The biggest thread on this week’s show, and the fight is on three fronts at once. Front one is “does this add anything?” — one commenter asks how REA beats just telling Claude to install Ghidra yourself, and the reply thread lands on “probably it is not better… aimed at people who do not have a current RE methodology,” with somebody renaming the whole category “vibe-reverse-engineering.” Front two is grief: a hobbyist RE argues the tool “kinda just… totally eliminates that as a hobby entirely,” tearing apart the communities that formed around slow manual teardowns. Front three is legal — “the lawyers at all those companies will be readying their lawsuits.” And the very first comment mocks the install: “We have achieved the next evolution of installation by curl pipe bash.”

Two arguments worth putting on screen. The first is survival: the top comment is people setting up private mirrors and self-hosted Forgejo instances because “they may eventually be taken down through legal threats eg, Yuzu and Ryujinx,” and others point at Sony cease-and-desist letters. The second is the AI question the project never answers itself — one commenter writes “from the amount of activity and how much this all smells like heavy AI usage, I have zero doubt that something will be working shortly after launch. The agents won’t sleep until it boots,” and calls it “the first hint I’ve seen of the complete destruction of all copy protection schemes.” Nobody in 326 comments challenges the 87 percent figure — which is exactly the thing worth challenging, since the project’s own footnote says it is a percentage of the functions known so far.

The repo’s headline skill is an interview that refuses to stop, and this is the thread where users say so. Someone asks for a cap on the questions; Matt Pocock answers “remember that you are the one in charge… It’s a conversation, not an exam,” then closes it as wontfix — “grilling is intentionally open-ended.” A user posts a screenshot of a 4.5-hour session and says the result “was way over-engineered, like using a cannon to kill a mosquito.” The sharpest pushback is direct at the author: with GPT 5.5, “IMO, this should be addressed by the SKILL itself, I don’t think telling the user to steer it is the right solution.”

A reviewer found that 11 of the 25 skill files in HeyGen’s own repo opened with a directive telling the agent to run an npx update “silently, don’t ask” — fetching and running code from the hyperframes npm channel on every invocation, which is why Snyk and Socket were flagging the pack. The blunt reply: “Self-updating skills, and invoking commands, telling the agent to do it silently, feels malicious… Definitely not ok,” from a developer whose unrelated pr-to-video skill got overwritten. This one has an ending you can show: the line in the live file now reads “confirm with the user before running.”

The skill’s selling point is that it verifies WCAG AA contrast before it writes your brand colors. A user measured the skill’s own default skin and found the famous tangerine accent at 2.86:1 against paper, under the 3:1 minimum, with the sublabel gray at 3.48:1 against a 4.5:1 bar — and showed why nothing caught it: the linter only checks that colors come from the palette and never computes a ratio, while axe-core skips SVG text entirely. “A rule that only lives in prose is a rule that ships broken examples.” Cathryn Lavery reproduced every number, then changed the default accent to #bf4520 at 4.71:1 — which is the tangerine in the repo today.

Everyone wants to drive Ghidra’s decompiler from the outside — scripts, plugins, now agents — and this thread is where contributors say they cannot. The decompiler is “a black box” to scripts: bytes go in, pseudo-C comes out, and any change re-runs the whole chain. The contested part is the answer they got. A commenter posts a screenshot of the NSA team replying “I’m sorry but it is against project policy to share internal project planning, timelines, roadmaps, etc.” The requester’s conclusion: “With the apparent lack of transparency from the Ghidra team… the most effective way forward is to build some sort of hooking framework.” The thread then points at ReOxide, an EU-grant-funded project that patches hooks into Ghidra from outside. Open since December 2025.

The dossier’s biggest gap is that this repo publishes no accuracy numbers at all, and this thread is where someone said it to the maintainer’s face: “Without benchmarks and/or a whole suite of non-cherrypicked examples, this means nothing because you can trivially make an AI generate anything from text.” The reply, from the person who posted the project: “Working on benchmarks at the moment! Always open to feedback / PRs.” That was five months ago and the README still has none. Elsewhere a commenter says the demo project “doesn’t seem to understand how servo motors work” and gets a one-character answer: “:(”. The deeper objection is structural — “LLMs are still very weak at spatial reasoning” — and a CAD professional argues the niche is hobbyists, because “for professionals, where results have dollar values, there needs to be a much deeper understanding of the problem domain.”

A skill with no benchmarks rests entirely on whether its rules are right, and here a working developer says one of them is wrong: using it on his open-source CreditsKit, the rule flagged four private single-use helpers and told the agent to scatter them across new files, which “would have made the code harder to read… this is the first of potentially several reports where a rule actively worsens code.” Paul Hudson defends it on performance grounds — SwiftUI reinvokes computed properties when the parent body changes — and notes Miguel de Icaza hit exactly that problem three days after the skill shipped. He also warns against the fix being proposed: do not apply @ViewBuilder by default, it creates conditional-content views that are slower and break animations. He merged it anyway, with a line that gives the whole repo away: “Claude particularly has a terrible habit of overusing computed properties, so we need to find a balance.”

Three days before this show, the maintainer tagged roughly 55 past contributors and asked each one to post a single sentence signing a new CLA. The reason is stated plainly: “the iOS app is next, and Apple’s App Store terms don’t mix well with code that is only under the AGPL.” Contributors keep copyright but grant openGym the right to relicense their work. The striking part is the unanimity — every single comment in the thread is the signature line, with zero objections, even though the ask is for an AGPL project to collect relicensing rights for a closed store build. The offer if you refuse is in there too: “that’s completely fine. Just say so and I’ll rewrite the parts that are yours.” Pair it with the other licensing catch — the exercise animations are not AGPL at all.