ghidra-iterative-re SKILL.md skillA
ghidra-iterative-re from gerev/ghidra-iterative-re is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add gerev/ghidra-iterative-re/ghidra-iterative-re@git:20261021.e802efdPins git:20261021.e802efd in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- gerev/ghidra-iterative-re
- Path
SKILL.md- Versions recorded
- 5
- Latest version
- git:20261021.e802efd, committed Oct 21, 2026
- First version recorded
- Sep 10, 2026
- Size
- 39,637 bytes
- Repository stars
- 5
- License
- MIT
Use when reverse-engineering a game (or any binary) in Ghidra via MCP or PyGhidra - establishes the apply-cascade-verify loop, the SourceType trust model that stops an agent corroborating its own guesses, invariant bracketing against Ghidra's silent collateral damage, and the game-specific evidence sources worth sweeping before any analysis.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Iterative reverse engineering in Ghidra Ghidra is not a disassembly viewer you read from. It is an inference engine with a persistent, versioned database. Knowledge you apply changes what the decompiler shows you next, which is where the next round of knowledge comes from. Refusing to write to it throws away the tool's main mechanism and is the more expensive choice. But the loop has a failure mode batch analysis does not: **you can corroborate your own guesses.** Apply an inference, re-read, and the confirming read looks independent when it is not. This file is the loop and the rules that bind every round; the catalogues behind it are in `references/`, keyed by the kind of work you are about to do. **Confidence convention.** Claims marked *(doc)* come from Ghidra's own documentation but have not been executed. Unmarked claims were either measured live or are project history. Quoted numbers from one binary are examples for calibration, not properties of yours. ## Start here **The loop below begins at `apply`, and on a binary you have just opened there is nothing to apply yet.** Two different things bring you to this file, and they have different first …
Read the whole file at its exact version.
How to install
mdr add gerev/ghidra-iterative-re/ghidra-iterative-re@sha256:a018719cd4f250afThe line at the top of this page pins the label git:20261021.e802efd, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_dl4dv5pyteb54ydd)
0 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Sep 10, 2026 and Oct 21, 2026, about one every 10 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261021.e802efd latest | 2026-10-21 | e802efd | 39,637 B | A | view · diff |
| git:20260921.440ee23 | 2026-09-21 | 440ee23 | 39,393 B | A | view · diff |
| git:20260911.f2f2dad | 2026-09-11 | f2f2dad | 35,997 B | A | view · diff |
| git:20260911.af73cb9 | 2026-09-11 | af73cb9 | 34,856 B | A | view · diff |
| git:20260910.b0a110d | 2026-09-10 | b0a110d | 34,064 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (39637 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
gerev/ghidra-iterative-re · 5 stars · license MIT · pushed 2026-11-09 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_dl4dv5pyteb54ydd GET https://markdownregistry.com/api/v1/resolve?ref=gerev/ghidra-iterative-re/ghidra-iterative-re GET https://markdownregistry.com/api/v1/blob/a018719cd4f250af427b677f19eeb4e9adda31e0d019a2d68d17379dd0019dbc
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.