ghidra skills

32 tagged ghidra, measured the same way as everything else here.

Browse within: reverse-engineering 40binary-analysis 15malware-analysis 15disassembly 12go-malware 11decompilation 9frida 9agentic-ai 8aggregator 8ai-tools 8LLM 6assistant 6binaryninja 6decompiler 5

ryuumonbuchi

01

elliottophellia/Ryuumonbuchi

Skill Claude CodeCodex

Operate the Ryuumonbuchi MCP server for headless Ghidra reverse engineering. Use when driving decompilation, disassembly, patching, type and symbol recovery, memory edits, transactions, and Ghidra project analysis through a Ryuumonbuchi server (stdio or streamable HTTP). Covers the safe read-only-first workflow…

not rated 79 +4 1mo ago A 126 tokens GPL-2.0

osgrep-reference

02

tdimino/bg3se-macos

Skill Claude Code

Comprehensive CLI reference and search strategies for osgrep semantic code search. Use for detailed CLI options, index management commands, search strategy guidance (architectural vs targeted queries), and troubleshooting. Complements the osgrep plugin which handles daemon lifecycle.

not rated 62 1mo ago A SkillSpector: warn 52 tokens original MIT

meltedinhex/analyst-ai-pack

Skill Claude CodeCodex

Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.

not rated 22 +1 3mo ago A 80 tokens original Apache-2.0

ghidra-agent-cli

04

ByteLandTechnology/headless-ghidra

Skill Claude CodeCodex

Rust CLI reference for the headless-ghidra pipeline. Covers command syntax, flags, output contract, artifact paths, and workspace layout for all ghidra-agent-cli subcommands. Load when: constructing a ghidra-agent-cli command, interpreting its output, resolving a flag or artifact path question, or debugging CLI…

not rated 5 5mo ago A 95 tokens

hexwitness

06

siaginw/HexWitness

Skill Claude CodeCodex

Investigate authorized binaries and runtime behavior with HexWitness's durable evidence MCP and optional Binary Ninja or IDA live tools. Use for function or class discovery, UUID and field mapping, protocol reconstruction, capture comparison, contradiction analysis, evidence-gap planning, and promotion of live…

not rated 2 15d ago A 64 tokens

debugger-review

07

dwgx/debugger-workstation

Skill Claude CodeCodex

A review process for reverse-engineering work, such as unpacking software, rebuilding tools, or downloading required tooling. Reverse engineering means examining compiled software to understand how it works.

not rated 2 1mo ago A 54 tokens

At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: