JoasASantos/REA-Prompts

The problem

Getting an AI coding agent to explain an unfamiliar binary or app usually produces confident prose with nothing behind it: no addresses, no functions, no way to tell confirmed behavior from the model's guesswork. Reverse engineering with an agent is a series of prompts, and the quality of the answer depends entirely on how the question is phrased. REAP is a curated library of those prompts, written for REA, a toolset that lets an agent inspect native binaries, firmware, kernels, APKs, Electron apps and games.

What's different

An unassisted agent given "explain how this app works" wanders. REAP's prompts enforce a structure: name the entry point, cite the file and address, separate facts from inferences from unknowns, and keep the session to one feature. Some prompts require the agent to build a minimal runnable reproduction of a recovered rule and check it against the original. The collection is organized by target type (binary, game, firmware, Android, kernel) rather than by feature, so you paste the prompt that matches what you are looking at. It is prompt content, not tooling: REA itself lives at rea.tools and is installed separately via npx rea-agents@latest setup.

Who it's for

Developers and security researchers already using, or willing to install, REA in an agent such as Claude Code or a similar coding agent, who want reproducible structure in their investigations. It suits CTF players, people doing interoperability or clean-room clone work, and analysts triaging an executable quickly. It is not for anyone without an agent and REA connected, and not for people looking for automated analysis: every prompt needs a real agent session and human judgement. Anyone whose goal is circumventing protection on software they don't own should read the README's disclaimer and stay away.

Cost of adoption

You need an AI coding agent and REA installed and connected; the prompts do nothing on their own. Prompts are static text, so the ongoing cost is token spend and time per investigation, and quality depends on the agent and REA's analysis engines. The repo is four days old, has no declared license, and the README relies heavily on external links, so treat it as a loosely maintained list rather than a supported product. Sensitive prompts (anti-cheat, DRM, kernel, vulnerability research) carry legal and terms-of-service risk; the README limits them to authorized testing, but nothing enforces that.

Verdict

REAP is a thin but useful artifact: a prompt library riding the attention around REA rather than a project with its own engineering. The star count tells the story: about 2,050 stars and 345 forks within four days of creation, roughly 400 a day, which is a launch spike, not demonstrated staying power. If you are already paying for an agent session and REA, the prompts are free to skim and a few of the evidence-discipline conventions are worth stealing regardless of the tool. If you are not, this is not the reason to adopt either. No license means no guarantee you can reuse the text in your own work.