How do I install the Headless Ghidra Baseline skill?

Run npx skillmds@latest add netvar1337/headless-ghidra-baseline in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Headless Ghidra Baseline safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Headless Ghidra Baseline?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Headless Ghidra Baseline free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Headless Ghidra Baseline?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Headless Ghidra Baseline by netvar1337

Name: Headless Ghidra Baseline
Author: netvar1337

Headless Ghidra Baseline

P1 phase skill for Headless Ghidra baseline and runtime evidence. Use after P0 when the target must be imported into Ghidra, auto-analyzed, exported to baseline YAML, and given reproducible runtime or hotpath observations without decompiling function bodies.

netvar1337 Updated Sep 17, 2026

File contents

Headless Ghidra Baseline+Runtime — P1

P1 runs the initial Ghidra import and auto-analysis, exports baseline YAML metadata, makes the target reproducibly runnable, and records runtime/hotpath YAML that later phases consume.

Required ghidra-agent-cli Commands

ghidra-agent-cli ghidra import
ghidra-agent-cli ghidra auto-analyze
ghidra-agent-cli ghidra export-baseline
ghidra-agent-cli frida device-list
ghidra-agent-cli frida device-attach
ghidra-agent-cli frida io-capture
ghidra-agent-cli frida trace
ghidra-agent-cli runtime record
ghidra-agent-cli runtime validate
ghidra-agent-cli hotpath add
ghidra-agent-cli hotpath validate
ghidra-agent-cli gate check --phase P1

The shell wrappers and Java Ghidra scripts remain the backend implementation for these commands. The workflow contract is the CLI surface plus the YAML outputs below.

Inputs

artifacts/<target-id>/pipeline-state.yaml
artifacts/<target-id>/scope.yaml
targets/<target-id>/ghidra-projects/

Outputs

artifacts/<target-id>/baseline/functions.yaml
artifacts/<target-id>/baseline/callgraph.yaml
artifacts/<target-id>/baseline/types.yaml
artifacts/<target-id>/baseline/vtables.yaml
artifacts/<target-id>/baseline/constants.yaml
artifacts/<target-id>/baseline/strings.yaml
artifacts/<target-id>/baseline/imports.yaml
artifacts/<target-id>/runtime/run-manifest.yaml
artifacts/<target-id>/runtime/run-records/*.yaml
artifacts/<target-id>/runtime/fixtures/**
artifacts/<target-id>/runtime/hotpaths/call-chain.yaml
artifacts/<target-id>/runtime/project/** when a library harness is needed

Exit Expectations

All required baseline YAML files exist and are readable.
Runtime availability or unavailability is recorded with reproducible executable args or a C++/CMake library harness.
The P1 hotpath call-chain is available as the initial P3/P4 priority source.
No P4 decompilation artifacts are created in this phase.

Constraints

Do not decompile function bodies in P1.
Do not apply renames or signatures in P1.
Do not modify pipeline-state.yaml except through sanctioned state changes.
Do not bypass ghidra-agent-cli for import, analysis, export, or supported gate checks.
Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.

Next Step

P1 gate passes → headless-ghidra-evidence

---name: headless-ghidra-baselinedescription: P1 phase skill for Headless Ghidra baseline and runtime evidence. Use after P0 when the target must be imported into Ghidra, auto-analyzed, exported to baseline YAML, and given reproducible runtime or hotpath observations without decompiling function bodies.---# Headless Ghidra Baseline+Runtime — P1P1 runs the initial Ghidra import and auto-analysis, exports baseline YAMLmetadata, makes the target reproducibly runnable, and records runtime/hotpathYAML that later phases consume.## Required ghidra-agent-cli Commands- `ghidra-agent-cli ghidra import`- `ghidra-agent-cli ghidra auto-analyze`- `ghidra-agent-cli ghidra export-baseline`- `ghidra-agent-cli frida device-list`- `ghidra-agent-cli frida device-attach`- `ghidra-agent-cli frida io-capture`- `ghidra-agent-cli frida trace`- `ghidra-agent-cli runtime record`- `ghidra-agent-cli runtime validate`- `ghidra-agent-cli hotpath add`- `ghidra-agent-cli hotpath validate`- `ghidra-agent-cli gate check --phase P1`The shell wrappers and Java Ghidra scripts remain the backend implementation forthese commands. The workflow contract is the CLI surface plus the YAML outputsbelow.## Inputs- `artifacts/<target-id>/pipeline-state.yaml`- `artifacts/<target-id>/scope.yaml`- `targets/<target-id>/ghidra-projects/`## Outputs- `artifacts/<target-id>/baseline/functions.yaml`- `artifacts/<target-id>/baseline/callgraph.yaml`- `artifacts/<target-id>/baseline/types.yaml`- `artifacts/<target-id>/baseline/vtables.yaml`- `artifacts/<target-id>/baseline/constants.yaml`- `artifacts/<target-id>/baseline/strings.yaml`- `artifacts/<target-id>/baseline/imports.yaml`- `artifacts/<target-id>/runtime/run-manifest.yaml`- `artifacts/<target-id>/runtime/run-records/*.yaml`- `artifacts/<target-id>/runtime/fixtures/**`- `artifacts/<target-id>/runtime/hotpaths/call-chain.yaml`- `artifacts/<target-id>/runtime/project/**` when a library harness is needed## Exit Expectations- All required baseline YAML files exist and are readable.- Runtime availability or unavailability is recorded with reproducible executable args or a C++/CMake library harness.- The P1 hotpath call-chain is available as the initial P3/P4 priority source.- No P4 decompilation artifacts are created in this phase.## Constraints- Do not decompile function bodies in P1.- Do not apply renames or signatures in P1.- Do not modify `pipeline-state.yaml` except through sanctioned state changes.- Do not bypass `ghidra-agent-cli` for import, analysis, export, or supported gate checks.- Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.## Next Step- P1 gate passes → `headless-ghidra-evidence`

Frequently asked questions