Headless ghidra discovery

Skill ByteLandTechnology/headless-ghidra/headless-ghidra-discovery

Headless Ghidra reverse-engineering skill family for reproducible, evidence-backed workflows and audit-ready Markdown outputs.

Install

npx -y skills add ByteLandTechnology/headless-ghidra --skill headless-ghidra-discovery

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

P3 phase skill for Headless Ghidra metadata discovery. Use after P2, or after a P4 batch exposes missing context, to enrich function names, signatures, types, constants, strings, and hotpath metadata in YAML before serialized CLI apply.

SKILL.md

2.5 KB, 575 tokens by cl100k_base, as published. Nobody here has run it

Headless Ghidra Metadata Enrichment — P3

P3 enriches function metadata from third-party evidence and the P1 runtime hotpath call-chain. Analysis work may be parallelized while producing YAML, but all writes back to the Ghidra project must go through serialized ghidra-agent-cli ghidra ... commands.

Required ghidra-agent-cli Commands

ghidra-agent-cli workspace state show
ghidra-agent-cli functions list
ghidra-agent-cli callgraph callers
ghidra-agent-cli callgraph callees
ghidra-agent-cli metadata enrich-function
ghidra-agent-cli metadata validate
ghidra-agent-cli hotpath validate
ghidra-agent-cli ghidra apply-renames
ghidra-agent-cli ghidra verify-renames
ghidra-agent-cli ghidra apply-signatures
ghidra-agent-cli ghidra verify-signatures
ghidra-agent-cli gate check --phase P3

Inputs

artifacts/<target-id>/pipeline-state.yaml
artifacts/<target-id>/runtime/hotpaths/call-chain.yaml
artifacts/<target-id>/third-party/identified.yaml
artifacts/<target-id>/baseline/functions.yaml
artifacts/<target-id>/baseline/callgraph.yaml
artifacts/<target-id>/baseline/types.yaml

Outputs

artifacts/<target-id>/metadata/renames.yaml
artifacts/<target-id>/metadata/signatures.yaml
artifacts/<target-id>/metadata/types.yaml
artifacts/<target-id>/metadata/constants.yaml
artifacts/<target-id>/metadata/strings.yaml
artifacts/<target-id>/metadata/apply-records/

Exit Expectations

Every function in runtime/hotpaths/call-chain.yaml has an explicit recovered name and signature before P4 starts.
Metadata enrichment YAML is applied to the Ghidra project only through CLI commands under the CLI lock.
The enrichment is reproducible from recorded baseline, runtime, and third-party evidence.

Constraints

Do not decompile anything in this phase.
Do not rewrite historical per-function outputs.
Do not bypass ghidra-agent-cli for supported state, baseline, callgraph, metadata, Ghidra apply, or gate operations.
Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.

Next Step

P3 gate passes → headless-ghidra-batch-decompile

What ships with it: 3 files

13.9 KB alongside SKILL.md