Expand 39 api-reference stubs with real tool docs, expand 15 agent.py boilerplate stubs

skills/analyzing-golang-malware-with-ghidra/SKILL.md

@@ -14,6 +14,14 @@ license: Apache-2.0
 
 Go (Golang) has become a popular language for malware authors due to its cross-compilation capabilities, static linking that produces self-contained binaries, and the complexity it introduces for reverse engineering. Go binaries contain the entire runtime, standard library, and all dependencies statically linked, resulting in large binaries (often 5-15MB) with thousands of functions. Ghidra struggles with Go-specific string formats (non-null-terminated), stripped function names, and goroutine concurrency patterns. Specialized tools like GoResolver (Volexity, 2025) use control-flow graph similarity to automatically deobfuscate and recover function names in stripped or obfuscated Go binaries.
 
+
+## When to Use
+
+- When investigating security incidents that require analyzing golang malware with ghidra
+- When building detection rules or threat hunting queries for this domain
+- When SOC analysts need structured procedures for this analysis type
+- When validating security monitoring coverage for related attack techniques
+
 ## Prerequisites
 
 - Ghidra 11.0+ with JDK 17+