Update to reverse engineering anything

{
  "description": "Interpret REA results and prepare a reviewable report that separates observations, inferences, unknowns, and coverage limits; use for analysis summaries, feature traces, comparisons, and handoffs.",
  "included_files": [],
  "name": "rea-evidence-and-reporting",
  "skill_md_contents": "---\nname: rea-evidence-and-reporting\ndescription: Interpret REA results and prepare a reviewable report that separates observations, inferences, unknowns, and coverage limits; use for analysis summaries, feature traces, comparisons, and handoffs.\n---\n\n# Evidence and reporting\n\n## Evidence ledger\n\nFor each conclusion, record the claim; actual evidence ID(s) and source/artifact/version; whether it is direct observation, inference, or unknown; confidence and why; coverage boundary, failed/unsupported routes, and relevant environment; and the narrowest next check if uncertain.\n\nRetain inline Evidence when no durable reference exists. Use stable same-session references when available. Do not invent evidence IDs, cite omitted details, or refer to evidence from another session without proof.\n\n## Interpretation rules\n\n- A string, symbol, import, filename, route, decompiled fragment, or graph edge can suggest a hypothesis; alone it does not prove behavior.\n- Static analysis describes the inspected artifact and analysis coverage. It does not show that a code path executed.\n- Runtime observation supports only the observed target, state, environment, and interval; it does not establish universal behavior.\n- A difference between versions may come from build/configuration or incomplete coverage. Attribute it only when evidence identifies the cause.\n- Preserve raw addresses, offsets, selectors, and original carrier details where relevant. Keep inferred values labeled as candidates.\n- “Not found” means not found within the stated search boundary, not absent everywhere.\n\n## Suggested report\n\n### Answer\nOne sentence with confidence and scope.\n\n### Evidence\nBullets keyed by actual Evidence IDs, with what each result directly establishes.\n\n### Interpretation\nClearly labeled inferences and alternatives.\n\n### Limits and unknowns\nProvider/tool limitations, target/version/environment, unsearched regions, and missing runtime confirmation.\n\n### Next step\nOne minimal follow-up tied to an unresolved checklist item.\n\nFor evidence bundles, write only to a user-selected path. Before sharing a report externally, remove credentials, private binary paths, proprietary artifacts, personal data, and unrelated local details.\n"
}