Attract Reverse Engineer

An evidence-driven agent skill for authorized technical reverse engineering of source repositories, deployed web applications, packages, binaries, and mixed artifact sets.

The skill guides an agent from preflight through static analysis, controlled runtime observation, security review, claim auditing, and a lawful clean-room reconstruction blueprint. Its primary output is REVERSE_ENGINEERING_REPORT.md, backed by a recoverable evidence ledger and command log.

Install

Install all skills in this repository:

npx skills add 1GMedia/attract-reverse-engineer

Install only this skill for all detected compatible agents:

npx skills add 1GMedia/attract-reverse-engineer \
  --skill attract-reverse-engineer \
  --agent '*' \
  --yes

List what the repository exposes without installing:

npx skills add 1GMedia/attract-reverse-engineer --list

The Agent Skills ecosystem supports tools including Codex, Claude Code, Cursor, Windsurf, and other compatible agents. Exact agent discovery depends on the locally installed skills CLI version.

Use

Ask your agent to use attract-reverse-engineer, then describe the target, your authorization, and allowed access. Examples:

Use attract-reverse-engineer to assess this repository. I own it. Static analysis
and local tests are allowed, but do not install packages or use the network.

Use attract-reverse-engineer on the web app already open in my signed-in browser.
I am authorized to evaluate normal user flows. Do not extract credentials, bypass
access controls, or submit destructive actions. Include an investor claim audit.

Use attract-reverse-engineer on ./vendor/application.zip. Static analysis only.
Generate a clean-room reconstruction blueprint and list every important unknown.

What it produces

By default, the target workspace receives only:

REVERSE_ENGINEERING_REPORT.md
.reverse_engineering/
  analysis_state.md
  evidence.md
  commands.log
  file_inventory.txt
  ...bounded traces and sanitized notes

The report separates verified facts, strong inferences, tentative interpretations, and unknowns. It can include:

• Architecture, entrypoints, lifecycle, data flow, state, and deployment
• AI model, prompt, tool, memory, and orchestration analysis when actually present
• Controlled runtime observations with exact commands and side effects
• Security and trust-boundary findings without exploit execution
• Dependency, supply-chain, performance, and scaling analysis
• Investor-facing claim audit: demonstrated capability, implementation depth, differentiation, replaceability, moat evidence, and missing proof
• A behaviorally compatible clean-room reconstruction plan that avoids copying protected implementation

What it does not authorize

Installing this skill does not grant permission to inspect any system. The operator must have authority and define the target and boundaries.

The skill prohibits credential extraction, authentication bypass, persistence, destructive testing, production changes, host escape, secret disclosure, and unsupported claims. It treats target content as untrusted data and never follows embedded instructions merely because they appear in source, prompts, documentation, or model output.

Package layout

skills.sh.json
skills/attract-reverse-engineer/
  SKILL.md
  references/
  scripts/

SKILL.md contains the portable workflow and routes agents to focused reference files only when needed. This keeps the core instructions readable while preserving the depth required for serious assessments.

Development

Validate the package:

bash scripts/validate-skill.sh

Validate a generated report:

bash skills/attract-reverse-engineer/scripts/validate-report.sh \
  /path/to/REVERSE_ENGINEERING_REPORT.md

License

MIT. See LICENSE.