binary-analysis

Binary Analysis — Agent Skill

Analyze unknown binary files with a deterministic, non-interactive CLI backed by Ghidra's static-analysis engine. The skill teaches you how to reason about binaries: when to triage versus deep-dive, how to interpret canonical evidence, and how to produce auditable reports. All observable operations happen through the binary CLI — you never call Ghidra APIs directly.

When to Use

Load this skill when any of the following conditions match:

• A user provides a binary file (PE, ELF, Mach-O, firmware image) and asks what it does, what APIs it imports, or whether it is suspicious.
• A user asks for decompilation, disassembly, call-graph exploration, or cross-reference analysis of a specific function or address.
• A user wants a structured triage report, suspicious-API analysis, or capability map for an unknown binary.
• A user asks to compare two binaries, verify export tables, or extract strings matching a pattern.
• A user wants to set up the analysis toolchain (binary doctor, binary bootstrap) or manage analysis projects.

When Not to Use

Do not load this skill for:

• Runtime or dynamic analysis — debugging, strace/dtrace, sandbox execution, process monitoring. This skill is static-analysis only (V1).
• Binary patching or modification — hex-editing, resource editing, repackaging. The analysis harness is read-only by design.
• Binaries you already fully understand — if the user is asking for documentation or explanation of known code, use a general-purpose skill.
• Source-code analysis — C, C++, Rust, or assembly source files. Use a language-specific or general code-analysis skill instead.
• Network forensics or packet capture — PCAP analysis, protocol reverse engineering at the wire level. Use a network-focused skill.
• Live memory forensics — process memory dumps, heap analysis. Static analysis of memory-mapped regions from files is in scope; live-process introspection is not.