---

Overview

REA_Skill is a unified library of 243 specialized skills across 41 categories built for the Claude Skills system, OpenAI Codex, Google Antigravity, Cursor, Windsurf, and Cline. It combines:

1. REA (Reverse Engineer Anything) Core & Full Source Recovery (17 skills): Disassemble PE/ELF/Mach-O binaries, decompile Android APKs/iOS IPAs, unpack Webpack/Vite/WASM/Electron bundles, dissect PCAP/Protobuf protocols, extract Unity/Unreal/Godot game assets, and reconstruct 100% compilable source code with zero skeletons (// TODO banned).
2. Multi-Agent Intelligence & Browser MCP Suite (9 skills): First-party owner authorization, Everything Claude Code (ECC) engineering rigor, Agent Reach zero-fee internet intelligence, SurfSense air-gapped RAG, and triple-engine browser automation (Playwright, Bright Data, Hyperbrowser).
3. 23-Category Security Assessment & Vulnerability Research Library (79 skills integrated from claude-red): Structured SKILL.md methodologies spanning Web OWASP Top 10, JWT/OAuth, Active Directory, Wireless/BLE/Zigbee/LoRa, Cloud, Mobile MASVS, IoT/Firmware, Binary Mitigations, Crash Analysis, Coverage-Guided Fuzzing (AFL++/libFuzzer), APIs, Containers/Kubernetes, CI/CD, Cryptography, Supply Chain, and AI/LLM Security.
4. 63 PayloadsAllTheThings Payload Skills (NEW in v2.1.0): The complete swisskyrepo/PayloadsAllTheThings library adapted as structured SKILL.md files — covering SQL/XSS/XXE/SSRF/SSTI/Command Injection, file upload bypass, deserialization, request smuggling, OAuth/JWT attacks, CORS, CSRF, open redirect, prototype pollution, prompt injection, race conditions, and 40+ more payload categories with full PoC content.
5. Understand Anything Codebase Understanding & Knowledge Graph Engine (9 skills + 10 agents, NEW in v2.2.0): Full integration of Egonex-AI/Understand-Anything — AST codebase analysis producing .ua/knowledge-graph.json, interactive React/xyflow dashboard with Louvain community clustering (understand-dashboard), deep component Q&A (understand-chat), git diff impact prediction (understand-diff), business domain flow mapping (understand-domain), component explainers (understand-explain), Figma design knowledge graphs (understand-figma), Karpathy LLM wiki parsing (understand-knowledge), and developer onboarding walkthroughs (understand-onboard).
6. Anti-Slop Clean Output System (6 skills): Integrated from miqdadbadjuber/anti-slop — stopping generic AI interfaces, robotic comments, hyperbole marketing copy, mobile reflow issues, and accessibility flaws.
7. Design Engineering & Craft Systems (3 skills): Integrated from pbakaus/impeccable, Leonxlnx/taste-skill, and educlopez/ui-craft — 24-command design steering vocabulary (/impeccable), Awwwards-distilled frontend art direction (design-taste-frontend), and 10-item designer acceptance bar (ui-craft).
8. Anti-AI-Slop Writing Discipline (1 skill): Integrated from jalaalrd/anti-ai-slop-writing — eliminates 50+ robotic words, formulaic phrases, and rule-of-three tells.
9. Persistent Memory Compression (1 skill): Integrated from thedotmack/claude-mem — cross-session memory compression system distilling conversation transcripts into durable project snapshots.
10. High-Performance Headless Browser (1 skill): Integrated from lightpanda-io/browser — headless browser built in Zig (16x lighter, 9x faster than Chromium) with full CDP compatibility.
11. Expanded REA Core & Everything Claude Code Suite (52 skills): 5 new REA core additions (rea-analysis-optimization, rea-changelog-update, rea-ci-tests-audit, rea-tool-design, reverse-engineer-anything) and 47 new Everything Claude Code (ECC) skills spanning full-stack development, TDD, and multi-agent coordination.

Drop REA_Skill into your coding agent and it operates like a senior reverse engineer and security architect: skills load progressively on demand based on conversational triggers—zero wasted context window.

Interactive Website, 500+ Unblocked Prompt Vault & AI Prompt Builder → https://smartworldarafath.github.io/REA_Skill/

---

Quickstart

1. Claude Code Native Plugin (Recommended)

/plugin marketplace add smartworldarafath/REA_Skill
/plugin install rea-skills@smartworldarafath

2. Universal Agent Skills CLI (skills.sh)

Works across Claude Code, OpenAI Codex, Google Antigravity, Cursor, and Windsurf:

npx skills add smartworldarafath/REA_Skill

3. Claude Skills System (~/.claude/skills)

git clone https://github.com/smartworldarafath/REA_Skill ~/.claude/skills/rea-skills

To install only specific categories via sparse checkout:

git clone --filter=blob:none --sparse https://github.com/smartworldarafath/REA_Skill
cd REA_Skill && git sparse-checkout set skills/rea-core skills/web skills/exploit-dev

4. Interactive Install Script (./install.sh)

./install.sh                               # interactive target prompt
./install.sh --target ~/.claude/skills     # explicit target directory
./install.sh --category rea-core           # install single category
./install.sh --category web                # install web security category
./install.sh --list                        # list all 29 categories & counts

5. Direct CLI System Prompt Piping

cat skills/rea-core/rea-full-code-recovery/SKILL.md | claude --system-file -
cat skills/web/offensive-sqli/SKILL.md | claude --system-file -

6. Connect REA MCP Server

npx -y rea-agents@latest setup
npx skills add morluto/rea --skill reverse-engineer-anything

