analyzing-golang-malware-with-ghidra

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a garble-packed Go binary, or recovering function names and third-party dependencies from a stripped Go executable.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with complete executable scripts and concrete technical detail, but it is verbose (background concepts Claude knows plus large inline code) and does not exploit the provided bundle files, leaving progressive disclosure and in-workflow validation underdeveloped.

Suggestions

Move the two inline scripts out of the body and reference scripts/agent.py and scripts/process.py instead, adding a 'Quick start' that links to references/api-reference.md, references/standards.md, references/workflows.md, and assets/template.md.

Tighten the Overview and Key Concepts to remove general Go-binary background Claude already knows, keeping only Go-malware-specific insights.

Add an explicit validation checkpoint inside the workflow (e.g., verify pclntab magic and recovered function count, then branch on failure) so the sequence has a feedback loop rather than only a terminal criteria list.

Dimension	Reasoning	Score
Conciseness	The Overview and Key Concepts explain Go binary basics (static linking, large binaries, pointer-length strings) Claude largely already knows, and two large inline Python scripts inflate the body; broadly accurate and structured but not lean.	2 / 3
Actionability	Two complete, runnable scripts (a standalone Python analyzer with magic-byte detection and a Ghidra Jython script) plus concrete regex patterns and pclntab magics are copy-paste ready executable code.	3 / 3
Workflow Clarity	Two clearly sequenced steps plus a terminal Validation Criteria list, but there is no inline validate->fix->retry checkpoint or error-recovery loop within the workflow.	2 / 3
Progressive Disclosure	Bundle files exist (references/, scripts/, assets/) but the body never links to them; the two inline scripts duplicate scripts/agent.py and scripts/process.py, so content that should be separate is inline and references are not signaled.	2 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and distinctive: it lists concrete reverse-engineering actions, provides explicit 'Use when' triggers using natural analyst terminology, and occupies a clear niche unlikely to collide with other skills. It is concise without padding.

Dimension	Reasoning	Score
Specificity	Names multiple concrete actions (parse Go buildinfo/pclntab, recover stripped/obfuscated function names via GoResolver, extract embedded module/dependency strings and types), matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	Clearly states what it does ('Reverse engineer... by parsing... recovering... extracting...') and when to use it via an explicit 'Use when' clause with three triggers, matching the 'answers both what AND when with explicit triggers' anchor.	3 / 3
Trigger Term Quality	Natural terms an analyst would say ('Go-language malware sample', 'garble-packed Go binary', 'stripped Go executable', 'function names', 'third-party dependencies') give strong coverage, matching the 'good coverage of natural terms users would say' anchor.	3 / 3
Distinctiveness Conflict Risk	Narrow niche (Go-compiled malware in Ghidra) with distinct triggers tied to Go-specific structures and garble obfuscation, making conflict with other skills unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-golang-malware-with-ghidra/SKILL.md
Commit: e612f49

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.