Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Reverse-engineer a product into a mechanically verifiable feature inventory + registry + spec set, with optional security-audit artifacts and validation gates.
Hard Guardrails (MANDATORY)
Only operate on code/binaries you own or have explicit written authorization to analyze.
Do not provide steps to bypass protections/ToS or to extract proprietary source code/system prompts from third-party products.
Do not output reconstructed proprietary source or embedded prompts from binaries (index only; redact in reports).
Redact secrets/tokens/keys if encountered; run the secret-scan gate over outputs.
Always separate: docs say vs code proves vs hosted/control-plane.
If you do not have explicit written authorization to analyze that binary, do not run the above. Use the included demo fixture instead (see Self-Test below).
--sbom (generate SBOM + dependency risk report where possible; may no-op with a note)
--fuzz (only if a safe harness exists; timeboxed)
Mandatory guardrail flag:
--authorized (required for binary mode; refuses to run binary analysis without it)
Upstream Ref Pinning (--upstream-ref)
Use --upstream-ref to pin a repo-mode clone to a specific commit, tag, or branch. This makes analysis reproducible and allows golden fixtures to be diffed against a known baseline.
# Pin to a tag (reproducible)
python3 skills/reverse-engineer-rpi/scripts/reverse_engineer_rpi.py cc-sdd \
--mode=repo \
--upstream-repo="https://github.com/gotalab/cc-sdd.git" \
--upstream-ref=v1.0.0 \
--output-dir=".agents/research/cc-sdd/"# Pin to a specific commit SHA
python3 skills/reverse-engineer-rpi/scripts/reverse_engineer_rpi.py cc-sdd \
--mode=repo \
--upstream-repo="https://github.com/gotalab/cc-sdd.git" \
--upstream-ref=abc1234 \
--output-dir=".agents/research/cc-sdd/"
When --upstream-ref is provided:
The clone is fetched with git fetch --depth=1 origin <ref> and checked out to FETCH_HEAD.
The resolved commit SHA is recorded in output_dir/clone-metadata.json for traceability.
Without --upstream-ref, a --depth=1 shallow clone of the default branch HEAD is used instead.
Repo-mode analysis writes machine-checkable contract files under output_dir/. These files use only relative paths, sorted lists, and stable keys — no absolute paths, no run-specific timestamps — so they can be committed as golden fixtures and diffed across runs.
Primary contract files:
File
Description
feature-registry.yaml
Structured feature inventory with mechanically-extracted CLI, config/env, and artifact surface
cli-surface-contracts.txt
CLI surface: commands, flags, help text, framework, language
docs-features.txt
Features extracted from documentation (docs say vs code proves)
clone-metadata.json
Upstream repo URL, pinned ref, resolved commit SHA, clone date
Note: Contract outputs are written by --mode=repo (or --mode=both). Binary-mode outputs (binary-analysis.md, binary-symbols.txt, etc.) remain directly under output_dir/.
Fixture Test Workflow
Golden fixtures allow regression detection: commit a known-good fixture snapshot (contract files alongside the pinned clone-metadata.json), then diff future runs against it.
in security mode: validate-security-audit.sh exits 0 and secret scan passes
Examples
Scenario: Reverse-Engineer an Open-Source CLI in Repo Mode
User says:/reverse-engineer-rpi cc-sdd --mode=repo --upstream-repo="https://github.com/gotalab/cc-sdd.git" --upstream-ref=v1.0.0
What happens:
The script shallow-clones the upstream repo at the pinned tag v1.0.0 and records the resolved SHA in clone-metadata.json.
It scans the repo for CLI entry points, config/env surface, schema files, and artifact manifests, then writes feature-inventory.md, feature-registry.yaml, contract JSON, and all spec files under the output directory.
Result: A complete feature catalog and machine-checkable feature-registry.yaml are generated under .agents/research/cc-sdd/, ready for golden-fixture diffing.
Scenario: Binary Analysis With Security Audit
User says:/reverse-engineer-rpi ao --authorized --mode=binary --binary-path="$(command -v ao)" --security-audit
What happens:
The script runs static analysis on the ao binary (file metadata, linked libraries, embedded archive signatures) and writes binary-analysis.md and binary-embedded-archives.md.
It generates the full security audit suite (threat-model.md, attack-surface.md, findings.md, etc.) under output_dir/security/ and runs the secret-scan gate over all outputs.
Result: Binary analysis artifacts plus a validated security audit are produced; validate-security-audit.sh exits 0 confirming all security deliverables are present and secrets-clean.
Troubleshooting
Problem
Cause
Solution
Script refuses to run binary analysis
Missing --authorized flag
Add --authorized to confirm you have explicit written authorization to analyze the binary.
clone-metadata.json not generated
--upstream-repo was not provided
Pass --upstream-repo (and optionally --upstream-ref) to enable clone metadata tracking.
Fixture test diff fails unexpectedly
Upstream repo changed or golden fixtures are stale
Re-run with the pinned ref, copy fresh contracts into fixtures/, and commit the updated golden files (see Updating Fixtures).
spec-cli-surface.md not generated
No recognized CLI framework (Node/Python/Go) detected in the repo
Check that the target repo has a discoverable CLI entry point; otherwise the CLI surface is documented in spec-code-map.md instead.
Network error during repo clone
Firewall, VPN, or GitHub rate limit blocking the shallow clone
Verify network connectivity, authenticate with gh auth login if the repo is private, or use --local-clone-dir to point at a pre-cloned directory.