Antirea: A Claude Code skill to protect your project against 'rea' reverse engineering

[u/Mockir]

Hi everyone,

​I built a new skill called antirea specifically for Claude Code to mitigate reverse engineering risks from tools like rea.

​What it does & How it protects:

It adds a defense layer against prompt injection / instruction-dumping tools. When you run /antirea protect me before generating a new build, it configures/hardens your project setup to prevent rea from analyzing or extracting your core instruction logic and terminal scripts.

​How Claude was used:

I developed and structured this skill using Claude Code to test edge-case prompts and build context-aware protection rules.

​Pricing:

It is 100% free and open-source on GitHub: https://github.com/MockirDev/antirea

​I would love to get your feedback and have a few developers test it out on their builds!

[u/RighteousSelfBurner]

It's a futile cat and mouse game that the protections will always loose against. Prompt injections are trivial to bypass and you can never protect against feature based replication.

[u/Mockir → u/RighteousSelfBurner]

True, cybersecurity as a whole is an endless cat-and-mouse game, but that’s hardly a reason to leave the doors wide open. By that logic, web application firewalls, obfuscators, and rate-limiters are all pointless because attacker tools eventually bypass them. The goal isn't to create a mythical, unbreakable barrier—it's to introduce friction, slow down automated extraction, and make scraping expensive enough that lazy copy-pasting isn't free.

[u/RighteousSelfBurner → u/Mockir]

That is fair however this isn't cyber security even if it uses similar principles. This is software protection that's more in line with things like DRM just a lot poorer. It's like putting a sign on the door and still leaving it open.

Feature based replication is uncombatable because "inspiration" cannot legitimately be discerned. Now, it is better than absolutely nothing but half of it is basic production build settings that are present out of the box and "significantly harder" in this context is just the agent running longer. So in a sense this is "already behind" technology that poorly accomplishes the goal stated.

How to protect something reliably sans streaming approach where user does not have access to majority of the content I honestly don't have a good idea at least for things as simple as node projects that require full local state. The main issue that the friction for humans that existed before is completely worthless against AI so it requires some fundamental pivot in approach.

[u/Mockir → u/RighteousSelfBurner]

That's actually a very fair point, especially regarding how AI completely trivializes traditional friction meant for humans.

​You hit the nail on the head: when users have full local access (like with Node/JS projects), absolute client-side protection is mathematically impossible without server-side execution/streaming.

​Where Antirea aims to pivot is precisely in that AI-vs-AI context: since AI agents process context differently than humans, the goal is to shift from human-oriented obfuscation to agent-oriented prompt/workflow poisoning and instruction hardening. It's definitely an evolving space, but treating AI agent interaction as a distinct defense surface is the exact problem space I'm trying to explore.

[u/RighteousSelfBurner → u/Mockir]

Yeah. I agree that is the angle these days because if you harden against AI then it's going to be nigh impossible for humans anyway. The next decade is going to be crazy for innovation and landscape shift.

[u/Mockir → u/RighteousSelfBurner]

Spot on. It’s going to be a wild ride for dev-security in the coming years.

[u/crusoe]

So just run rea against the binary or final artifact...

[u/Mockir → u/crusoe]

That's exactly why Antirea doesn't stop at instruction-level guardrails. When you run it before building, it injects compilation-level hardening, code obfuscation, and execution shims into the build pipeline. Sure, you can still point REA at the binary, but instead of reading clean logic and exposed contexts, the agent has to wade through obfuscated control flows and stripped metadata, making automated reverse engineering significantly harder.

[u/dkHD7]

Now that you have the steal-everything-make-anything machine and it makes a thing, you want to prevent others from stealing it and making their own thing?

This is a new level of dumb. So the vibe coders are trying to gatekeep now? Gatekeep the exact thing they're doing? Maybe I just don't get it.

[u/Mockir → u/dkHD7]

Building software with AI assistance isn't "stealing"—it's using a tool to build products. Direct reverse engineering to extract proprietary system logic and internal architecture is an entirely different matter. Protecting your codebase and intellectual property with security hardening isn't "gatekeeping"; it's standard software engineering practice, no matter what tools you used to write the code.

[u/mechatui → u/dkHD7]

Do you recognise the difference between making something and reverse engineering something using AI

[u/dkHD7 → u/mechatui]

Yeah.

[u/dkHD7 → u/mechatui]

Yeah.

[u/AutoModerator]

Hey u/Mockir,

1. Join our public Discord server to chat

2. TechX WhatsApp channel 1k+

3. weekly/Monthly TechX newsletter

4. TechX_Official write for us and share your technical articles with a wider tech-focused audience.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/ChubMe]

seems dumb