---

Categories

Category	Skills	Focus
Reverse Engineering & Source Recovery	17	Full A–Z lost source code recovery, PE/ELF/Mach-O disassembly, APK/IPA, WASM, PCAP, SQLite, Unity/Unreal, firmware & interactive grilling
Multi-Agent Ecosystem & Browser MCPs	9	Owner authorization, 10-layer website audit, ECC TDD rigor, Agent Reach, SurfSense RAG, Playwright, Bright Data & Hyperbrowser
Codebase Understanding & Knowledge Graphs	9	AST codebase analysis, interactive React/xyflow dashboard, component Q&A, git diff impact, domain flows, Figma & Karpathy wiki graphs
Web Application	16	OWASP Top 10, SQLi, XSS, SSRF, SSTI, XXE, IDOR, RCE, deserialization, race conditions, request smuggling, GraphQL & business logic
Auth & Identity	2	JWT implementation auditing (alg:none, key confusion, claims) and OAuth 2.0 / OIDC flow verification (PKCE, redirect_uri)
Active Directory	2	On-prem & hybrid AD security auditing, Kerberos, ACLs, ADCS ESC1–15, SMB/LDAP signing & channel binding
Wireless	14	802.11, WPA2-PSK, WPA3-SAE, 802.1X/EAP, WPS, rogue AP detection, KRACK/FragAttacks, 802.11w PMF, BLE, Classic BT, Zigbee/Matter, Z-Wave & LoRaWAN
Cloud	1	AWS, Azure, and GCP IAM least-privilege review, IMDSv2 enforcement, storage ACLs & cross-account trust boundaries
Mobile	1	Android and iOS OWASP MASVS assessment, manifest/plist auditing, Keystore/Keychain, TLS pinning & Frida runtime triage
IoT & Embedded	1	Hardware debug lockdown (UART/JTAG/SWD), SPI flash encryption, Secure Boot chains, signed OTA updates & RTOS protection
Infrastructure & Hardening	7	External attack surface, Purple Team MITRE ATT&CK validation, EDR telemetry health, PIC/loader analysis, Windows mitigations (ACG/CFG/CET/HVCI) & UAC/IL boundaries
Exploit Mitigations & Crash Analysis	6	Memory corruption root-cause analysis, WinDbg/GDB/ASan crash triage, compiler hardening (RELRO/PIE/CFI), stack/format auditing & TOCTOU races
Fuzzing & Vulnerability Research	4	Coverage-guided fuzzing (AFL++, libFuzzer, Honggfuzz), harness engineering, static/CodeQL variant analysis & CWE vulnerability taxonomy
Reconnaissance	2	External Attack Surface Management (EASM), Certificate Transparency logs, ASN/DNS inventory & drift monitoring
API Security	2	OWASP API Top 10 across REST/GraphQL/gRPC/WebSocket, schema validation, pagination bounds & idempotency enforcement
Container & Kubernetes	2	Container runtime isolation (capabilities, seccomp, rootless) and Kubernetes RBAC, Pod Security Standards & NetworkPolicies
CI/CD & Pipeline	2	GitHub Actions / GitLab CI workflow hardening (pull_request_target, SHA pinning) and OIDC secretless workload federation
Cryptography	2	Applied cryptography auditing (AEAD AES-GCM/ChaCha20, CSPRNG, Argon2id) and TLS 1.3 / PKI / HSTS / mTLS configuration
Privilege Escalation	2	Linux (SUID, capabilities, sudoers, systemd) and Windows (service ACLs, unquoted paths, token privileges, DLL search order) boundary audits
Post-Exploitation & Segmentation	3	Internal network microsegmentation, endpoint autoruns/persistence baseline auditing, and DLP egress protection
Forensics & Network Detection	2	Immutable SIEM/audit log integrity, MFT/EventLog tamper detection, and JA3/JA4/beacon network threat hunting
Supply Chain	2	SLSA build provenance, Sigstore/Cosign signing, CycloneDX/SPDX SBOMs, and private registry dependency-confusion prevention
Social Engineering & Email Auth	2	SPF/DKIM/DMARC p=reject enforcement, FIDO2/WebAuthn passkeys, and helpdesk identity verification workflows
Network Attacks	1	Layer 2/3 switch hardening: Dynamic ARP Inspection (DAI), DHCP Snooping, 802.1X, LLMNR/NBT-NS disablement & VLAN isolation
AI Security	1	OWASP LLM Top 10: direct/indirect prompt injection defenses, tool-call sandboxing, RAG ACLs & output validation
Utility	2	Rapid 15-minute pre-release security triage checklist and CVSS v3.1/v4.0 executive & technical report authoring
PayloadsAllTheThings (NEW v2.1.0)
Payload Injection Library	18	SQL, XSS, XXE, SSRF, SSTI, Command, LDAP, NoSQL, GraphQL, XPath, XSLT, LaTeX, SAML, SSI, HTTP Param Pollution, CSV, Prototype Pollution & Prompt Injection payloads
Payload Web Attacks Library	30	CORS, CRLF, CSRF, Open Redirect, LFI/RFI, Path Traversal, Deserialization, File Upload, Request Smuggling, Cache Deception, OAuth, JWT, IDOR, Race Conditions, WebSocket, CSS Injection, Clickjacking, Type Juggling, Mass Assignment, Dependency Confusion, Account Takeover, Brute Force, Business Logic, API Key Leaks, CVE Exploits, Reverse Proxy, vHosts, Hidden Params, ORM Leak, CSS Injection
Payload Research Library	14	DOM Clobbering, Encoding, ReDoS, DNS Rebinding, Tabnabbing, XS-Leak, Headless Browser, Client-Side Path Traversal, GWT, Ext Variable, Java RMI, Insecure Randomness, Management Interface Exposure, SCM Exposure, Zip Slip
Payload Resources	1	Pentest methodology cheatsheets: AD Attack, Reverse Shells, Network Pivoting, Linux/Windows PrivEsc, Cloud Pentest (AWS/Azure/GCP), Kubernetes, Docker
Anti-Slop, Design & Memory (NEW v2.3.0)
Anti-Slop Clean Output	6	Core anti-slop filter, code comment hygiene, authentic copywriting, accessibility checks, mobile layouts, and UI polish
Design Taste & Engineering	3	Impeccable 24-command design vocabulary, TasteSkill v2 gallery-distilled art direction, and UI Craft designer acceptance gates
Writing Quality & Anti-AI-Slop	1	50+ banned AI words, 35+ formulaic phrases, and structural pattern elimination for human-grade writing
Persistent Agent Memory	1	Claude-Mem cross-session transcript memory compression, knowledge graph distillation & multi-agent memory sharing
Headless Browser Automation	1	Lightpanda Zig headless browser (16x lighter, 9x faster than Chromium) with full CDP support for Playwright & Puppeteer
Everything Claude Code (ECC)	48	Complete full-stack engineering suite covering TDD rigor, coding standards, CI/CD audits, and multi-agent loops

