analyzing-golang-malware-with-ghidra

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a garble-packed Go binary, or recovering function names and third-party dependencies from a stripped Go executable.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-golang-malware-with-ghidra/SKILL.md

Quality

Content

53%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is actionable with concrete runnable scripts, but it is padded with background Claude already knows and, critically, ignores its own bundle by inlining large scripts instead of pointing to scripts/agent.py and references/*, which is a progressive-disclosure failure.

Suggestions

Replace the two inlined scripts with pointers to the existing bundle (scripts/agent.py, scripts/process.py) and surface references/api-reference.md, references/workflows.md, references/standards.md, and assets/template.md as one-level-deep links so the body becomes a true overview.

Trim the Overview and Key Concepts sections to Go/Ghidra-specific details Claude would not already know, and replace the generic 'When to Use' bullets with skill-specific triggers.

Integrate the Validation Criteria as explicit checkpoints within the workflow (e.g., after Step 1 verify pclntab was located before proceeding to Step 2) to add feedback loops.

Dimension	Reasoning	Score
Conciseness	Mostly efficient but padded in places: the Overview re-explains Go's malware popularity and binary sizes, Key Concepts re-explains what pclntab/moduledata are, and the 'When to Use' bullets are generic templates ('When investigating security incidents that require analyzing golang malware with ghidra').	3 / 5
Actionability	Two complete, runnable scripts (a standalone analyzer with usage and a Ghidra-API script) give mostly executable, copy-paste-ready guidance; minor gap is the Ghidra 'Fixing Go string references...' block which only prints rather than actually fixing.	4 / 5
Workflow Clarity	A Step 1 / Step 2 sequence exists and a detached 'Validation Criteria' checklist is present, but there are no integrated validation checkpoints or feedback loops between steps — criteria are listed separately rather than sequenced into the workflow.	3 / 5
Progressive Disclosure	The bundle ships scripts/agent.py, scripts/process.py, references/{api-reference,workflows,standards}.md and assets/template.md, yet the body inlines ~220 lines of its own Python and references none of these bundle files — content that clearly belongs in separate files is inlined and existing references are neither signaled nor navigable.	2 / 5
	Total	12 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states concrete capabilities and gives explicit, natural-language trigger scenarios. The only minor gap is the absence of file-extension trigger terms, which are less standardized for Go binaries anyway.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'parsing Go buildinfo and pclntab structures', 'recovering stripped/obfuscated function names (e.g. via GoResolver)', 'extracting embedded module/dependency strings and types' — giving comprehensive coverage rather than vague verbs.	5 / 5
Completeness	Explicitly answers both: the 'what' (reverse engineer Go malware in Ghidra via buildinfo/pclntab/GoResolver) and the 'when' via a concrete 'Use when...' clause naming three trigger scenarios.	5 / 5
Trigger Term Quality	Strong natural triggers ('analyzing a Go-language malware sample', 'deobfuscating a garble-packed Go binary', 'recovering function names... from a stripped Go executable') with synonyms (stripped/obfuscated/garble), but no file-extension cues (.exe/ELF), leaving a few natural terms missing.	4 / 5
Distinctiveness Conflict Risk	The 'Go-compiled malware + Ghidra + pclntab/GoResolver' niche is highly specific with distinct triggers, creating minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-golang-malware-with-ghidra/SKILL.md
Commit: 54a7988

Reviewed: ~1 hour ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.