{"id":53902,"plugin_id":"plugins_6ac8b172444881918616085e96cb73e3","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-10-24T13:55:18.747Z","digest":"3ac22d052b5ae6b0d7e5496336ca06e0a3f01d48ad2891df78011ab162fdbe3c","against":null,"payload":{"description":"Plan authorized analysis of native binaries, libraries, package contents, managed .NET assemblies, Linux ELF layouts, or supplied crash cores using available REA providers.","included_files":[],"name":"rea-native-and-managed-artifacts","skill_md_contents":"---\nname: rea-native-and-managed-artifacts\ndescription: Plan authorized analysis of native binaries, libraries, package contents, managed .NET assemblies, Linux ELF layouts, or supplied crash cores using available REA providers.\n---\n\n# Native and managed artifacts\n\nUse only user-supplied artifacts the user owns or is authorized to analyze. Before opening a target, state the format and question, check provider availability, and warn that the provider parses untrusted input with the user's permissions; it is not a sandbox.\n\n## Route and scope\n\n- For a native executable/library/database: open the exact path with `open_binary`; inspect the selected provider and active target before focused calls.\n- For package member inventories, open only the supplied ZIP/APK/IPA/MSIX/AppX/DMG. Use artifact graph/findings only when they answer a named question.\n- For managed PE/CLI assemblies, use static inspection and preserve metadata/CIL coverage and unresolved native boundaries.\n- For offline Linux ELF layout, use `inspect_binary_layout` only when available and the target is an explicit ELF; preserve section/symbol/relocation evidence and static mitigation candidates.\n- For an explicitly supplied Linux x86-64 core, use `inspect_recorded_crash`; read recorded notes/threads and raw evidence. Historical PIDs must never be used to select live processes.\n\n## Avoid overreach\n\n- Do not disable, bypass, patch, or remove licensing, access controls, anti-cheat, DRM, or integrity checks.\n- Do not extract or disclose secrets, private keys, credentials, tokens, personal data, or proprietary information.\n- Do not execute a binary merely to see what it does. If runtime evidence is necessary, explain target effects and request the exact target/lifecycle within a controlled, authorized environment.\n- Do not save to or modify user-owned analysis databases or projects unless specifically requested and the tool's action is understood. Verify provider save semantics first.\n- If output is partial, say so. Never report pseudocode as source or static mitigation hints as a full security verdict.\n\nReport artifact identity, provider/version if available, evidence IDs, methods used, coverage, and the difference between observations and hypotheses.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}