菜单
P2 phase skill for Headless Ghidra third-party evidence. Use after P1 to review baseline/runtime artifacts, identify or rule out third-party code, record pristine sources, classify functions, and capture evidence before metadata recovery.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | headless-ghidra-evidence |
| description | P2 phase skill for Headless Ghidra third-party evidence. Use after P1 to review baseline/runtime artifacts, identify or rule out third-party code, record pristine sources, classify functions, and capture evidence before metadata recovery. |
| phase | P2 |
P2 reviews baseline and runtime YAML to identify third-party libraries, record
local pristine source directories, and classify functions for later metadata
enrichment. Source download or acquisition is outside the CLI; the CLI records
source_path, pristine_path, version, confidence, and evidence.
ghidra-agent-cli functions listghidra-agent-cli functions showghidra-agent-cli imports listghidra-agent-cli constants listghidra-agent-cli strings listghidra-agent-cli vtables listghidra-agent-cli types listghidra-agent-cli callgraph listghidra-agent-cli callgraph callersghidra-agent-cli callgraph calleesghidra-agent-cli third-party addghidra-agent-cli third-party noneghidra-agent-cli third-party set-versionghidra-agent-cli third-party listghidra-agent-cli third-party classify-functionghidra-agent-cli third-party vendor-pristineghidra-agent-cli execution-log appendghidra-agent-cli gate check --phase P2artifacts/<target-id>/baseline/functions.yamlartifacts/<target-id>/baseline/callgraph.yamlartifacts/<target-id>/baseline/types.yamlartifacts/<target-id>/baseline/constants.yamlartifacts/<target-id>/baseline/vtables.yamlartifacts/<target-id>/baseline/strings.yamlartifacts/<target-id>/baseline/imports.yamlartifacts/<target-id>/runtime/run-manifest.yamlartifacts/<target-id>/runtime/hotpaths/call-chain.yamlartifacts/<target-id>/third-party/identified.yaml if presentartifacts/<target-id>/third-party/identified.yamlartifacts/<target-id>/third-party/pristine/<library>@<version>/artifacts/<target-id>/third-party/compat/<library>@<version>/identified.yaml records at least one medium-or-higher confidence library
when third-party code is present.identified.yaml records libraries: [] when review finds no third-party
code.source_path and a pristine
directory under third-party/pristine/.third-party/compat/.ghidra-agent-cli for supported baseline reads, third-party
writes, or execution logging.headless-ghidra-discoveryRust CLI reference for the headless-ghidra pipeline. Covers command syntax, flags, output contract, artifact paths, and workspace layout for all ghidra-agent-cli subcommands. Load when: constructing a ghidra-agent-cli command, interpreting its output, resolving a flag or artifact path question, or debugging CLI behavior. Do not load for P0–P4 workflow sequencing — use the headless-ghidra skill family instead.
Thoroughly analyze a single function by first recovering its type definitions, constant definitions, vtables, function name and signature, then producing the final decompilation. Use when the user wants a complete per-function analysis following the strict recovery order: types → constants → vtables → function identity → decompilation.
Entry skill for the Headless Ghidra YAML-first reverse-engineering pipeline. Use when the user asks to analyze, decompile, triage, resume, or iterate on a binary target with Ghidra/headless-ghidra. Reads artifacts/<target>/pipeline-state.yaml, routes P0–P4 phase skills, runs gate checks, and manages review pauses. Performs zero analysis work itself.
P1 phase skill for Headless Ghidra baseline and runtime evidence. Use after P0 when the target must be imported into Ghidra, auto-analyzed, exported to baseline YAML, and given reproducible runtime or hotpath observations without decompiling function bodies.
P4 phase skill for Headless Ghidra selected function substitution. Use after P3 when an approved batch of functions should have metadata applied, be decompiled through Ghidra, and be recorded as per-function capture/substitution YAML.
P3 phase skill for Headless Ghidra metadata discovery. Use after P2, or after a P4 batch exposes missing context, to enrich function names, signatures, types, constants, strings, and hotpath metadata in YAML before serialized CLI apply.