Agent skill · magnus919
binary-analysis
Analyze unknown binary files through a deterministic CLI that wraps Ghidra's static-analysis engine. Use when you need to inspect a PE, ELF, or Mach-O file — triage suspicious binaries, map imported APIs, decompile functions, trace call paths, or produce structured evidence reports. Do not use for runtime analysis (debugging, dynamic tracing, sandbox execution), for modifying or patching binaries, or for binaries you already know everything about. The skill owns planning, hypothesis formation, and evidence synthesis; the CLI owns all deterministic operations.
What it needs
About 8k tokens when loaded.
What this skill does
Binary Analysis — Agent Skill Analyze unknown binary files with a deterministic, non-interactive CLI backed by Ghidra's static-analysis engine. The skill teaches you how to reason about binaries: when to triage versus deep-dive, how to interpret canonical evidence, and how to produce auditable reports. All observable operations happen through the binary CLI — you never call Ghidra APIs directly. When to Use Load this skill when any of the following conditions match: A user provides a binary file (PE, ELF, Mach-O, firmware image) and asks what it does, what APIs it imports, or whether it is suspicious. A user asks for decompilation, disassembly, call-graph exploration, or cross-reference analysis of a specific function or address. A user wants a structured triage report, suspicious-API analysis, or capability map for an unknown binary. A user asks to compare two binaries, verify export tables, or extract strings matching a pattern. A user wants to set up the analysis toolchain (binary doctor, binary bootstrap) or manage analysis projects. When Not to Use Do not load this skill for: Runtime or dynamic analysis — debugging, strace/dtrace, sandbox execution, process monitoring. This skill is static-analysis only (V1). Binary patching or modification — hex-editing, resource editing, repackaging. The analysis harness is read-only by design. Binaries you already fully understand — if the user is asking for documentation or explanation of known code, use a general-purpose skill. Source-code analysis — C, C++, Rust, or assembly source files. Use a language-specific or general code-analysis skill instead. Network forensics or packet capture — PCAP analysis, protocol reverse engineering at the wire level. Use a network-focused skill. Live memory forensics — process memory dumps, heap analysis. Static analysis of memory-mapped regions from files is in scope; live-process introspection is not. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills magnus919/binary-analysis