Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add zhaoxuya520/reverse-skill/skills/digital-forensicsCompatible with
Supported agents
| name | digital-forensics |
| description | Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation. |
NOW: 读取 ../field-journal/precedent-pentest.md 或组织 IR 授权说明NOW: 确认是取证/溯源而非进攻性扫描NOW: 建立 case；证据只读副本优先（原始介质写保护）NEXT: tool-index；Volatility 等常手动ACT: 保全哈希 → 时间线 → 关键伪影protocol-reverse/）malware-analysis/ / threat-hunting/）□ 计算 SHA256；记录时区与采集命令
□ 工作在副本上；原始只读
□ chain of custody 备注写入 timeline
vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdline
□ 事件日志：Security / PowerShell / Sysmon
□ 持久化：Run 键、服务、计划任务、WMI
□ 执行痕迹：Amcache、Prefetch、BAM
□ tshark 统计会话与 DNS
□ 导出可疑流 → protocol-reverse 或 malware C2 分析
| 工具 | 用途 |
|---|---|
| Volatility 3 | 内存 |
| Timeline Explorer / Plaso | 超级时间线 |
| tshark | PCAP |
| Eric Zimmerman 工具集 | Windows 伪影 |
| Autopsy / FTK Imager | 磁盘 |
references/forensics-triage.md../malware-analysis/ ../threat-hunting/ ../protocol-reverse/上游: MASTER R25
下游: 恶意样本深挖 → malware-analysis；规则 → threat-hunting
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versiondigital-forensicsExecute the skills CLI command in your project's root directory to begin installation:
epx add zhaoxuya520/reverse-skill/skills/digital-forensicsFetches digital-forensics from zhaoxuya520/reverse-skill and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/digital-forensics
Restart Cursor to activate digital-forensics. Access via /digital-forensicsin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
ida-reverse
zhaoxuya520/reverse-skill · security · same repo
ghidra-reverse
zhaoxuya520/reverse-skill · security · same repo
cloud-k8s
zhaoxuya520/reverse-skill · security · same repo
radio-sdr
zhaoxuya520/reverse-skill · security · same repo
macos-reverse
zhaoxuya520/reverse-skill · security · same repo
diagram-generator
zhaoxuya520/reverse-skill · security · same repo
Solid pick for teams standardizing on skills: digital-forensics is focused, and the summary matches what you get after install.
digital-forensics fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
digital-forensics reduced setup friction for our internal harness; good balance of opinion and flexibility.
digital-forensics has been reliable in day-to-day use. Documentation quality is above average for community skills.
I recommend digital-forensics for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
Keeps context tight: digital-forensics is the kind of skill you can hand to a new teammate without a long onboarding doc.
Registry listing for digital-forensics matched our evaluation — installs cleanly and behaves as described in the markdown.
We added digital-forensics from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
digital-forensics is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
digital-forensics reduced setup friction for our internal harness; good balance of opinion and flexibility.
showing 1-10 of 47