[GH-ISSUE #43] Create reusable reverse-engineering skill packs and investigation playbooks

bsakaguchi commented

2026-10-15 18:20:14 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/43

Goal

Teach agents how to combine REA capabilities into safe, bounded investigations instead of exposing an undifferentiated tool catalog.

Initial skill packs

native binary triage
application bundle and installer inventory
browser and web feature tracing
desktop client protocol reconstruction
mobile application analysis
managed-runtime and bytecode analysis
malware triage in an isolated environment
version comparison and regression localization
compatibility reconstruction
residual-unknowns review and next-probe selection

Each skill defines

intended questions and prerequisites
scope and authorization checks
provider and capability requirements
a staged workflow with budgets and stopping conditions
evidence and confidence requirements
side effects and approval gates
failure recovery and alternative providers
expected artifacts and report schema
explicit residual unknowns

Requirements

Skills call semantic capabilities, not hard-coded provider commands.
Capability discovery selects valid variants for the current host.
Installed skills support versioning, upgrade, readback, and drift detection.
Skills are fixture-tested against their documented output and safety behavior.
Domain-specific skills may compose shared lower-level skills.

Acceptance criteria

A new agent can select an appropriate playbook from the investigation goal and available providers.
The same skill can degrade honestly across macOS, Linux, and Windows.
Every conclusion cites evidence; every unsupported branch remains visible.
Skill installation and upgrades are verified by package tests.

Roadmap expansion

Add fixture-tested playbooks for deterministic process capture (#57–#62), browser/Electron differential capture (#63–#65), historical-source comparison (#66–#68), native runtime correlation (#71), and residual-unknown review (#73). Each skill declares evidence authority, environment prerequisites, approval gates, budgets, stopping conditions, alternatives, and unsupported branches.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/43 ## Goal Teach agents how to combine REA capabilities into safe, bounded investigations instead of exposing an undifferentiated tool catalog. ## Initial skill packs - native binary triage - application bundle and installer inventory - browser and web feature tracing - desktop client protocol reconstruction - mobile application analysis - managed-runtime and bytecode analysis - malware triage in an isolated environment - version comparison and regression localization - compatibility reconstruction - residual-unknowns review and next-probe selection ## Each skill defines - intended questions and prerequisites - scope and authorization checks - provider and capability requirements - a staged workflow with budgets and stopping conditions - evidence and confidence requirements - side effects and approval gates - failure recovery and alternative providers - expected artifacts and report schema - explicit residual unknowns ## Requirements - Skills call semantic capabilities, not hard-coded provider commands. - Capability discovery selects valid variants for the current host. - Installed skills support versioning, upgrade, readback, and drift detection. - Skills are fixture-tested against their documented output and safety behavior. - Domain-specific skills may compose shared lower-level skills. ## Acceptance criteria - A new agent can select an appropriate playbook from the investigation goal and available providers. - The same skill can degrade honestly across macOS, Linux, and Windows. - Every conclusion cites evidence; every unsupported branch remains visible. - Skill installation and upgrades are verified by package tests. ## Roadmap expansion Add fixture-tested playbooks for deterministic process capture (#57–#62), browser/Electron differential capture (#63–#65), historical-source comparison (#66–#68), native runtime correlation (#71), and residual-unknown review (#73). Each skill declares evidence authority, environment prerequisites, approval gates, budgets, stopping conditions, alternatives, and unsupported branches.

bsakaguchi

2026-10-15 18:20:14 +00:00

closed this issue
added the
P1: high

roadmap

documentation

enhancement
labels

bsakaguchi commented

2026-10-15 18:20:15 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

REA now ships one installed, versioned, drift-checked reverse-engineering skill with package verification. The remaining issue scope is the enumerated fixture-tested playbook catalog, host-degrading variants, and explicit per-playbook outputs; reuse the existing skill installation and metadata machinery.

@morluto commented on GitHub (Jul 17, 2026): REA now ships one installed, versioned, drift-checked reverse-engineering skill with package verification. The remaining issue scope is the enumerated fixture-tested playbook catalog, host-degrading variants, and explicit per-playbook outputs; reuse the existing skill installation and metadata machinery.

bsakaguchi commented

2026-10-15 18:20:16 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#368
#369

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #368 - [ ] #369 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi commented

2026-10-15 18:20:16 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Closing as out of scope / premature for the current local CLI/MCP reverse-engineering focus. No concrete implementation exists yet, and the work overlaps with existing passive browser/Electron observation, process capture, and skill machinery. Can be reopened when a specific runtime observation use case is ready.

@morluto commented on GitHub (Jul 20, 2026): Closing as out of scope / premature for the current local CLI/MCP reverse-engineering focus. No concrete implementation exists yet, and the work overlaps with existing passive browser/Electron observation, process capture, and skill machinery. Can be reopened when a specific runtime observation use case is ready.

Rows
Columns

[GH-ISSUE #43] Create reusable reverse-engineering skill packs and investigation playbooks #32

Goal

Initial skill packs

Each skill defines

Requirements

Acceptance criteria

Roadmap expansion