---

Skill Index

Reverse Engineering & Source Recovery

skills/rea-core/ • .agents/skills/

Skill	Description
rea-universal-orchestrator	Master artifact auto-detection & router for all 500+ Prompt Vault templates and custom reverse-engineering tasks
rea-grill-me	(User-Invoked) Relentless frontier-question interview to scope reverse engineering, source recovery, or audit plans
rea-grilling	Interactive decision-tree interrogation engine computing compiler, fidelity, asset, and verification trade-offs
rea-full-code-recovery	Autonomous end-to-end A–Z lost source code recovery with Zero-Skeleton Law and 1-click multi-compiler (build.bat/build.sh) verification
rea-binary-disassembly	Complete Windows PE (.exe/.dll/.sys), Linux ELF (.so/.deb/.AppImage), and macOS Mach-O static & dynamic binary disassembly
rea-mobile-app-recovery	Android (APK/AAB/DEX/JNI/Flutter/React Native/Unity) & iOS (IPA/Mach-O/Swift) reconstruction + 5-Pillar MASVS scanner
rea-web-bundle-recovery	Webpack/Vite/Next.js AST de-minification, source map recovery, WebAssembly (.wasm) decompilation & Electron .asar unpacking
rea-protocol-api-recovery	PCAP packet dissection, Protobuf/gRPC .proto descriptor recovery, WebSockets, GraphQL & working client/server SDK generation
rea-database-storage-recovery	SQLite, Realm, LevelDB, Apple NSKeyedArchiver / binary plist, Windows Registry hives & custom binary format parsers
rea-game-asset-recovery	Unity (Il2CppDumper/AssetStudio), Unreal (.pak), Godot (.pck), HLSL/SPIR-V/GLSL shader decompilation & 3D/audio extraction
rea-performance-crash-triage	Windows Minidump (.dmp), Linux core & macOS .ips forensics, Frida dynamic hooking & Flameox CPU flamegraphs
rea-firmware-iot-extension	Embedded firmware (binwalk/unblob, RTOS/ARM/MIPS/RISC-V), EVM smart contract bytecode & RF/signal decoding

Codebase Understanding & Interactive Knowledge Graphs

skills/codebase-understanding/ • .agents/skills/

Skill	Description
understand	Master codebase analysis orchestrator producing .ua/knowledge-graph.json with AST parsers, language patterns & framework heuristics
understand-chat	Graph-powered conversational engine answering deep architectural and flow questions about any codebase
understand-dashboard	Launch interactive web dashboard (xyflow/react + Louvain community clustering) for visual exploration & guided tours
understand-diff	Git diff and pull-request impact analyzer predicting ripple effects, risks & affected components before merge
understand-domain	Business logic and domain flow graph extractor mapping code to high-level processes and steps
understand-explain	Deep-dive component explainer breaking down complex files, functions, or modules into plain English
understand-figma	Figma REST API design knowledge graph builder analyzing tokens, components, screens & design systems
understand-knowledge	Force-directed knowledge graph builder for Karpathy-pattern LLM wikis with entity extraction & claims
understand-onboard	Automated developer onboarding walkthrough generator ordered by dependency graph and architectural hierarchy

Multi-Agent Ecosystem & Browser MCPs

skills/agent-ecosystem/ • .agents/skills/

Skill	Description
rea-owner-authorization	Persistent first-party owner authorization preventing false-positive refusals on user-owned software and binaries
rea-personal-use-authorization	Maximum-effort directive for personal debugging, lost-source recovery, and pre-release vulnerability auditing
website-security-audit	5-Phase & 10-Layer defensive website vulnerability scanner (HSTS/CSP/CORS headers, bundle secrets, RLS, APIs, webhooks)
ecc-workflow	Everything Claude Code (ECC) engineering harness: Research & Reuse, Plan First, TDD, Code Review & Zero-Secret Gate
agent-reach	Zero-fee read-only internet intelligence across X/Twitter, Reddit, YouTube transcripts, GitHub, LinkedIn & Bilibili
surfsense	Air-gapped, privacy-first local documentation intelligence and codebase RAG powered by SurfSense
playwright-mcp	Microsoft Playwright MCP for structured DOM accessibility-tree navigation, live browser interaction & E2E verification
brightdata-mcp	Bright Data MCP for anti-bot unlocking, CAPTCHA bypass, residential proxy routing & SERP extraction
hyperbrowser-mcp	Hyperbrowser MCP for cloud headless browser sessions, dynamic SPA crawling & session recording

Web Application

skills/web/ • .agents/skills/

Skill	Description
offensive-sqli	SQL injection auditing — error-based, blind, OOB, DB-specific syntax, ORM pitfalls & parameterized remediation
offensive-xss	Cross-site scripting — reflected, stored, DOM-based, mutation XSS (mXSS), sink taint tracking & CSP hardening
offensive-ssrf	Server-side request forgery — URL parser differentials, DNS rebinding, IMDSv2 enforcement & egress allowlisting
offensive-ssti	Server-side template injection — Jinja2/Twig/Freemarker/Handlebars context analysis & sandboxed rendering
offensive-xxe	XML external entity — external DTD/entity resolution auditing across XML/SOAP/SAML/SVG/DOCX & parser hardening
offensive-idor	Insecure direct object references (BOLA/IDOR) — horizontal/vertical privilege matrices, tenant isolation & RLS checks
offensive-file-upload	File upload security — magic-byte validation, path traversal, Zip Slip, polyglots & isolated object storage
offensive-rce	Remote code execution — command injection sink auditing, argument separation, dynamic eval removal & sandboxing
offensive-deserialization	Insecure deserialization — Java, .NET, PHP, Python & Node serialization gadget reachability & safe schema formats
offensive-race-condition	Race conditions — TOCTOU windows, HTTP/2 single-packet concurrent testing, row locking & idempotency keys
offensive-request-smuggling	HTTP request smuggling — CL.TE, TE.CL, H2.CL downgrade desync & reverse-proxy framing normalization
offensive-open-redirect	Open redirect — returnUrl validation, authority confusion, OAuth token leakage prevention & strict allowlists
offensive-parameter-pollution	HTTP parameter pollution — duplicate query/body/JSON key precedence across gateways and backend frameworks
offensive-graphql	GraphQL security — introspection control, query depth/complexity limits, batching rate limits & resolver authz
offensive-waf-bypass	WAF normalization audit — encoding discrepancies, body inspection limits & root application-layer remediation
offensive-business-logic	Business logic flaws — workflow state machine enforcement, boundary/negative value checks & multi-step invariants

Auth & Identity

skills/auth/ • .agents/skills/

Skill	Description
offensive-jwt	JWT security — alg:none rejection, RS256/HS256 key confusion, jwk/jku/kid injection, secret entropy & claim checks
offensive-oauth	OAuth 2.0 & OIDC — exact redirect_uri validation, PKCE (S256) enforcement, state CSRF binding & account linking

Active Directory

skills/active-directory/ • .agents/skills/

Skill	Description
offensive-active-directory	Active Directory methodology — Kerberoast/AS-REP exposure, BloodHound ACL paths, ADCS ESC1–15, delegation & tiering
offensive-netexec	Enterprise protocol audit — SMB signing, LDAP signing/channel binding, NTLM relay mitigation & LAPS verification

