Headless Ghidra reverse-engineering skill family for reproducible, evidence-backed workflows and audit-ready Markdown outputs.
SaferSkills independently audited headless-ghidra (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill is the workflow coordinator for the skill family. It defines the P0–P4 sequence, dispatch rules, and artifact hand-off points. ghidra-agent-cli remains the tool reference for command syntax and YAML artifact semantics.
ghidra-agent-cli is the mandatory shared interface for supported workspace,metadata, Ghidra, Frida, progress, validation, and gate operations.
ghidra-agent-cli subcommands they use.replace the CLI as the primary interface when the CLI already supports the action.
artifacts/<target-id>/.ghidra-agent-cli.user review.
ghidra-agent-cli. If the CLIlacks a required capability, pause and ask the user before creating or running a new Ghidra script.
P0 Intake → P1 Baseline+Runtime → P2 Third-Party → [P3 Metadata Enrichment → P4 Function Substitution]*| Phase | Skill | Purpose | Primary outputs |
|---|---|---|---|
| P0 | headless-ghidra-intake | Initialize target workspace, discover prerequisites, and define scope | pipeline-state.yaml, scope.yaml, targets/<id>/ghidra-projects/ |
| P1 | headless-ghidra-baseline | Run Ghidra import/analysis, export baseline YAML, and prepare runtime observations | baseline/*.yaml, runtime/run-manifest.yaml, runtime/run-records/*.yaml, runtime/hotpaths/call-chain.yaml |
| P2 | headless-ghidra-evidence | Identify and record third-party libraries and pristine sources | third-party/identified.yaml, third-party/pristine/<library>@<version>/, third-party/compat/<library>@<version>/ |
| P3 | headless-ghidra-discovery | Enrich names, signatures, types, constants, strings, and selected hotpath metadata | metadata/*.yaml, metadata/apply-records/ |
| P4 | headless-ghidra-batch-decompile | Substitute selected functions through metadata application and Ghidra decompilation | substitution/next-batch.yaml, substitution/functions/<fn_id>/ |
All phases work inside this active workspace layout:
targets/<target-id>/ghidra-projects/
artifacts/<target-id>/
├── pipeline-state.yaml
├── scope.yaml
├── intake/
├── baseline/
├── runtime/
│ ├── project/
│ ├── fixtures/
│ ├── run-manifest.yaml
│ ├── run-records/
│ └── hotpaths/call-chain.yaml
├── third-party/
│ ├── identified.yaml
│ ├── pristine/<library>@<version>/
│ └── compat/<library>@<version>/
├── metadata/
│ ├── renames.yaml
│ ├── signatures.yaml
│ ├── types.yaml
│ ├── constants.yaml
│ ├── strings.yaml
│ └── apply-records/
├── substitution/
│ ├── template/
│ ├── next-batch.yaml
│ └── functions/<fn_id>/
└── gates/The orchestrator treats pipeline-state.yaml as the current target-level state record and relies on the phase-owned YAML artifacts above for hand-offs.
artifacts/<target-id>/pipeline-state.yaml.ghidra-agent-cli gate check --phase ... at each transition.batch confirmation, divergence review, and completion.
ghidra-agent-cli gate check is the authoritative gate validation for allpipeline phases (P0–P4). The legacy gate-check.sh has been removed.
ghidra-agent-cli context useghidra-agent-cli context showghidra-agent-cli context clearghidra-agent-cli workspace state showghidra-agent-cli workspace state set-phaseghidra-agent-cli gate checkghidra-agent-cli validateghidra-agent-cli progress compute-next-batchghidra-agent-cli progress showdirectly except for explicit state updates it owns.
ghidra-agent-cli for supported state, progress, context,validation, or gate operations.
pause and ask the user first.
headless-ghidra-baselineheadless-ghidra-evidenceheadless-ghidra-discoveryheadless-ghidra-batch-decompileThe following skills operate outside the P0–P4 pipeline and can be invoked directly:
| Skill | Purpose | Invocation |
|---|---|---|
headless-ghidra-analyze-function | Thorough single-function analysis following the strict five-step recovery order: types → constants → vtables → function identity → decompilation. Use when you need complete analysis of one specific function with full type/constant/vtable context before decompilation results are interpreted. | Invoked when user asks to "analyze this function thoroughly", "decompile function at 0x... with full context", or requests complete per-function analysis. |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.