binary-re-static-analysis
Analyze Binaries with r2 and Ghidra
Binary analysis is slow when function maps, xrefs, and decompiler output are scattered. This skill gives Claude, Codex, and Claude Code a staged static-analysis workflow.
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "binary-re-static-analysis" from https://skillstore.io/skills/2389-research-binary-re-static-analysis.md and its manifest at https://skillstore.io/api/skills/2389-research-binary-re-static-analysis/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "binary-re-static-analysis". I have a stripped ARM binary and need a first static pass.
Expected outcome:
The skill would propose a light radare2 workflow, list the first artifacts to collect, and defer execution until approval.
Using "binary-re-static-analysis". Which function uses this API endpoint string?
Expected outcome:
The skill would map the string to an address, inspect xrefs, identify containing functions, and summarize likely data flow.
Using "binary-re-static-analysis". I need to record findings after decompiling a function.
Expected outcome:
The skill would separate observed facts from hypotheses, cite analysis sources, update confidence, and list open questions.
Security Audit
High RiskMost static findings are false positives caused by markdown code fences and inline radare2 command names, not Ruby backtick execution. Real risks remain where the workflow asks an agent to execute sample binaries, install r2ghidra, run shell command substitution over binary-derived names, and create a fixed /tmp Ghidra project. No prompt injection or data exfiltration instructions were found.
Confirmed security concerns (2)
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (64)
📁 Filesystem access (2)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/2389-research-binary-re-static-analysis/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/2389-research-binary-re-static-analysis?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/2389-research-binary-re-static-analysis?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/2389-research-binary-re-static-analysis/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/2389-research-binary-re-static-analysis.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
2389-research. (2026). binary-re-static-analysis security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/2389-research-binary-re-static-analysis/audits/7BibTeX citation
@techreport{2389-research-2389-research-binary-re-static-analysis-2026,
author = {2389-research},
title = {binary-re-static-analysis security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/2389-research-binary-re-static-analysis/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "binary-re-static-analysis security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "2389-research"
date-released: "2026-07-04"
url: "https://skillstore.io/skills/2389-research-binary-re-static-analysis/audits/7"
identifiers:
- type: other
value: "skillstore:2389-research-binary-re-static-analysis:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: MediumWhat You Can Build
Map an unknown binary
Enumerate functions, imports, strings, and xrefs before deeper reverse engineering.
Trace risky behavior
Follow network, file, and crypto call chains from imports to caller functions.
Document firmware findings
Record facts, hypotheses, and open questions after static analysis of embedded binaries.
Try These Prompts
Plan a light static-analysis pass for this binary. Identify architecture assumptions, function enumeration, imports, strings, and first xrefs to inspect.
Help me trace this string or import through the binary. Show which functions reference it and what caller chain to inspect next.
Guide a targeted decompilation of this function. Compare decompiler output with disassembly, xrefs, local variables, and control flow.
Turn these static-analysis notes into facts, hypotheses, confidence levels, unresolved questions, and recommended dynamic checks.
Best Practices
- Confirm authorization and isolate samples before using binary analysis tools.
- Start with light analysis, then deepen only the functions that matter.
- Record facts, source commands, confidence, and unresolved questions.
Avoid
- Running unknown binaries natively without explicit approval and sandboxing.
- Using full deep analysis on large binaries before scoping the target.
- Treating decompiler output as ground truth without checking disassembly and xrefs.
Frequently Asked Questions
Does this skill execute binaries by default?
Which tools does it expect?
Can it analyze stripped binaries?
Is this only for malware analysis?
Does it replace dynamic analysis?
Can it produce final reverse-engineering reports?
Developer Details
Author
2389-researchLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/2389-research/claude-plugins/tree/main/binary-re/skills/static-analysisRef
14dc8f201a64f8d30fd131d7f036cd5e788be523
Maintenance freshness
7/18/2026
Usage
8 downloads · 177 views
File structure
📄 SKILL.md