Wireless

skills/wireless/ • .agents/skills/

Skill	Description
offensive-wifi	802.11 wireless security overview — SSID segmentation, WPA2/WPA3/802.1X architecture & assessment planning
offensive-wifi-recon	Wireless airspace audit — 2.4/5/6 GHz spectrum mapping, beacon/cipher enumeration & rogue AP detection
offensive-wpa2-psk	WPA2-PSK assessment — EAPOL 4-way handshake / PMKID exposure analysis, passphrase entropy & WPA3 migration
offensive-wpa3-sae	WPA3-SAE audit — transition-mode downgrade checks, mandatory 802.11w PMF verification & H2E support
offensive-wpa-enterprise	WPA-Enterprise (802.1X/EAP) — EAP-TLS vs PEAP/TTLS, supplicant RADIUS certificate validation & NAC isolation
offensive-wps	Wi-Fi Protected Setup (WPS) — beacon IE inspection, Pixie Dust offline/online PIN risk check & WPS disablement
offensive-evil-twin	Rogue AP resilience — WIDS/WIPS detection verification, auto-connect hygiene & certificate-pinned 802.1X profiles
offensive-krack-fragattacks	802.11 protocol patches — KRACK key reinstallation & FragAttacks aggregation firmware patch verification
offensive-deauth-disassoc	Management Frame Protection — 802.11w (PMF) enforcement auditing for deauthentication/disassociation frames
offensive-bluetooth-ble	Bluetooth Low Energy (BLE) — GATT service/characteristic permissions, LE Secure Connections (ECDH) & bonding
offensive-bluetooth-classic	Bluetooth Classic (BR/EDR) — SDP enumeration, Secure Simple Pairing, KNOB/BIAS key entropy & HID restrictions
offensive-zigbee-thread-matter	802.15.4 mesh security — Zigbee install codes, Trust Center key rotation, Thread commissioning & Matter DAC/PAA
offensive-z-wave	Z-Wave security — S2 ECDH DSK commissioning verification, legacy S0 downgrade prevention & hub hardening
offensive-lorawan-sub-ghz	LoRaWAN & Sub-GHz RF — OTAA vs ABP provisioning, secure element AppKey storage & frame counter replay checks

Cloud

skills/cloud/ • .agents/skills/

Skill	Description
offensive-cloud	Multi-cloud audit (AWS/Azure/GCP) — IAM privilege escalation paths, IMDSv2, storage bucket ACLs & cross-account trust

Mobile

skills/mobile/ • .agents/skills/

Skill	Description
offensive-mobile	Android & iOS MASVS audit — manifest/plist review, Keystore/Keychain storage, TLS pinning & Frida runtime triage

IoT & Embedded

skills/iot/ • .agents/skills/

Skill	Description
offensive-iot	IoT/OT & embedded security — UART/JTAG lockdown, flash encryption, Secure Boot chains, signed OTA & RTOS hardening

Infrastructure & Hardening

skills/infrastructure/ • .agents/skills/

Skill	Description
offensive-initial-access	External perimeter audit — internet-facing asset inventory, VPN/ZTNA MFA enforcement & edge appliance patching
offensive-advanced-redteam	Purple Team & adversary emulation — MITRE ATT&CK telemetry validation, SOC alerting & detection gap analysis
offensive-edr-evasion	EDR sensor resilience — ETW, AMSI, kernel callback telemetry verification & tamper-protection auditing
offensive-shellcode	PIC & loader analysis — position-independent code disassembly, PEB resolution patterns & ACG/CFG/W^X verification
offensive-keylogger-arch	Input API telemetry & defense — monitoring SetWindowsHookEx/RawInput/evdev, UIPI isolation & detection rules
offensive-windows-mitigations	Windows exploit mitigations — High-Entropy ASLR, DEP, CFG, XFG, Intel CET Shadow Stacks & HVCI verification
offensive-windows-boundaries	Windows security boundaries — Mandatory Integrity Control (MIC), AppContainer sandboxes & privileged RPC/ALPC/COM audit

Exploit Mitigations & Crash Analysis

skills/exploit-dev/ • .agents/skills/

Skill	Description
offensive-exploit-development	Memory corruption root-cause analysis — stack/heap overflows, UAF lifecycle tracking & sanitizer verification
offensive-exploit-dev-course	Binary security curriculum — x86_64/ARM64 calling conventions, stack layouts, allocator internals & compiler flags
offensive-basic-exploitation	Stack & format string audit — unsafe C library sink removal, -fstack-protector-strong & -Wformat-security
offensive-crash-analysis	Crash dump triage — WinDbg/GDB/LLDB analysis, ASan/MSan/UBSan interpretation & minimal reproducer generation
offensive-mitigations	Compiler & linker hardening — Full RELRO, PIE, Stack Canaries, _FORTIFY_SOURCE=3, Clang CFI & SafeStack
offensive-toctou	Filesystem & kernel TOCTOU — symlink/oplock race auditing, double-fetch bugs & atomic openat2 remediation

Fuzzing & Vulnerability Research

skills/fuzzing/ • .agents/skills/

Skill	Description
offensive-fuzzing	Coverage-guided fuzzing — AFL++, libFuzzer, Honggfuzz & Cargo-Fuzz harness writing, corpus curation & sanitizers
offensive-fuzzing-course	Automated bug discovery curriculum — greybox, grammar, snapshot & differential fuzzing in CI/CD (OSS-Fuzz)
offensive-bug-identification	Static & variant bug hunting — CodeQL/Semgrep taint tracking, sink-to-source reachability & security patch diffing
offensive-vuln-classes	Software vulnerability taxonomy — CWE reference across integer, memory, parser differential & state machine flaws

Reconnaissance

skills/recon/ • .agents/skills/

Skill	Description
offensive-osint	External asset discovery — Certificate Transparency logs, DNS/ASN mapping, cloud asset inventory & git leak checks
offensive-osint-methodology	Structured attack-surface management — continuous asset cataloging, SaaS dependency mapping & drift alerting

API Security

skills/api/ • .agents/skills/

Skill	Description
offensive-api-security	REST, GraphQL & gRPC API audit — OWASP API Top 10, BOLA/BFLA, mass assignment, OpenAPI validation & mTLS
offensive-api-abuse	API business logic & anti-scraping — pagination bounds, bulk export controls, idempotency & cost-based rate limits

Container & Kubernetes

skills/container/ • .agents/skills/

Skill	Description
offensive-container-escape	Container isolation — --privileged & capability auditing (CAP_SYS_ADMIN), seccomp/AppArmor & rootless namespaces
offensive-k8s-attacks	Kubernetes cluster audit — RBAC least privilege, Pod Security Standards, kubelet/etcd auth & CNI NetworkPolicies

