forensics
A reference tool for solving CTF forensics challenges using industry-standard analysis commands.
Install
mkdir -p .claude/skills/forensics && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/14916" && unzip -o skill.zip -d .claude/skills/forensics && rm skill.zipInstalls to .claude/skills/forensics
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
CTFのForensics（フォレンジクス）ジャンル。パケット解析、ファイルカービング、ステガノグラフィ、メモリフォレンジクスについて説明。Forensics問題に取り組む際に参照。Key capabilities
- →Extract embedded files from evidence using binwalk or foremost
- →Analyze network packets with tshark and scapy
- →Perform steganalysis on image files
- →Analyze memory dumps with Volatility 3
- →Extract data from ZIP archives
How it works
The skill provides command-line and script-based instructions for various forensic tools to analyze different types of digital evidence. It guides through initial analysis, packet inspection, file carving, steganalysis, and memory forensics.
Inputs & outputs
When to use forensics
- →Analyzing pcap files
- →Extracting embedded files from binaries
- →Performing memory forensics on dumps
About forensics
Summarizes techniques for packet analysis, file carving, and memory forensics. It provides specific command-line instructions for tools like Wireshark, Volatility, and binwalk.
CTFのForensics（フォレンジクス）ジャンル。パケット解析、ファイルカービング、ステガノグラフィ、メモリフォレンジクスについて説明。Forensics問題に取り組む際に参照。
When not to use it
- →When the task does not involve digital forensic analysis
- →When the evidence is not in a supported format
Limitations
- →Requires specific forensic tools to be installed
- →Packet analysis is focused on pcap/pcapng formats
- →Memory analysis is specifically for Volatility 3
How it compares
This skill centralizes and provides specific tool commands and Python scripts for common forensic tasks, offering a structured approach to analyzing digital evidence compared to manually researching and executing individual tool functionali
Compared to similar skills
forensics side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| forensics (this skill) | 0 | 5mo | Review | Advanced |
| censys | 0 | — | Review | Intermediate |
| idapython | 4 | 7mo | No flags | Advanced |
| offensive-exploit-dev-course | 0 | 2mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
censys
eliferjunior
>-
idapython
mrexodia
IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida_* modules (50+), idautils iterators, and common patterns.
offensive-exploit-dev-course
26zl
Full exploit development course roadmap and syllabus: weekly topics, recommended reading, lab setup, and learning path from vulnerability classes through advanced exploitation. Use to structure exploit dev training or onboard new researchers. Use only for authorized security research, training, or a
senior-security
davila7
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
security-header-generator
Dexploarer
Generates security HTTP headers (CSP, HSTS, CORS, etc.) for web applications to prevent common attacks. Use when user asks to "add security headers", "setup CSP", "configure CORS", "secure headers", or "HSTS setup".
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.