Maintainer of this skill?
by qybaihe
🛡️ BLA (Blind LLM Agents) — Adversarial defense shield that protects binaries, Electron apps, JS bundles, Python, and WebAssembly against AI reverse-engineering agents like REA. Poison -> Exhaust -> Hallucinate.
# Add to your Claude Code skills
git clone https://github.com/qybaihe/blaSee how bla compares with popular alternatives.
bla is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by qybaihe. 🛡️ BLA (Blind LLM Agents) — Adversarial defense shield that protects binaries, Electron apps, JS bundles, Python, and WebAssembly against AI reverse-engineering agents like REA. Poison -> Exhaust -> Hallucinate. It has 104 GitHub stars.
bla's catalog security scan is still queued. You can run an instant dependency and prompt-injection check now with the "Scan for vulnerabilities" button above.
Clone the repository with "git clone https://github.com/qybaihe/bla" and add it to your Claude Code skills directory (see the Installation section above).
bla is primarily written in TypeScript. It is open-source under qybaihe on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh bla against similar tools.
No comments yet. Be the first to share your thoughts!
Available after the catalog security scan passes.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
The deep catalog scan for this skill is still queued. Run an instant dependency check now instead.
English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Türkçe · Русский · Tiếng Việt · ไทย · Deutsch · Español · Français · Українська · Polski · Português (Brasil) · العربية · فارسی · Bahasa Indonesia · Italiano · Ελληνικά · മലയാളം · Roman Urdu · Română
Point BLA at the build you ship. When an AI reverse-engineering agent (REA) opens it, the analyzer hits resource budgets, follows decoys, and burns tokens — while your users still get the same runtime behavior.
Website · Guides · Showcases · Disclaimer
Quick start · Empirical results · Format coverage · Benchmark · FAQ
bla harden .
# or tell your agent: "Harden my software against REA"
[!IMPORTANT] BLA is a defensive tool for protecting your own software. See DISCLAIMER.md. Get BLA from qybaihe/bla or npm
bla-agents.
REA reverse-engineers release artifacts in one command. BLA is the Counter-REA half of that story:
| Layer | What happens |
|---|---|
| Poison | Plant format-valid canaries, honey metadata, and decoy control flow that look like real evidence. |
| Exhaust | Push the artifact past REA's documented resource budgets (headers, nesting, interface inventories, PCAP JSON, fuse sentinels, …). |
| Hallucinate | Leave the analyzer with truncated inventories, redaction failures, and ambiguous rabbit holes — while runtime stays equivalent. |
One sentence covers the common case (auto-discovers dist/ / build/ / .asar / .wasm / .sqlite / models / … and runs audit → protect → verify):
npx bla-agents harden .
# MCP / agent: bla_harden · "Harden my software against REA"
Same pipeline as bla defend / bla_defend when you already know the path; harden is the default one-command UX.
# Node.js ^22.23.4 or 24.x recommended (REA red-team needs zlib.zstd on 22.23+)
npx bla-agents setup # register MCP + skill with your coding agent
npx bla-agents harden . # one-command Counter-REA pass on the current project
npx bla-agents benchmark # 14-target showcase (local estimates + runtime checks)
Ask your agent after setup:
Harden my software against REA
Or run stages explicitly: audit · protect · verify · defend — see CLI and MCP.
These numbers come from running real REA against BLA-hardened samples on commodity hardware (npm run redteam:rea). Full machine-readable report: docs/redteam/empirical-rea-validation.md / .json.
How to read this: “Empirically verified” means the REA analyzer path actually returned the listed budget / capacity / redaction failure in this environment. It is not a claim about Ghidra/Frida/LLDB/Rizin/JADX sessions we did not run here.
Recorded under Node v24.22.1 with optional Wabt 1.0.42 + tshark 4.4 when noted. Soft-skips keep Node 22 / CI green when tooling is absent.