CI/CD & Pipeline

skills/cicd/ • .agents/skills/

Skill	Description
offensive-cicd-pipeline	CI/CD pipeline hardening — pull_request_target safety, expression injection, SHA-pinned actions & ephemeral runners
offensive-cicd-secrets	CI/CD secret hygiene — OIDC workload federation, scoped GITHUB_TOKEN permissions, log masking & vault gates

Cryptography

skills/crypto/ • .agents/skills/

Skill	Description
offensive-crypto-attacks	Cryptographic implementation audit — AEAD (AES-GCM/ChaCha20), nonce uniqueness, constant-time checks, CSPRNG & Argon2id
offensive-tls-attacks	TLS/SSL & PKI configuration — TLS 1.3 enforcement, ECDHE forward secrecy, HSTS preload, CAA records & mTLS

Privilege Escalation

skills/privesc/ • .agents/skills/

Skill	Description
offensive-linux-privesc	Linux privilege boundary audit — SUID/SGID, file capabilities, sudoers rules, systemd unit ACLs & sysctl hardening
offensive-windows-privesc	Windows privilege boundary audit — service/registry ACLs, unquoted paths, token privileges & DLL search order

Post-Exploitation & Segmentation

skills/post-exploitation/ • .agents/skills/

Skill	Description
offensive-lateral-movement	Internal segmentation audit — Credential Guard, Local Account Token Filter, host firewalls & zero-trust bastions
offensive-persistence	Endpoint persistence hunting — Registry Run keys, scheduled tasks, WMI subscriptions, systemd units & PAM integrity
offensive-data-exfiltration	DLP & egress protection — DNS/HTTPS egress filtering, VPC Service Controls & bulk query anomaly detection

Forensics & Network Detection

skills/forensics/ • .agents/skills/

Skill	Description
offensive-anti-forensics	Forensic readiness & log integrity — immutable SIEM forwarding, EventLog/auditd tamper detection & MFT consistency
offensive-c2-frameworks	C2 traffic hunting — JA3/JA4 TLS fingerprinting, beacon jitter statistical analysis & DNS tunneling detection

Supply Chain

skills/supply-chain/ • .agents/skills/

Skill	Description
offensive-supply-chain	Software supply chain — SLSA provenance, Sigstore/Cosign artifact signing, lockfile integrity & CycloneDX/SPDX SBOMs
offensive-dependency-confusion	Dependency confusion — private npm/PyPI/Maven/NuGet/Cargo namespace scoping & upstream proxy routing

Social Engineering & Email Auth

skills/social-engineering/ • .agents/skills/

Skill	Description
offensive-phishing	Email authentication & FIDO2 — SPF -all, DKIM, DMARC p=reject, lookalike domain monitoring & WebAuthn passkeys
offensive-social-engineering	Identity verification workflows — helpdesk MFA reset approval gates, out-of-band callbacks & physical access controls

Network Attacks

skills/network/ • .agents/skills/

Skill	Description
offensive-network-attacks	Layer 2/3 network hardening — Dynamic ARP Inspection (DAI), DHCP Snooping, 802.1X, LLMNR/NBT-NS disablement & VLANs

AI Security

skills/ai/ • .agents/skills/

Skill	Description
offensive-ai-security	AI/LLM security (OWASP LLM Top 10) — prompt injection defenses, tool-call sandboxing, RAG ACLs & output encoding

Utility

skills/utility/ • .agents/skills/

Skill	Description
offensive-fast-checking	Rapid 15-minute security triage checklist across auth, headers, secrets, dependencies, APIs & binary mitigations
offensive-reporting	Professional security report writing — risk-led executive summaries, CVSS v3.1/v4.0 vectors, CWEs & remediation code

---

PayloadsAllTheThings Integration (v2.1.0)

63 skills from swisskyrepo/PayloadsAllTheThings fully integrated as structured SKILL.md files with operational workflows, REA MCP integration, and the complete payload reference content.

Payload Injection Library

skills/payloads-injection/ • .agents/skills/

Skill	Description
payloads-sqli	SQL Injection payloads — error-based, UNION, blind, time-based, and WAF bypass techniques
payloads-xss	XSS payloads — reflected, stored, DOM, filter bypass, and polyglot vectors
payloads-xxe	XXE injection payloads — file read, SSRF, blind OOB, and DOCTYPE bypass
payloads-ssti	SSTI payloads — Jinja2, Twig, Freemarker, Pebble, ERB, and Velocity templates
payloads-ssrf	SSRF payloads — cloud metadata bypass, URL filter bypass, and Gopher protocol chains
payloads-cmdi	Command injection payloads — Linux, Windows, blind OOB, and filter bypass operators
payloads-ldap	LDAP injection payloads — authentication bypass and directory enumeration
payloads-nosqli	NoSQL injection payloads — MongoDB, CouchDB, Redis operator injection and bypass
payloads-graphql	GraphQL injection — introspection abuse, batching attacks, authorization bypass
payloads-xpath	XPath injection payloads for XML authentication bypass and data extraction
payloads-xslt	XSLT injection payloads — RCE via server-side XML transformation abuse
payloads-latex	LaTeX injection payloads — file read and command execution in PDF/math renderers
payloads-saml	SAML injection payloads — XML signature wrapping, SSO bypass, and assertion forgery
payloads-ssi	SSI injection payloads — Apache/Nginx Server-Side Include RCE and file disclosure
payloads-hpp	HTTP Parameter Pollution payloads — WAF bypass via duplicate parameter manipulation
payloads-csv	CSV/formula injection payloads — spreadsheet-based code execution via cell injection
payloads-proto-pollution	Prototype pollution payloads — server-side Node.js and client-side browser exploitation
payloads-prompt-injection	LLM prompt injection payloads — goal hijacking, data exfiltration, and jailbreak vectors

