# Ghidra Headless Evidence

> Phase skill for evidence extraction, replay expectations, and audit of generated planning artifacts.

- Skill: `bytelandtechnology/ghidra-headless-evidence` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add bytelandtechnology/ghidra-headless-evidence`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bytelandtechnology/ghidra-headless-evidence/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: bytelandtechnology (https://skillmd.com/u/bytelandtechnology)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bytelandtechnology/ghidra-headless-evidence

---


# Ghidra Headless Evidence

Use this phase skill when planning needs to preserve how evidence will be
extracted, replayed, and reviewed after the target and scope are already
normalized.

The canonical contract is [`./planning-brief.md`](./planning-brief.md). That
brief carries evidence and replay constraints into `speckit`, then acts as the
checklist for reviewing generated planning artifacts.

## Phase Focus

This phase covers:

- evidence sources and extraction expectations
- replayable command or manifest requirements
- artifact capture and review surfaces
- validation expectations for generated planning artifacts

This phase is generic evidence planning. It does not own active Frida runtime
capture. When the request needs new Frida capture planning rather than review
of already captured outputs, route first to
[`../ghidra-headless-frida-runtime-injection/SKILL.md`](../ghidra-headless-frida-runtime-injection/SKILL.md).
When a runtime-capture manifest already exists and the remaining work is
provenance review, observed-versus-inferred claim labeling, or
static-vs-dynamic conflict recording, route to
[`../ghidra-headless-frida-evidence/SKILL.md`](../ghidra-headless-frida-evidence/SKILL.md).

## Non-Negotiable Constraints

- Headless-only workflow. Evidence collection must not depend on GUI-only
  activity.
- Evidence-backed claims. Reverse-engineering conclusions must trace to
  observable exports, manifests, or recorded outputs.
- Reproducible workflow expectations. Replay commands, inputs, and outputs must
  be explicit enough to regenerate.
- Reviewable Markdown outputs. The planning and audit surfaces remain readable
  as Markdown.
- No downstream `speckit` extension or constitution change is required.

## Required Inputs

- existing intake summary or normalized target context
- expected evidence sources and artifact types
- replay expectations, including command, manifest, or export surfaces
- validation gates a reviewer must confirm after planning
- optional local overlays that only tighten the contract

## How To Use This Skill

1. Fill in [`./planning-brief.md`](./planning-brief.md) with the evidence and
   replay expectations for the target.
2. Pass that brief into `speckit` as a file or inline paste.
3. Review the generated planning artifacts against the same evidence checklist
   before treating them as ready for implementation.
4. If a generated artifact weakens replay or evidence requirements, refine or
   regenerate the planning artifacts rather than weakening this phase contract.

## Example

- Evidence handoff example:
  [`./examples/evidence-speckit-handoff.md`](./examples/evidence-speckit-handoff.md)

## Next Step Routing

- Use this phase after intake is stable and before script-specific planning.
- Move to the Frida runtime-injection phase when the planning request still
  needs reproducible CLI/headless Frida capture, common script selection, or a
  capture manifest before imported evidence can be reviewed.
- Move to the Frida evidence phase when the planning request depends on
  externally captured Frida traces, hook logs, or session notes that need their
  own provenance and replayable handoff contract.
- Return to intake if the real gap is still target identity, initial scope, or
  setup normalization rather than evidence design.
- Move to script authoring and review when the plan introduces reusable Ghidra
  scripts, registration work, or checklist-based script review.