Guide · Agent skill
How to use the Ghidra Reverse Engineering agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The ghidra-reverse skill gives an AI agent a structured workflow for reverse engineering compiled programs with Ghidra, a free, open-source tool. It is for security students and analysts who want binary analysis without a paid IDA license, or who need to decompile many samples in a script. After this guide you will know how to install the skill, how to ask for it in plain language, and what you need on your machine before it can work.
Ghidra Reverse Engineeringzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Download the skill. Download the ghidra-reverse ZIP from this page and unzip it so that SKILL.md sits in a ghidra-reverse folder.
- 2Place the folder. Copy the folder to ~/.claude/skills/ for personal use, or to .claude/skills/ inside a project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install Ghidra and Java. Install Ghidra locally by manual download or package manager, and make sure a Java runtime is available for it.
- 4Decide on optional tools. Install ghidra-mcp only if you want MCP workflows, and ghidriff only if you need patch diffing.
- 5Ask in plain language. Name the binary, its path and the goal, such as decompiling a function or batch-processing a folder.
- 6Check the paths. Make sure the analyzeHeadless path and any companion files the agent expects are correct on your machine before running on real samples.
What is an agent skill and what does this one do?
An agent skill is a folder with a SKILL.md file that tells an AI agent how to handle a certain kind of task. When the skill is installed and relevant, the agent follows its steps instead of improvising.
This skill covers free or open reverse engineering with Ghidra, either headless (no window, run from the command line) or through the GUI. Its described workflow covers importing a binary, running auto-analysis, finding key functions from strings or imported APIs, decompiling them to readable pseudo-code, and renaming or annotating them.
- Import a file into a Ghidra project and run the default analyzers
- Record the language, compiler detection and base address
- Find functions from strings or imported API names, then decompile them
- Rename functions and variables and add plate comments
- Run batch decompilation of many samples in headless mode
- Optionally use a Ghidra MCP bridge so the AI can pull decompilation and cross-references directly
Install the ghidra-reverse skill
Download the skill ZIP from this page and unzip it. The skill folder must contain SKILL.md, which is what the agent reads. For a personal install, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.
If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there.
- Personal install: ~/.claude/skills/ghidra-reverse/
- Project install: .claude/skills/ghidra-reverse/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload
Install the requirements
The skill does not bundle Ghidra. You need a local Ghidra installation, obtained either by manual download or through a package manager. Ghidra also needs a Java runtime. The skill's own tool list names Ghidra, ghidra-mcp and ghidriff.
ghidra-mcp is only needed if you want MCP workflows. ghidriff is only needed for patch diffing. The skill also refers to a tool-index file and a field-journal file that are not included in the files provided with it, so the paths it expects to find there may need to be supplied by your own setup.
- Ghidra installed locally (required)
- Java runtime for Ghidra (required)
- ghidra-mcp bridge (optional, for MCP workflows)
- ghidriff (optional, for patch diffing)
- Command-line familiarity
How to trigger the skill with natural requests
You do not need special syntax. Name the tool and the task in plain language, and say what you have. The skill is meant to activate when you want Ghidra specifically, when you do not have IDA, or when you want to batch-process samples.
Give the agent the file path and say what you want out of it. Naming a function, string or API you are interested in helps it pick a starting point.
- Analyse ./samples/loader.bin with Ghidra and decompile the function that calls CreateProcessA
- Use Ghidra headless to decompile every binary in ./corpus and export the results
- I don't have IDA. Find where this program reads its config string and rename the function that parses it
- Set up a Ghidra MCP workflow and pull cross-references for the main function
Run Ghidra in headless batch mode
For many samples, the skill describes running Ghidra's analyzeHeadless command. The skill notes that the install path varies, so the agent should read it from your tool-index file rather than guess it. The example it gives imports a sample into a project and runs a post-script that exports decompiled output.
The post-script name in the example, ExportDecomp.py, is not included with the skill, so you must provide it or adapt the example to your own script.
- Replace the example path with the analyzeHeadless location on your machine
- Confirm the project name and the script before running on many files
- Scripts can be written in Java, Python (Jython) or PyGhidra, according to the skill
analyzeHeadless /path/to/project Proj -import sample.bin -postScript ExportDecomp.pyUse the MCP bridge (optional)
If you have configured ghidra-mcp, the skill tells the agent to confirm the MCP port first. It names 8765 as a common port but says the tool-index file is the reference, so the agent should not guess the port. Once confirmed, the agent can request decompilation and cross-references through MCP tools.
- Confirm the ghidra MCP port before use
- Use the MCP tools for decompilation and xrefs
- The skill says the agent must not guess ports
Work with the Ghidra GUI shortcuts
The bundled cheatsheet lists default GUI actions. These are useful when you check the agent's work by hand or when you do part of the analysis yourself.
- Decompile: double-click a function, then Decompile
- Rename: press L
- Add a comment: press ;
- Cross-references: right-click, then References
- Search strings: Search → For Strings
- Scripts: Window → Script Manager
What people use it for
- Decompile a suspicious function in a sample after finding its imported API calls
- Batch-decompile a folder of binaries in a scripted pipeline using headless mode
- Learn Ghidra's workflow for a security course without buying IDA
- Rename and annotate functions in a project so the analysis is repeatable
Frequently asked questions
Is the Ghidra reverse engineering skill free?
The skill is listed under the MIT licence, and Ghidra itself is a free, open-source tool from the NSA. You still need a local Ghidra install and a Java runtime, and the optional ghidriff and ghidra-mcp tools must be installed separately if you use them.
What do I need before installing this skill?
You need Ghidra installed locally and a Java runtime for it. Command-line familiarity is expected, and ghidra-mcp and ghidriff are optional depending on the workflow you want.
Does this skill run scripts or use the network?
The skill runs scripts, including headless Ghidra post-scripts, so review them before running on your machine. The listing states that it does not use the network.
How is this different from the IDA skill?
The skill's own guidance is to use the IDA-based skill when you already have IDA MCP for deep analysis. This Ghidra skill is for open-source, batch and teaching use, while a separate radare2 skill covers quick command-line reconnaissance.
Can I use it to crack software or bypass licensing?
The skill is aimed at deep binary analysis and is not meant for cracking software or bypassing licensing without authorisation. It can route exploit-related work to another skill, so it is not suited to that use.
Why does the agent say it cannot find the tool-index file?
The skill refers to a tool-index and a field-journal file that are not included with the provided files. You need to supply those paths or local setup for the agent to read tool locations rather than guess.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you want a free, repeatable Ghidra workflow for learning, analysis or batch decompilation and you are comfortable with the command line. Pick a point-and-click tool or a commercial disassembler instead if you need a graphical experience without local setup, or if your work depends on the companion files this package does not include.
Download the skill