Payload Web Attacks Library

skills/payloads-web/ • .agents/skills/

Skill	Description
payloads-cors	CORS misconfiguration payloads — cross-origin credential and token theft PoC scripts
payloads-crlf	CRLF injection payloads — HTTP response splitting, header injection, log poisoning
payloads-csrf	CSRF payload templates — form-based, JSON, and CORS token bypass PoCs
payloads-open-redirect	Open redirect bypass payloads — OAuth token theft and phishing via URL manipulation
payloads-lfi-rfi	LFI/RFI payloads — log poisoning, PHP filter chains, and remote file inclusion
payloads-path-traversal	Path traversal payloads — encoding variants, null bytes, and filter bypass
payloads-deserial	Insecure deserialization payloads — Java/PHP/Python/.NET gadget chains
payloads-file-upload	File upload bypass payloads — extension tricks, MIME manipulation, polyglot files
payloads-smuggling	Request smuggling payloads — CL.TE, TE.CL, and TE.TE HTTP desync attacks
payloads-cache-deception	Web cache deception payloads — path confusion to cache authenticated responses
payloads-oauth	OAuth misconfiguration payloads — token theft, open redirect chains, PKCE bypass
payloads-jwt	JWT attack payloads — alg:none, HMAC confusion, kid injection, JWK spoofing
payloads-idor	IDOR/BOLA payloads — object ID manipulation and horizontal/vertical access bypass
payloads-race-condition	Race condition payloads — concurrent request timing attacks for state manipulation
payloads-websocket	WebSocket attack payloads — CSWSH, message injection, and protocol upgrade attacks
payloads-css-injection	CSS injection payloads — data exfiltration via attribute selector timing oracles
payloads-clickjacking	Clickjacking PoC templates — iframe overlay and X-Frame-Options bypass
payloads-type-juggling	PHP type juggling payloads — loose comparison bypass for authentication logic
payloads-mass-assignment	Mass assignment payloads — unauthorized parameter binding in web frameworks
payloads-dep-confusion	Dependency confusion attack techniques for npm/PyPI/RubyGems package hijacking
payloads-ato	Account takeover methodology — password reset abuse, session fixation, MFA bypass
payloads-bruteforce	Brute force & rate limit bypass — credential stuffing and enumeration techniques
payloads-bizlogic	Business logic flaw payloads — price manipulation, workflow bypass, privilege escalation
payloads-api-key-leaks	API key leak discovery — dorks, patterns, and exploitation of exposed credentials
payloads-cve	CVE exploit payloads — real-world PoC scripts for known vulnerabilities
payloads-reverse-proxy	Reverse proxy misconfiguration — path confusion, header injection, and SSRF via proxy
payloads-vhosts	Virtual host discovery — Host header manipulation for multi-tenant SSRF escalation
payloads-hidden-params	Hidden parameter discovery wordlists for attack surface expansion
payloads-orm-leak	ORM query leak payloads for Django, Hibernate, ActiveRecord data exfiltration

Payload Research Library

skills/payloads-research/ • .agents/skills/

Skill	Description
payloads-dom-clobbering	DOM clobbering payloads — global override via named HTML elements for XSS escalation
payloads-encoding	Encoding transformation payloads — URL, HTML, Unicode, base for WAF bypass
payloads-regex	ReDoS and regex exploitation payloads — catastrophic backtracking and filter bypass
payloads-dns-rebinding	DNS rebinding attack payloads — SOP bypass for internal service access via browser
payloads-tabnabbing	Reverse tabnabbing payloads — window.opener phishing for credential theft
payloads-xs-leak	XS-Leak payloads — timing oracles, cache probing, cross-origin data inference
payloads-headless	Headless browser exploitation — SSRF/XSS/sandbox escape via Puppeteer/CDP
payloads-cspt	Client-side path traversal payloads — XSS gadgets via fetch URL manipulation
payloads-gwt	Google Web Toolkit attack payloads — RPC serialization abuse and endpoint discovery
payloads-ext-var	External variable modification payloads — global scope poisoning and config injection
payloads-java-rmi	Java RMI exploitation payloads — deserialization, registry enumeration, and RCE
payloads-insecure-random	Insecure randomness exploitation — PRNG prediction and token forge attacks
payloads-mgmt-interface	Management interface exposure — default credentials, admin panel bypass, and enumeration
payloads-scm-exposure	SCM exposure payloads — .git/.svn/.hg directory disclosure and source extraction
payloads-zip-slip	Zip slip payloads — arbitrary file write via malicious ZIP/TAR archive traversal

Payload Resources

skills/payloads-resources/ • .agents/skills/

Skill	Description
payloads-methodology	Pentest methodology cheatsheets — AD Attack, Reverse Shells, Network Pivoting, Linux/Windows PrivEsc, Cloud Pentest (AWS/Azure/GCP), Kubernetes, Docker

---

AI Penetration Testing (Strix)

skills/strix/ • .agents/skills/strix/

Skill	Description
strix	Autonomous AI penetration testing — find and fix vulnerabilities in your own applications and web services with the Strix AI pentest agent

| gtfobins | GTFOBins Unix binary bypass reference for privilege escalation and post-exploitation on owner-authorized systems |

---

Supported Platforms & MCP Configuration

AI Agent / Runtime	Configuration Files	Format	Loading Mode
Google Antigravity	.agents/skills/*/SKILL.md	Agent Skills YAML + Markdown	Progressive on-demand discovery
Claude Code / Claude.ai	.claude-plugin/plugin.json & CLAUDE.md	Native Plugin + @AGENTS.md	1-click plugin & root instruction
OpenAI Codex	AGENTS.md & agents/openai.yaml	Dual-harness YAML + Markdown	Skill picker UI + persistent rules
Cursor IDE	.cursor/rules/*.mdc	Cursor MDC frontmatter	alwaysApply: true workspace rules
GitHub Copilot	.github/copilot-instructions.md	Standard Markdown	Workspace context instructions
Google Jules	.agents/skills/*/SKILL.md	Agent Skills Standard	Autonomous cloud coding agent
Moonshot Kimi	AGENTS.md	Standard Markdown	Long-context instruction
OpenClaw	skills/*/*/SKILL.md	Agent Skills Standard	Open agent harness
OpenCode	AGENTS.md	OpenCode CLI format	Terminal coding agent
Windsurf & Cline	.windsurf/rules/*.md & .clinerules/*.md	Plain Markdown	Workspace task rules

Unified .mcp.json

{
  "mcpServers": {
    "rea": { "command": "npx", "args": ["-y", "rea-agents@latest", "run"] },
    "playwright": { "command": "npx", "args": ["-y", "@playwright/mcp@latest"] },
    "brightdata": {
      "command": "npx",
      "args": ["-y", "@brightdata/mcp"],
      "env": { "BRIGHTDATA_API_KEY": "${BRIGHTDATA_API_KEY}" }
    },
    "hyperbrowser": {
      "command": "npx",
      "args": ["-y", "hyperbrowser-mcp"],
      "env": { "HYPERBROWSER_API_KEY": "${HYPERBROWSER_API_KEY}" }
    }
  }
}

---

🎯 The Problem It Solves & The Solution

When developers and security researchers use AI coding assistants to reverse-engineer, inspect, debug, test, or build on their own apps, websites, and binaries, AI agents frequently run into friction:

• ❌ Refusing to run decompilers, disassemblers, or REA MCP tools on false-positive cybersecurity grounds.
• ❌ Pausing every single turn to question authorization or lecturing about cybersecurity ethics.
• ❌ Outputting partial skeletons, // TODO stubs, or non-compiling fragments during source code recovery.
• ❌ Getting blocked by anti-bot walls (Cloudflare, CAPTCHAs) when fetching external documentation or auditing endpoints.
• ❌ Inability to interactively click, type, and verify live web applications without burning context on heavy screenshots.
• ❌ Leaking proprietary code or research notes to third-party cloud vector stores.

