How do I install the Headless Ghidra Evidence skill?

Run npx skillmds@latest add netvar1337/headless-ghidra-evidence in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Headless Ghidra Evidence safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Headless Ghidra Evidence?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Headless Ghidra Evidence free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Headless Ghidra Evidence?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Headless Ghidra Evidence by netvar1337

Name: Headless Ghidra Evidence
Author: netvar1337

Headless Ghidra Evidence

P2 phase skill for Headless Ghidra third-party evidence. Use after P1 to review baseline/runtime artifacts, identify or rule out third-party code, record pristine sources, classify functions, and capture evidence before metadata recovery.

netvar1337 Updated Sep 17, 2026

File contents

Headless Ghidra Third-Party — P2

P2 reviews baseline and runtime YAML to identify third-party libraries, record local pristine source directories, and classify functions for later metadata enrichment. Source download or acquisition is outside the CLI; the CLI records source_path, pristine_path, version, confidence, and evidence.

Required ghidra-agent-cli Commands

ghidra-agent-cli functions list
ghidra-agent-cli functions show
ghidra-agent-cli imports list
ghidra-agent-cli constants list
ghidra-agent-cli strings list
ghidra-agent-cli vtables list
ghidra-agent-cli types list
ghidra-agent-cli callgraph list
ghidra-agent-cli callgraph callers
ghidra-agent-cli callgraph callees
ghidra-agent-cli third-party add
ghidra-agent-cli third-party none
ghidra-agent-cli third-party set-version
ghidra-agent-cli third-party list
ghidra-agent-cli third-party classify-function
ghidra-agent-cli third-party vendor-pristine
ghidra-agent-cli execution-log append
ghidra-agent-cli gate check --phase P2

Inputs

artifacts/<target-id>/baseline/functions.yaml
artifacts/<target-id>/baseline/callgraph.yaml
artifacts/<target-id>/baseline/types.yaml
artifacts/<target-id>/baseline/constants.yaml
artifacts/<target-id>/baseline/vtables.yaml
artifacts/<target-id>/baseline/strings.yaml
artifacts/<target-id>/baseline/imports.yaml
artifacts/<target-id>/runtime/run-manifest.yaml
artifacts/<target-id>/runtime/hotpaths/call-chain.yaml
Existing artifacts/<target-id>/third-party/identified.yaml if present

Outputs

artifacts/<target-id>/third-party/identified.yaml
artifacts/<target-id>/third-party/pristine/<library>@<version>/
Optional local adaptation changes under artifacts/<target-id>/third-party/compat/<library>@<version>/

Exit Expectations

identified.yaml records at least one medium-or-higher confidence library when third-party code is present.
identified.yaml records libraries: [] when review finds no third-party code.
Each recorded third-party library has a local source_path and a pristine directory under third-party/pristine/.
Pristine source directories are kept unmodified; local adaptation edits live under third-party/compat/.
The next phase has enough version and function-classification evidence to recover names, signatures, and types.

Constraints

Do not mutate baseline YAML exports directly.
Do not claim unsupported evidence without recording the supporting source.
Do not bypass ghidra-agent-cli for supported baseline reads, third-party writes, or execution logging.
Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.

Next Step

P2 gate passes → headless-ghidra-discovery

---name: headless-ghidra-evidencedescription: P2 phase skill for Headless Ghidra third-party evidence. Use after P1 to review baseline/runtime artifacts, identify or rule out third-party code, record pristine sources, classify functions, and capture evidence before metadata recovery.---# Headless Ghidra Third-Party — P2P2 reviews baseline and runtime YAML to identify third-party libraries, recordlocal pristine source directories, and classify functions for later metadataenrichment. Source download or acquisition is outside the CLI; the CLI records`source_path`, `pristine_path`, version, confidence, and evidence.## Required ghidra-agent-cli Commands- `ghidra-agent-cli functions list`- `ghidra-agent-cli functions show`- `ghidra-agent-cli imports list`- `ghidra-agent-cli constants list`- `ghidra-agent-cli strings list`- `ghidra-agent-cli vtables list`- `ghidra-agent-cli types list`- `ghidra-agent-cli callgraph list`- `ghidra-agent-cli callgraph callers`- `ghidra-agent-cli callgraph callees`- `ghidra-agent-cli third-party add`- `ghidra-agent-cli third-party none`- `ghidra-agent-cli third-party set-version`- `ghidra-agent-cli third-party list`- `ghidra-agent-cli third-party classify-function`- `ghidra-agent-cli third-party vendor-pristine`- `ghidra-agent-cli execution-log append`- `ghidra-agent-cli gate check --phase P2`## Inputs- `artifacts/<target-id>/baseline/functions.yaml`- `artifacts/<target-id>/baseline/callgraph.yaml`- `artifacts/<target-id>/baseline/types.yaml`- `artifacts/<target-id>/baseline/constants.yaml`- `artifacts/<target-id>/baseline/vtables.yaml`- `artifacts/<target-id>/baseline/strings.yaml`- `artifacts/<target-id>/baseline/imports.yaml`- `artifacts/<target-id>/runtime/run-manifest.yaml`- `artifacts/<target-id>/runtime/hotpaths/call-chain.yaml`- Existing `artifacts/<target-id>/third-party/identified.yaml` if present## Outputs- `artifacts/<target-id>/third-party/identified.yaml`- `artifacts/<target-id>/third-party/pristine/<library>@<version>/`- Optional local adaptation changes under `artifacts/<target-id>/third-party/compat/<library>@<version>/`## Exit Expectations- `identified.yaml` records at least one medium-or-higher confidence library when third-party code is present.- `identified.yaml` records `libraries: []` when review finds no third-party code.- Each recorded third-party library has a local `source_path` and a pristine directory under `third-party/pristine/`.- Pristine source directories are kept unmodified; local adaptation edits live under `third-party/compat/`.- The next phase has enough version and function-classification evidence to recover names, signatures, and types.## Constraints- Do not mutate baseline YAML exports directly.- Do not claim unsupported evidence without recording the supporting source.- Do not bypass `ghidra-agent-cli` for supported baseline reads, third-party writes, or execution logging.- Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.## Next Step- P2 gate passes → `headless-ghidra-discovery`

Frequently asked questions