binary-analysis

Binary Analysis — Agent Skill

Plan analysis of unknown binary files through a deterministic, non-interactive CLI intended for Ghidra; see the implementation limitation below. The skill teaches you how to reason about binaries: when to triage versus deep-dive, how to interpret canonical evidence, and how to produce auditable reports. All observable operations happen through the binary CLI — you never call Ghidra APIs directly.

Implementation status

This release does not provide live Ghidra analysis. Import, analyze, metadata, structural/function queries, search, triage, and report generation stop with an explicit backend error. Installing dependencies cannot make the unfinished adapter operational. Project administration and dependency diagnostics remain available. The production CLI does not load or select FakeAdapter; tests inject it explicitly. There is no fixture/demo CLI switch or environment override.

The workflow below describes the intended interface, not runnable analysis in this release. Stop at the backend error and explain the limitation. Do not cite old fixture-derived reports as evidence about a user's binary, even if an old project is marked READY. A future live backend needs verification on distinct known binaries before results can be treated as observations.

When to Use

Load this skill when any of the following conditions match:

• A user provides a binary file (PE, ELF, Mach-O, firmware image) and asks what it does, what APIs it imports, or whether it is suspicious.
• A user asks for decompilation, disassembly, call-graph exploration, or cross-reference analysis of a specific function or address.
• A user wants a structured triage report, suspicious-API analysis, or capability map for an unknown binary.
• A user asks to compare two binaries, verify export tables, or extract strings matching a pattern.
• A user wants to set up the analysis toolchain (binary doctor, binary bootstrap) or manage analysis projects.