agent to use the skill, for example: /leanrea How does the search feature in Foo.app work? Show the evidence. See the README for agent-specific and manual installation options, supported investigation workflows, and benchmark reproduction steps.

Considerations

• The repository is very new, with only one contributor so far. Its work is concentrated in that person, and there is not yet a track record of releases or issue resolution.
• The benchmark uses three repetitions per task cell, one model, and one machine. The README says Ghidra, Hopper, and jadx were not installed for the native tasks, and notes that results against no skill are less pronounced than results against REA.
• The skill is guidance, not a bundled analysis environment. Results depend on the agent's ability to use Bash and on the relevant tools being installed.
• The README's benchmark answer keys are tied to particular app versions and a specific gh build, so other versions need new keys.
• The repository is MIT licensed; teams should review the license terms when incorporating or redistributing it.