How to use the Analyzing Golang Malware with Ghidra agent skill

What the skill makes the agent do

Go binaries are large, often 5-15MB with thousands of functions, and they are frequently stripped or obfuscated. The skill directs the agent to read Go's metadata rather than rely on symbol tables, since the pclntab structure retains function names even in stripped binaries.

The source also describes GoResolver, a Ghidra plugin that uses control-flow graph similarity to recover names of functions renamed by obfuscators such as garble. The bundled helper scripts scan a binary and produce a summary of suspicious strings, dependencies and hashes.

• Locate Go build info and report the Go version string when found
• Locate the pclntab and report its approximate Go version range
• Recover function names and group them into categories such as network, crypto and os/exec
• Extract module paths that reveal third-party dependencies

Install the skill

Download the skill ZIP from this page. To make it available in Claude Code for your user account, unzip it into ~/.claude/skills/. To scope it to one project, unzip it into the project's .claude/skills/ folder.

In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills

Install the requirements

The skill expects Python 3.9+, Ghidra 11.0+ with JDK 17+, and the Go Reverse Engineering Tool Kit (go-re.tk). The GoResolver Ghidra plugin is optional and is needed only for function name recovery.

• Python 3.9+ for the helper scripts
• Ghidra 11.0+ with JDK 17+
• GoResolver plugin (optional, for function name recovery)
• Go Reverse Engineering Tool Kit (go-re.tk)

Trigger the skill with a natural request

You do not need a special command. Describe the task in plain language that mentions a Go sample, a stripped Go executable, or garble-packed code. The skill's description covers requests such as analyzing a Go-language malware sample, deobfuscating a garble-packed Go binary, or recovering function names and dependencies from a stripped Go executable.

Give the agent the file path to the sample and say what you want, for example a triage summary or a list of dependencies.

• Analyze this Go malware sample and list its third-party dependencies
• This Go executable is stripped. Recover the function names and group them by category
• Triage this garble-packed Go binary and fill in the sample information report

Run it safely in an isolated lab

The samples are malicious and the bundled scripts read and process untrusted binaries. Run the analysis in an isolated analysis VM, not on a live production or personal machine.

The skill runs scripts (scripts/agent.py and scripts/process.py). The source states it does not use the network. The skill is not suited to non-Go binaries because its pattern matching and metadata checks assume Go compilation.

• Use an isolated analysis VM
• Do not run it on production or personal machines
• Expect heuristics, not a complete decompilation

Read the output with its limits in mind

The scripts use regex heuristics, and the pclntab magic values listed in the source are approximate across Go versions. Treat the output as triage leads to verify in Ghidra rather than final results.

The skill includes a report template with sections for sample information, recovered functions, dependencies, C2 infrastructure and recommendations. Fill it in as you confirm findings.

• Verify each recovered function and dependency in Ghidra
• Treat the pclntab version as approximate
• Fill the report template sections only with confirmed values