Skip to content

AI Compass / Quick reads

Every statement gets a label: seen, suspected, unknown

Automation Website Prompting

An AI agent should say for every statement whether it saw it, suspected it or didn't check it at all. This rule makes any audit report more honest, whatever the tool.

In depth: Have your own website checked from the outside

REA (“Reverse Engineer Anything”) is an open-source tool for AI agents such as Claude Code. Among other things, it records what a web page actually sends to the server. AI LABS shows five uses, including debugging, speed and layout checks and a security check of your own site. What carries over most is a rule the REA skill gives the agent: every statement is tied to a stored piece of evidence and labelled “seen”, “suspected” or “unknown”. That way a suspicion doesn’t turn into a fact. The skill file in the repo demands the same in other words: keep observations, inferences and unknowns apart (externally checked). The video names the limit itself: REA only sees what arrives in the browser, and the logic on the server stays hidden. The test pages in the video were deliberately prepared, for example with built-in keys. How much REA finds on a real site is open.

Tool and alternative

REA is free, MIT license, installed according to the README with npx rea-agents setup, needs Node.js 22.19 or later (externally checked). According to the README, REA is meant only for software you own or are authorized to examine. For a security audit of code there is also the skill cloudflare/security-audit-skill, also MIT (Jack Roberts, 12 Oct). According to the README, it runs third-party code only in an isolated environment. Firecrawl, the sponsor in the video, is not needed for the checks shown.

Sources

Advertising in the source: AI LABS sponsored by Firecrawl (6:31–7:22), plus self-promotion. At Jack Roberts, several short links are not marked as advertising.

Want to try this with your team? That’s what the AI Lab is for. See the AI Lab