memory-forensics
wshobsonMaster memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
memory-forensics
sickn33Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating inciden...
forensics-data-collector
Forensics Data Collector - Auto-activating skill for Security Advanced. Triggers on: forensics data collector, forensics data collector Part of the Security Advanced skill category.
chain-forensics
a5c-aiOn-chain analysis and transaction forensics for blockchain security investigations. Provides capabilities for tracing fund flows, identifying suspicious patterns, MEV analysis, and generating forensic reports for incident response.
incident-forensics
a5c-aiDigital forensics and incident response capabilities. Analyze memory dumps with Volatility, parse filesystem artifacts, extract browser forensics, analyze Windows event logs, create forensic timelines, recover deleted files, and generate forensic reports.
report-template
HaaaiawdAggregates all analyses from the Scout phase (build-inspector, runtime-inspector, git-forensics, concept-modeler) to produce a decision-ready system risk report.
git-forensics
HaaaiawdAnalyze Git history to discover 'logical coupling' (files that tend to be changed together) and 'hotspots' (complex modules modified frequently). Based on Adam Tornhill's methodology from 'Your Code as a Crime Scene'.
security-audit-logging
aj-geddesImplement comprehensive security audit logging for compliance, forensics, and SIEM integration. Use when building audit trails, compliance logging, or security monitoring systems.
analysis-tshark
AgentSecOpsNetwork protocol analyzer and packet capture tool for traffic analysis, security investigations, and forensic examination using Wireshark's command-line interface. Use when: (1) Analyzing network traffic for security incidents and malware detection, (2) Capturing and filtering packets for forensic analysis, (3) Extracting credentials and sensitive data from network captures, (4) Investigating network anomalies and attack patterns, (5) Validating encryption and security controls, (6) Performing protocol analysis for vulnerability research.
forensics-osquery
AgentSecOpsSQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases. Enables rapid evidence collection, threat hunting, and incident response across Linux, macOS, and Windows endpoints. Use when: (1) Investigating security incidents and collecting forensic artifacts, (2) Threat hunting across endpoints for suspicious activity, (3) Analyzing running processes, network connections, and persistence mechanisms, (4) Collecting system state during incident response, (5) Querying file hashes, user activity, and system configuration for compromise indicators, (6) Building detection queries for continuous monitoring with osqueryd.
crack-hashcat
AgentSecOpsAdvanced password recovery and hash cracking tool supporting multiple algorithms and attack modes. Use when: (1) Performing authorized password auditing and security assessments, (2) Recovering passwords from captured hashes in forensic investigations, (3) Testing password policy strength and complexity, (4) Validating encryption implementations, (5) Conducting security research on cryptographic hash functions, (6) Demonstrating password weakness in penetration testing reports.
ir-velociraptor
AgentSecOpsEndpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale. Use when: (1) Conducting forensic investigations across multiple endpoints, (2) Hunting for indicators of compromise or suspicious activities, (3) Collecting endpoint telemetry and artifacts for incident analysis, (4) Performing live response and evidence preservation, (5) Monitoring endpoints for security events, (6) Creating custom forensic artifacts for specific threat scenarios.
password-recovery
letta-aiThis skill provides guidance for recovering passwords or sensitive data from disk images, corrupted files, or forensic scenarios. Use this skill when tasked with extracting passwords from disk images, recovering deleted files containing credentials, or performing data forensics to find lost authentication information.
brand-positioning
majesticlabs-devDefine your brand's core identity - purpose, values, personality, and positioning statement. Use when building a new brand, rebranding, or need a strategic foundation for voice, design, and brand decisions. Not for personal voice extraction (use style-forensics).
forensic-data-engineer
daffy0208Expert in data forensics, anomaly detection, audit trail analysis, fraud detection, and breach investigation
memory-forensics
oimiragieoMaster memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
deepfake-detection
dirnbauerMultimodal media authentication and deepfake forensics. PRNU analysis, IGH classification, DQ detection, semantic forensics, and LLM-augmented sensemaking for the post-empirical era. Use when working with deepfake, media forensics, fake detection, synthetic media, prnu, image authentication, video verification, disinformation.
automating-messages
SpillwaveSolutionsAutomates macOS Messages (iMessage/SMS) via JXA with reliable service→buddy resolution. Use when asked to 'automate iMessage', 'send Messages via script', 'JXA Messages automation', or 'read Messages history'. Covers send-bug workarounds, UI scripting for attachments, chat.db forensics, and launchd polling bots.
archive-searcher
Professional Git Forensics and Archival Intelligence for deep historical recovery.
utility-pro
Master of the Modern Utility Toolbelt, specialized in AI-enhanced CLI, structured data transformation, and advanced Unix forensics.
responding-to-security-incidents
BbgnsurfTechGuide security incident response, investigation, and remediation processes. Use when you need to handle security breaches, classify incidents, develop response playbooks, gather forensic evidence, or coordinate remediation efforts. Trigger with phrases like "security incident response", "ransomware attack response", "data breach investigation", "incident playbook", or "security forensics".
memory-forensics
agent-skills-hubMaster memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
memprocfs-assistant
Tokeii0Assists with memory analysis and forensics using MemProcFS. Use when analyzing memory dumps, investigating system activity, or performing forensic examinations.
memory-forensics
ngxtmMaster memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating inciden...
memprocfs-assistant-zh
Tokeii0Assist with memory analysis and forensics using MemProcFS. Use when you need to analyze memory dumps, investigate system activity, or perform forensic examinations.
performing-cloud-storage-forensic-acquisition
mukul975Perform forensic acquisition and analysis of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by collecting both API-based remote data and local sync client artifacts from endpoint devices.
investigating-ransomware-attack-artifacts
mukul975Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.
performing-linux-log-forensics-investigation
mukul975Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal, kern.log, and application logs to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised Linux systems.
analyzing-slack-space-and-file-system-artifacts
mukul975Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
extracting-credentials-from-memory-dump
mukul975Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.
detecting-process-injection-techniques
mukul975Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.
analyzing-network-traffic-for-incidents
mukul975Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.
performing-network-packet-capture-analysis
mukul975Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity.
performing-sqlite-database-forensics
mukul975Perform forensic analysis of SQLite databases to recover deleted records from freelists and WAL files, decode encoded timestamps, and extract evidence from browser history, messaging apps, and mobile device databases.
performing-endpoint-forensics-investigation
mukul975Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.
performing-cloud-forensics-investigation
mukul975Conduct forensic investigations in cloud environments by collecting and analyzing logs, snapshots, and metadata from AWS, Azure, and GCP services.
analyzing-windows-lnk-files-for-artifacts
mukul975Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.
performing-log-analysis-for-forensic-investigation
mukul975Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.
analyzing-disk-image-with-autopsy
mukul975Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.
performing-active-directory-compromise-investigation
mukul975Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.
hunting-for-shadow-copy-deletion
mukul975Hunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.
extracting-browser-history-artifacts
mukul975Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.
collecting-volatile-evidence-from-compromised-host
mukul975Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.
performing-mobile-device-forensics-with-cellebrite
mukul975Acquire and analyze mobile device data using Cellebrite UFED and open-source tools to extract communications, location data, and application artifacts.
building-incident-timeline-with-timesketch
mukul975Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.
performing-insider-threat-investigation
mukul975Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case. Activates for requests involving insider threat investigation, employee data theft, privilege misuse, user behavior anomaly, or internal threat detection.
performing-steganography-detection
mukul975Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.
analyzing-network-covert-channels-in-malware
mukul975Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 and data exfiltration.