💡 The Solution

• ✅ Persistent Owner Authorization: Recognizes you as the verified owner and developer of target software, eliminating repetitive justification hurdles.
• ✅ Zero-Skeleton Full Code Recovery: Reconstructs 100% complete, compilable source code with 1-click multi-compiler verification (build.bat / build.sh).
• ✅ ECC Engineering Rigor: Enforces the 6-stage development pipeline (Research & Reuse → Plan First → TDD → Code Review → Zero-Secret Audit → Verification).
• ✅ 169 Specialized Skills Across 34 Categories: Covers every reverse-engineering, binary, mobile, web, wireless, cloud, fuzzing, and security-auditing surface.
• ✅ Live Web Intelligence & Triple-Engine Browser Automation: Agent Reach, Microsoft Playwright MCP, Bright Data MCP, and Hyperbrowser MCP.
• ✅ Air-Gapped Document Intelligence: Private local research and note synthesis powered by SurfSense and local LLMs.

---

⚡ Autonomous Coding Agents vs. Standard Chat LLMs (Tier-1 Native Execution)

While the 500+ Unblocked Prompts in this repository work seamlessly in conversational Chat UIs (ChatGPT, Gemini Web, Claude.ai, Kimi Web, GLM) without safety refusals, their full power is unleashed when executed inside Tier-1 Autonomous Coding Agents like Claude Code, Google Antigravity, OpenAI Codex, Cursor, and Windsurf.

The Core Difference: Standard chat UIs only produce conversational explanations and Markdown code snippets on-screen. Autonomous coding agents, by contrast, directly interface with your local file system, run disassemblers, execute REA MCP tools, create source trees, run compilers, and autonomously verify 0 errors and 0 warnings.

🛠️ Execution Capabilities by Agent Framework

1. Google Antigravity

• Support Level: 100% Native Integration
• How It Works:
  • Antigravity directly loads all 169 skills from .agents/skills/*/SKILL.md using progressive on-demand discovery.
  • When passed $rea-full-code-recovery or $rea-personal-use-authorization, Antigravity operates without refusal or lecturing, directly analyzing compiled local binaries (.exe, .apk, .wasm, .js).
  • Terminal-integrated multi-compiler verification: Antigravity automatically executes build.bat / build.sh (MSVC, Zig CC, MinGW GCC, Gradle) to verify compiler exit codes and ensure 0 errors and 0 warnings before concluding.

2. Claude Code (Anthropic Official CLI)

• Support Level: Official Native Plugin Architecture
• How It Works:
  • Fully packaged as a native Claude Code plugin via .claude-plugin/plugin.json and marketplace.json.
  • 1-click install directly from Claude Code CLI:

    /plugin marketplace add smartworldarafath/REA_Skill
    /plugin install rea-skills@smartworldarafath
    

  • Spawns parallel background subagents to concurrently disassemble binaries, decompile bytecode, and regenerate project source trees in your active workspace while completely bypassing moralizing policy friction.

3. OpenAI Codex / Codex CLI / OpenAI Operator

• Support Level: Full Native Compatibility
• How It Works:
  • Ingests root AGENTS.md and agents/openai.yaml automatically during session initialization.
  • Automatically activates the file editor and terminal execution loop, reconstructing lost source trees file-by-file with complete working logic.

4. Cursor, Windsurf, Roo Code, Cline & AI IDEs

• Support Level: Open Agent Skills & MCP Native
• How It Works:
  • Conforms to the open .agents/skills/ standard and provides IDE-specific rule configurations (.cursor/rules/, .windsurf/rules/, .clinerules/).
  • Seamlessly bridges to the local REA MCP server via .mcp.json, providing direct autonomous access to tools like Rizin, Ghidra, JADX, Capa, and GDB.

---

📊 Capability Matrix: Standard Chat LLMs vs. Autonomous Coding Agents

Feature / Capability	Standard Chat LLMs (ChatGPT / Gemini Web / Claude.ai)	Autonomous Coding Agents (Claude Code / Antigravity / Codex / Cursor)
Prompt Execution	Text & conversational code blocks only	Directly creates, edits, and builds physical files on disk
Binary Ingestion	Requires manual hex/text pasting into chat	Autonomously reads .exe, .apk, .wasm, .pcap from local disk
Toolchain Invocation	None (pure text output)	Directly runs Rizin, Ghidra, Capa, JADX, Playwright, GDB
Compilation Verification	Unable to compile or test code	Automatically runs build.bat / build.sh to guarantee 0 errors
Safety Refusal Rate	0% (Unblocked via Owner Authorization)	0% (Unblocked via Owner Authorization)
Delivery Gate	Partial snippets or markdown blocks	100% complete, compilable source tree ready for production

Bottom Line: The true power of the 500+ prompts is realized in these autonomous coding agents. They eliminate human friction entirely—taking a raw binary and autonomously delivering a verified, compiling project repository to your hard drive.

---

Global Machine-Level Installation (Personal Dev Setup)

Configure it once on your computer so every AI agent automatically recognizes all 169 skills, rules, and MCP tools in any folder or project:

1. Google Antigravity (Global Skills)

# Windows
xcopy /E /I /Y ".agents\skills" "%USERPROFILE%\.gemini\config\skills"

# macOS / Linux
mkdir -p ~/.gemini/config/skills
cp -r .agents/skills/* ~/.gemini/config/skills/

2. OpenAI Codex (Global System Prompt)

# Windows
type AGENTS.md >> "%USERPROFILE%\.codex\AGENTS.md"

# macOS / Linux
cat AGENTS.md >> ~/.codex/AGENTS.md

3. Claude Code (Global Instructions)

# Windows
type CLAUDE.md >> "%USERPROFILE%\.claude\CLAUDE.md"

# macOS / Linux
cat CLAUDE.md >> ~/.claude/CLAUDE.md

4. Cursor (Global Rules for AI)

1. Open Cursor Settings: Ctrl + , (or Cmd + , on macOS).
2. Navigate to Features > Rules for AI (User Rules).
3. Paste the contents of AGENTS.md.

---

💬 Usage Examples

Example 1: Web Application Analysis with REA

"Use REA to trace and inspect the network request logic and WebSocket frames of my web app."