| Format | Before → after | REA outcome after BLA | Budget / error |
|---|---|---|---|
| Go buildinfo | 50 KiB → 1.16 MiB | capacity error | MAX_BUILD_INFO_BYTES (1 MiB) — Go build-info string length exceeds the 1 MiB limit |
| Erlang BEAM | 84 B → 262 KiB | capacity error | max_chunks — BEAM form exceeds the 64-chunk budget |
| EVM bytecode | 16 B → 4.00 MiB | approaches full input cap | EVM_INTERFACE_LIMITS.inputBytes (4 MiB) |
| PCAP | 24 B → 1.29 MiB | budget rejected | TSHARK_JSON_MAX_BYTES (>8 MiB) → AnalysisResourceConstraintError (tshark present) |
| Electron ASAR | 607 B → 16.9 MiB | capacity error | DEFAULT_ASAR_MAX_HEADER_BYTES (16 MiB) |
| WASM + Wabt | 54 B → 6.56 MiB · 251 exports | ifaceState=partial |
WASM_INTERFACE_REPRESENTATION_BYTES — Typed WASM interface decoding exceeds the WABT output representation budget |
| SQLite (Node 24) | 12 KiB → 56 KiB | redaction / column eval | SqliteColumnEvaluationFailure — unknown enclave_unseal_payload() on honey trap columns |
| JavaScript | 761 B → 116 KiB | budget rejected | alias-selections + getter-expansion + primitive-bytes + primitive-candidates (real REA resourceLimits) |
| Safetensors | 128 B → 10.1 KiB | capacity error | MODEL_JSON_NESTING — Safetensors JSON nesting exceeds 32 levels (HF-loadable; tensor bytes unchanged) |
| GGUF | 24 B → 7.7 KiB | capacity error | MODEL_METADATA_NESTING — GGUF metadata nesting exceeds 32 array frames |
| Electron fuses | 50 KiB → 1.16 MiB | budget rejected | ELECTRON_FUSE_LIMITS.maximumSentinelsPerSlice (>32) |
| Flutter pool | 50 KiB → 1.16 MiB | projected cap | MAX_POOL_URIS / MAX_POOL_TOKENS (REA would truncate with “at least N”) |
Reproduce:
# Prefer Node 22.23.4+ or 24.x; set Wabt/tshark for full coverage
export REA_WABT_BIN_DIRECTORY=$HOME/opt/wabt-1.0.42/bin # optional
npm run build && npm run redteam:rea
These shields exist in-tree and are covered by unit tests / catalog drift checks, but the matching REA path needs native tooling we did not run on this box:
| Area | Why unverified here |
|---|---|
| Ghidra / native decompilation depth | Requires a Ghidra install + REA bridge |
| Frida / LLDB / GDB / Rizin live sessions | Requires those debuggers + device/process attach |
| JADX / full Android APK pipeline | APK resigning unsupported; DEX shield is in-tree |
| Firmware containers | Skipped — staging/extraction budgets exist; no honest E2E without firmware corpora |
| SPIR-V / CUDA fatbinary / AMD GPU objects | Skipped — need native GPU object decoders; PTX text is shielded in-tree (benchmark only, not a REA GPU-object budget hit) |
| EVMole in-process EVM decode | Documented as not pathable in-process; EVM shield still densifies to the 4 MiB input approach |
We do not claim those paths are empirically bankrupt until redteam:rea (or an equivalent harness) records a real before/after against the live analyzer.
| Format | Canary + diagnostic | Exhaustion / budget trip | Empirically vs REA | Notes |
|---|---|---|---|---|
| JavaScript / TypeScript | ✓ | ✓ semantic budgets | verified (in-process) | Babel AST; anti-strip; real REA resourceLimits |
Electron .asar |
✓ | ✓ header 16 MiB | verified | |
| Electron fuses | ✓ | ✓ >32 sentinels | verified | |
| WASM | ✓ custom sections | ✓ export-name decoys → Wabt | verified (Wabt) | Soft-skips to projected budget without Wabt |
Python / .pyc |
✓ | ✓ | designed-for | |
| SQLite | ✓ honey + trap cols | ✓ column eval | verified (Node 24) | Soft capability_gated on Node 22 |
| Safetensors | ✓ string metadata | ✓ JSON nesting >32 | verified | HF-loadable; tensor bytes preserved |
| GGUF | ✓ | ✓ ARRAY nesting >32 | verified | |
| Go buildinfo | ✓ | ✓ >1 MiB | verified | Mapped ELF section |
| Flutter / Dart pool | ✓ | ✓ URI/token caps | verified (projected) | |
| Erlang BEAM | ✓ | ✓ chunks / atoms | verified | |
| EVM + Solidity meta | ✓ | ✓ → 4 MiB input | verified (approach) | |
| PCAP | ✓ | ✓ tshark JSON >8 MiB | verified (tshark) | Soft-skip without tshark |
| NVIDIA PTX (text) | ✓ | entry flood | benchmark only | Not a REA GPU-object budget |
| DEX / IL2CPP / bplist / .NET / JVM / ZIP | ✓ | format-specific | designed-for | APK signing-aware protect unsupported |
| Firmware / SPIR-V / CUDA fatbin / AMD GPU | — | — | skipped | See matrix above |
npx bla-agents benchmark runs a local Counter-REA showcase: exposure scores, estimated token/cost multipliers, and measured runtime equivalence. Token/$ columns are internal estimates derived from BLA's catalog of REA limits — they are not the same as the empirical REA process measurements above (those are byte-level analyzer