headless-ghidra-discovery

Installation
SKILL.md

Headless Ghidra Metadata Enrichment — P3

P3 enriches function metadata from third-party evidence and the P1 runtime hotpath call-chain. Analysis work may be parallelized while producing YAML, but all writes back to the Ghidra project must go through serialized ghidra-agent-cli ghidra ... commands.

Required ghidra-agent-cli Commands

  • ghidra-agent-cli workspace state show
  • ghidra-agent-cli functions list
  • ghidra-agent-cli callgraph callers
  • ghidra-agent-cli callgraph callees
  • ghidra-agent-cli metadata enrich-function
  • ghidra-agent-cli metadata validate
  • ghidra-agent-cli hotpath validate
  • ghidra-agent-cli ghidra apply-renames
  • ghidra-agent-cli ghidra verify-renames
  • ghidra-agent-cli ghidra apply-signatures
  • ghidra-agent-cli ghidra verify-signatures
  • ghidra-agent-cli gate check --phase P3

Inputs

  • artifacts/<target-id>/pipeline-state.yaml
  • artifacts/<target-id>/runtime/hotpaths/call-chain.yaml
  • artifacts/<target-id>/third-party/identified.yaml
  • artifacts/<target-id>/baseline/functions.yaml
  • artifacts/<target-id>/baseline/callgraph.yaml
  • artifacts/<target-id>/baseline/types.yaml

Outputs

  • artifacts/<target-id>/metadata/renames.yaml
  • artifacts/<target-id>/metadata/signatures.yaml
  • artifacts/<target-id>/metadata/types.yaml
  • artifacts/<target-id>/metadata/constants.yaml
  • artifacts/<target-id>/metadata/strings.yaml
  • artifacts/<target-id>/metadata/apply-records/

Exit Expectations

  • Every function in runtime/hotpaths/call-chain.yaml has an explicit recovered name and signature before P4 starts.
  • Metadata enrichment YAML is applied to the Ghidra project only through CLI commands under the CLI lock.
  • The enrichment is reproducible from recorded baseline, runtime, and third-party evidence.

Constraints

  • Do not decompile anything in this phase.
  • Do not rewrite historical per-function outputs.
  • Do not bypass ghidra-agent-cli for supported state, baseline, callgraph, metadata, Ghidra apply, or gate operations.
  • Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.

Next Step

  • P3 gate passes → headless-ghidra-batch-decompile
Related skills
Installs
30
GitHub Stars
3
First Seen
Apr 10, 2026