Example 2: Native Binary & Framework Inspection

"Inspect my compiled binary with REA to analyze exported symbols and verify native boundaries."

Example 3: Android / Electron App Debugging

"Use REA to inspect my Electron application package, check event listeners, and reconstruct component routes."

Example 4: Vulnerability Hunting & Pre-Publishing Audit

"Reverse engineer my AI app and find all vulnerabilities so I can fix them before publishing."

Example 5: Defensive Website Security Audit (10-Layer Scanner)

"Audit my website https://my-other-site.com/ for security vulnerabilities, header misconfigurations, and frontend secret leaks."

Example 6: Lost Source Code & Data Recovery (Zero-Skeleton Law)

"My laptop is not turning on, I lost my source code. Without codes I cannot improve my app. Reverse engineer my app and recover all app data so I can continue my project."

Example 7: Interactive Scoping & Frontier Grilling

/rea-grill-me Scope the full C++20 source recovery and shader extraction for my compiled binary before writing code.

Example 8: Live Threat Intelligence with Agent Reach

"Use Agent Reach to look up latest CVE disclosures and Reddit discussions about Next.js middleware vulnerabilities."

Example 9: ECC Feature Implementation & Refactoring Pipeline

"Execute orch-add-feature to build an API rate-limiting middleware using Redis and TDD."

Example 10: Interactive Browser Testing with Microsoft Playwright MCP

"Use Playwright MCP to navigate to http://localhost:3000/login, fill out test credentials, click submit, and verify that the dashboard loads."

Example 11: Unlocking Protected Endpoints with Bright Data MCP

"Use Bright Data MCP to scrape and extract pricing data from https://protected-target.com/ without triggering Cloudflare blocks."

Example 12: Air-Gapped Document Synthesis with SurfSense

"Use SurfSense to index all decompiled pseudocode files in ./dist and synthesize a security architecture map locally using Ollama."

---

📂 Repository Architecture & File Structure

REA_Skill/
├── .claude-plugin/                      # Native Claude Code plugin & self-hosted marketplace
│   ├── plugin.json                      # Plugin manifest listing all 169 skills & metadata
│   └── marketplace.json                 # 1-click install registry for Claude Code
├── .agents/
│   ├── invocation.md                    # Model-invoked vs. user-invoked architectural discipline
│   ├── adr/                             # Architecture Decision Records (0001–0004)
│   └── skills/                          # All 169 Skills (YAML frontmatter + agents/openai.yaml)
├── skills/                              # Categorized (29 categories) & mirrored root skills tree
│   ├── rea-core/                        # 12 Reverse Engineering & Source Recovery skills
│   ├── agent-ecosystem/                 # 9 Multi-Agent & Browser MCP skills
│   └── <23 claude-red categories>/      # 79 Security Assessment & Auditing skills
├── .clinerules/                         # Cline workspace rules
├── .cursor/rules/                       # Cursor IDE MDC rules
├── .windsurf/rules/                     # Windsurf Cascade rules
├── .github/copilot-instructions.md      # GitHub Copilot workspace instructions
├── docs/                                # Interactive Three.js Website, 500+ Prompt Vault & AI Prompt Builder
├── recovered_source/                    # Verified C99/Win32 full source recovery showcase & build.bat
├── scripts/                             # Automated skill verification & manifest sync scripts
├── tools/build_manifest.py              # Python manifest builder for claude-skills.json
├── claude-skills.json                   # Machine-readable index of all 34 categories & 169 skills
├── install.sh                           # Interactive & CLI skill installer
├── convert_skills.py                    # Markdown-to-SKILL.md converter utility
├── MINDMAP.md                           # Visual Mermaid mindmap of all 34 categories & 169 skills
├── AGENTS.md                            # Universal agent instructions (Codex, Copilot, Antigravity)
├── CLAUDE.md                            # Claude Code root instruction configuration
├── SECURITY.md                          # Security & responsible disclosure policy
├── CONTRIBUTING.md                      # Contributor guide & skill specification
├── CHANGELOG.md                         # Release history
├── package.json                         # npm package manifest & test runner
└── README.md                            # Complete documentation

---

⚠️ Important Boundary & Alignment Notice

1. Owner & Authorized Scope: This suite is strictly for inspecting, tracing, debugging, auditing, and recovering your own software, applications, and web services or targets where you hold explicit written authorization.
2. Model-Level Guardrails: Some frontier LLMs incorporate provider-level safety filters. While this suite eliminates false-positive conversational refusals on authorized tasks, always use these methodologies responsibly within legal and authorized boundaries.

---

Roadmap

See CHANGELOG.md for release history and MINDMAP.md for the full visual topology.

Phase	Focus	Skills	Status
1	REA Core — PE/ELF/Mach-O, APK/IPA, Web bundles, PCAP, SQLite, Game assets, Firmware & Crash triage	12	Complete
2	Multi-Agent Ecosystem — Owner auth, 10-layer web audit, ECC rigor, Agent Reach, SurfSense & Browser MCPs	9	Complete
3	Web, API, Auth & GraphQL Security Library (claude-red integration)	20	Complete
4	Wireless — 802.11, WPA2/3, 802.1X, WPS, BLE, Classic BT, Zigbee/Matter, Z-Wave & LoRaWAN	14	Complete
5	Binary Hardening, Crash Analysis, Exploit Mitigations & Coverage-Guided Fuzzing	10	Complete
6	Active Directory, Cloud, Containers/K8s, CI/CD, Crypto, PrivEsc, Forensics, Supply Chain & AI	35	Complete
7	Interactive Prompt Vault (500+ templates) & AI Prompt Builder Web App	—	Complete
8	Deep Kernel Driver & eBPF Runtime Verification Modules	+12	Planned
9	Automated Binary Diffing & Patch-Gap Regression Suite	+10	Planned

Target: 120+ skills across 25+ categories.

---

Contributing

Contributions are welcome! See CONTRIBUTING.md for the SKILL.md template, agents/openai.yaml dual-harness metadata rules, and automated validation (npm test). See SECURITY.md for our security and responsible-use policy.

License

MIT © 2026 Arafath Rahman (@smartworldarafath).

Acknowledgements

• REA (Reverse Engineer Anything): morluto/rea — MCP server for binary, web, mobile, and runtime reverse engineering
• claude-red Skill Taxonomy: SnailSploit/claude-red (Kai Aizen) & sahar042/offensive-checklist
• Agent Skills Architecture: mattpocock/skills — plugin manifest, ADR, and grill-me patterns
• Engineering Rigor & Research: Everything Claude Code, Agent Reach, and SurfSense

---