reap-10-vulnerability-research git:20261025.9bd45a8A

Immutable. This exact content never changes and is served at /api/v1/blob/478e92f1fda727a0.

---
name: reap-10-vulnerability-research
description: REA prompt pack:  Vulnerability research (5 ready-to-paste prompts). Use when doing reverse-engineering investigation of vulnerability research with REA (rea.tools) via an AI coding agent.
---

# REAP — 10. Vulnerability research

Part of REAP (REA Investigation Prompts). Replace everything in <angle brackets>; keep each request focused on one feature. Demand file/function/address evidence and separate facts from hypotheses.

### Trust-boundary audit

```text
Use REA to review the security of <authorized application or binary>.

Prioritize trust boundaries, untrusted input, privileged operations,
credential storage, IPC, file handling and command execution.

For each possible vulnerability, present:
- the input origin and the sensitive operation;
- the code path and existing checks;
- preconditions and impact;
- evidence and uncertainties;
- a proposal for controlled validation.

Do not classify a hypothesis as a confirmed vulnerability without sufficient
evidence.
```

### Sink hunt from untrusted input

```text
Use REA on <binary>. List every place untrusted data enters (network sockets,
files, IPC, command-line, clipboard, URL handlers) and follow each source to
dangerous sinks: memcpy/strcpy with unchecked length, system/exec, dynamic
loading, deserialization, path concatenation. For each source→sink path give
the function chain with addresses and state which validation exists in
between.
```

### Patch diffing (1-day to incomplete-fix hunting)

```text
Use REA to compare <vulnerable version> and <patched version> of <component>.

Diff the security-relevant functions: what check was added, where else in the
binary the same pattern exists without the fix, and whether the fix covers
every caller of the vulnerable routine. Report candidate incomplete-fix
locations with function/address evidence, clearly labeled as hypotheses until
validated in a controlled environment.
```

### Crash triage to root cause

```text
Use REA to investigate this crash in <application>.

Available evidence:
<STACK TRACE, LOGS, DUMP OR REPRO STEPS>

Relate the error to the functions involved, formulate hypotheses and indicate
which evidence supports each one.

Propose the smallest experiment needed to distinguish the hypotheses and
validate the cause.
```

### How is my data handled?

```text
I am allowed to analyse <program>. Use REA to find where it stores or sends
<kind of data>. Show the code paths, say whether the data is encrypted at rest
and in transit, and list concrete risks with evidence.
```

---