skills/galyarderlabs/galyarder-framework/reverse-engineering-malware-with-ghidra/Gen Agent Trust Hub
reverse-engineering-malware-with-ghidra
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/agent.pyscript usessubprocess.run()to execute the Ghidra headless analyzer (analyzeHeadless). It manages command-line arguments to import binaries and execute analysis scripts, which is a core function of the automation tool. - [DYNAMIC_EXECUTION]: The skill performs dynamic script generation in
scripts/agent.pyvia theexport_functions_ghidrafunction. It writes a temporary Python script to the project directory and executes it within the Ghidra environment to facilitate data extraction. - [INDIRECT_PROMPT_INJECTION]: By design, the skill ingests and decompiles untrusted malware binaries. Maliciously crafted strings or comments within a binary could potentially attempt to influence the agent's reasoning or output when it processes the results of the disassembly and decompilation.
- [EXTERNAL_DOWNLOADS]: The
SKILL.mdfile provides links to the official Ghidra website (ghidra-sre.org) for mandatory tool installation. These references are appropriate for the skill's stated purpose of malware analysis.
Audit Metadata