How do I install the Headless Ghidra Discovery skill?

Run npx skillmds@latest add netvar1337/headless-ghidra-discovery in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Headless Ghidra Discovery safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Headless Ghidra Discovery?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Headless Ghidra Discovery free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Headless Ghidra Discovery?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Headless Ghidra Discovery by netvar1337

Name: Headless Ghidra Discovery
Author: netvar1337

Headless Ghidra Discovery

P3 phase skill for Headless Ghidra metadata discovery. Use after P2, or after a P4 batch exposes missing context, to enrich function names, signatures, types, constants, strings, and hotpath metadata in YAML before serialized CLI apply.

netvar1337 Updated Sep 17, 2026

File contents

Headless Ghidra Metadata Enrichment — P3

P3 enriches function metadata from third-party evidence and the P1 runtime hotpath call-chain. Analysis work may be parallelized while producing YAML, but all writes back to the Ghidra project must go through serialized ghidra-agent-cli ghidra ... commands.

Required ghidra-agent-cli Commands

ghidra-agent-cli workspace state show
ghidra-agent-cli functions list
ghidra-agent-cli callgraph callers
ghidra-agent-cli callgraph callees
ghidra-agent-cli metadata enrich-function
ghidra-agent-cli metadata validate
ghidra-agent-cli hotpath validate
ghidra-agent-cli ghidra apply-renames
ghidra-agent-cli ghidra verify-renames
ghidra-agent-cli ghidra apply-signatures
ghidra-agent-cli ghidra verify-signatures
ghidra-agent-cli gate check --phase P3

Inputs

artifacts/<target-id>/pipeline-state.yaml
artifacts/<target-id>/runtime/hotpaths/call-chain.yaml
artifacts/<target-id>/third-party/identified.yaml
artifacts/<target-id>/baseline/functions.yaml
artifacts/<target-id>/baseline/callgraph.yaml
artifacts/<target-id>/baseline/types.yaml

Outputs

artifacts/<target-id>/metadata/renames.yaml
artifacts/<target-id>/metadata/signatures.yaml
artifacts/<target-id>/metadata/types.yaml
artifacts/<target-id>/metadata/constants.yaml
artifacts/<target-id>/metadata/strings.yaml
artifacts/<target-id>/metadata/apply-records/

Exit Expectations

Every function in runtime/hotpaths/call-chain.yaml has an explicit recovered name and signature before P4 starts.
Metadata enrichment YAML is applied to the Ghidra project only through CLI commands under the CLI lock.
The enrichment is reproducible from recorded baseline, runtime, and third-party evidence.

Constraints

Do not decompile anything in this phase.
Do not rewrite historical per-function outputs.
Do not bypass ghidra-agent-cli for supported state, baseline, callgraph, metadata, Ghidra apply, or gate operations.
Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.

Next Step

P3 gate passes → headless-ghidra-batch-decompile

---name: headless-ghidra-discoverydescription: P3 phase skill for Headless Ghidra metadata discovery. Use after P2, or after a P4 batch exposes missing context, to enrich function names, signatures, types, constants, strings, and hotpath metadata in YAML before serialized CLI apply.---# Headless Ghidra Metadata Enrichment — P3P3 enriches function metadata from third-party evidence and the P1 runtimehotpath call-chain. Analysis work may be parallelized while producing YAML, butall writes back to the Ghidra project must go through serialized`ghidra-agent-cli ghidra ...` commands.## Required ghidra-agent-cli Commands- `ghidra-agent-cli workspace state show`- `ghidra-agent-cli functions list`- `ghidra-agent-cli callgraph callers`- `ghidra-agent-cli callgraph callees`- `ghidra-agent-cli metadata enrich-function`- `ghidra-agent-cli metadata validate`- `ghidra-agent-cli hotpath validate`- `ghidra-agent-cli ghidra apply-renames`- `ghidra-agent-cli ghidra verify-renames`- `ghidra-agent-cli ghidra apply-signatures`- `ghidra-agent-cli ghidra verify-signatures`- `ghidra-agent-cli gate check --phase P3`## Inputs- `artifacts/<target-id>/pipeline-state.yaml`- `artifacts/<target-id>/runtime/hotpaths/call-chain.yaml`- `artifacts/<target-id>/third-party/identified.yaml`- `artifacts/<target-id>/baseline/functions.yaml`- `artifacts/<target-id>/baseline/callgraph.yaml`- `artifacts/<target-id>/baseline/types.yaml`## Outputs- `artifacts/<target-id>/metadata/renames.yaml`- `artifacts/<target-id>/metadata/signatures.yaml`- `artifacts/<target-id>/metadata/types.yaml`- `artifacts/<target-id>/metadata/constants.yaml`- `artifacts/<target-id>/metadata/strings.yaml`- `artifacts/<target-id>/metadata/apply-records/`## Exit Expectations- Every function in `runtime/hotpaths/call-chain.yaml` has an explicit recovered name and signature before P4 starts.- Metadata enrichment YAML is applied to the Ghidra project only through CLI commands under the CLI lock.- The enrichment is reproducible from recorded baseline, runtime, and third-party evidence.## Constraints- Do not decompile anything in this phase.- Do not rewrite historical per-function outputs.- Do not bypass `ghidra-agent-cli` for supported state, baseline, callgraph, metadata, Ghidra apply, or gate operations.- Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.## Next Step- P3 gate passes → `headless-ghidra-batch-decompile`

Frequently asked questions