How do I install the Reverser Ghidra skill?

Run npx skillmds@latest add purpleailab/reverser-ghidra in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Reverser Ghidra safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Reverser Ghidra?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Reverser Ghidra free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Reverser Ghidra?

purpleailab (@purpleailab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Reverser Ghidra by purpleailab — Agent Skill

Name: Reverser Ghidra
Author: purpleailab

File contents

Ghidra Deep Analysis

Ghidra is the primary reverse engineering backend. Two modes:

MCP bridge (preferred) — 245 tools via HTTP at $GHIDRA_MCP_URL
Headless (fallback) — analyzeHeadless + postScript for JSON output

Prerequisites

ghidra_status()

Check if Ghidra headless and/or MCP bridge are available.

1. Full Analysis

ghidra_analyze(binary="/workspace/target.exe")

Returns: functions (up to 500), imports, exports, language, image base. Auto-selects MCP if running, headless otherwise.

2. Decompile a Function

ghidra_decompile(binary="/workspace/target.exe", function="main")
ghidra_decompile(binary="/workspace/target.exe", function="0x401000")

Accepts symbol name or hex address. Returns C pseudocode.

3. Cross-References (MCP)

ghidra_xrefs(binary="/workspace/target.exe", address="0x401000")

Returns up to 200 xrefs with source function context.

4. Fallback: Script Generation

If headless/MCP are unavailable, generate a recon script and run via bash:

bin_ghidra_script(binary="/workspace/target.exe")

MCP Bridge — Full 245-Tool Coverage

When the Ghidra MCP bridge is running, the reverser also has access to the complete bethington/ghidra-mcp tool surface via bash + curl:

Function analysis — decompilation, call graphs, completeness scoring
Data flow — PCode-graph value propagation (forward / backward)
Structure discovery — struct/union/enum creation, field analysis
String extraction — regex search, quality filtering
Import/export analysis — symbol tables, ordinal resolution
Memory inspection — raw reads, byte pattern search
Cross-binary documentation — SHA-256 function hash matching
P-code emulation — run functions in isolation, brute-force API hashes
Batch operations — bulk rename, comment, type (93% fewer API calls)
Script management — create, run, update Ghidra scripts via MCP
Convention enforcement — auto-fix naming, type safety, documentation

Workflow

ghidra_status() → check availability
ghidra_analyze() → full triage
Pick interesting functions → ghidra_decompile() each
For xref hunting → ghidra_xrefs() on dangerous imports
Record all findings in the knowledge graph

---name: reverser-ghidradescription: Deep binary analysis via Ghidra — headless analyzeHeadless or live MCP bridge with 245 tools. Decompilation, xrefs, function listing, batch operations, P-code emulation, convention enforcement.---# Ghidra Deep AnalysisGhidra is the primary reverse engineering backend. Two modes:- **MCP bridge** (preferred) — 245 tools via HTTP at `$GHIDRA_MCP_URL`- **Headless** (fallback) — `analyzeHeadless` + postScript for JSON output## Prerequisites```ghidra_status()```Check if Ghidra headless and/or MCP bridge are available.## 1. Full Analysis```ghidra_analyze(binary="/workspace/target.exe")```Returns: functions (up to 500), imports, exports, language, image base.Auto-selects MCP if running, headless otherwise.## 2. Decompile a Function```ghidra_decompile(binary="/workspace/target.exe", function="main")ghidra_decompile(binary="/workspace/target.exe", function="0x401000")```Accepts symbol name or hex address. Returns C pseudocode.## 3. Cross-References (MCP)```ghidra_xrefs(binary="/workspace/target.exe", address="0x401000")```Returns up to 200 xrefs with source function context.## 4. Fallback: Script GenerationIf headless/MCP are unavailable, generate a recon script and run via bash:```bin_ghidra_script(binary="/workspace/target.exe")```## MCP Bridge — Full 245-Tool CoverageWhen the Ghidra MCP bridge is running, the reverser also has access tothe complete bethington/ghidra-mcp tool surface via bash + curl:- **Function analysis** — decompilation, call graphs, completeness scoring- **Data flow** — PCode-graph value propagation (forward / backward)- **Structure discovery** — struct/union/enum creation, field analysis- **String extraction** — regex search, quality filtering- **Import/export analysis** — symbol tables, ordinal resolution- **Memory inspection** — raw reads, byte pattern search- **Cross-binary documentation** — SHA-256 function hash matching- **P-code emulation** — run functions in isolation, brute-force API hashes- **Batch operations** — bulk rename, comment, type (93% fewer API calls)- **Script management** — create, run, update Ghidra scripts via MCP- **Convention enforcement** — auto-fix naming, type safety, documentation## Workflow1. `ghidra_status()` → check availability2. `ghidra_analyze()` → full triage3. Pick interesting functions → `ghidra_decompile()` each4. For xref hunting → `ghidra_xrefs()` on dangerous imports5. Record all findings in the knowledge graph

Frequently asked questions

Reverser Ghidra