FrancoStino/digital-forensics
bundled-skills/digital-forensics/SKILL.md
Authorized digital forensics: memory dumps, disk timelines, PCAP investigation, artifact triage, and incident-response evidence preservation.
$ install --global
skillsauthnpx skillsauth add FrancoStino/opencode-skills-antigravity digital-forensicsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 30, 2026, 2:12 AM39.0s2 files scanned
SKILL.md
- name:
- digital-forensics
- description:
- Authorized digital forensics: memory dumps, disk timelines, PCAP investigation, artifact triage, and incident-response evidence preservation.
- risk:
- safe
- source:
- https://github.com/zhaoxuya520/reverse-skill
- source_repo:
- zhaoxuya520/reverse-skill
- source_type:
- community
- date_added:
- 2026-08-25
- license:
- MIT
- license_source:
- https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE
Digital Forensics & IR Artifacts
When to Use
- Investigating a suspected incident with forensic rigor.
- Building defensible timelines from disk/memory/network artifacts.
适用场景
- 内存转储分析（Volatility 2/3）
- 磁盘/ E01 / 落地文件时间线
- PCAP 溯源与协议还原（可联合
protocol-reverse/） - 主机伪影：Prefetch、Shimcache、Event Log、浏览器历史
- 应急响应 IOC 提炼（联合
malware-analysis//threat-hunting/）
工作流
1. 保全
□ 计算 SHA256；记录时区与采集命令
□ 工作在副本上；原始只读
□ chain of custody 备注写入 timeline
2. 内存
vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdline
3. 主机伪影
□ 事件日志：Security / PowerShell / Sysmon
□ 持久化：Run 键、服务、计划任务、WMI
□ 执行痕迹：Amcache、Prefetch、BAM
4. 网络
□ tshark 统计会话与 DNS
□ 导出可疑流 → protocol-reverse 或 malware C2 分析
工具链
| 工具 | 用途 | |------|------| | Volatility 3 | 内存 | | Timeline Explorer / Plaso | 超级时间线 | | tshark | PCAP | | Eric Zimmerman 工具集 | Windows 伪影 | | Autopsy / FTK Imager | 磁盘 |
参考
references/forensics-triage.md../malware-analysis/../threat-hunting/../protocol-reverse/
路由上下文
上游: MASTER R25
下游: 恶意样本深挖 → malware-analysis；规则 → threat-hunting
任务完成自检
- [ ] 是否保全哈希与副本策略？
- [ ] 时间线是否可复核？
- [ ] IOC 是否脱敏分级？
- [ ] Checklist？
Limitations
- Chain-of-custody requirements apply; work on verified copies, never originals.
- Encrypted or anti-forensic artifacts may be unrecoverable.
Adapted from zhaoxuya520/reverse-skill (MIT).
Related Skills
FrancoStino/llm-security
tools
VerifiedTrustedCommunity
Authorized security assessment of LLM applications and AI agents: prompt injection, tool abuse, RAG exposure, memory poisoning, system-prompt extraction, and agent-compliance engineering per OWASP LLM/ASI Top 10.
68SKILL.mdUpdated Aug 30, 2026
FrancoStino/liuguang-banlan-ui
development
VerifiedTrustedCommunity
Builds two parameterized UI modes—流光溢彩白 (iridescent white) and 五彩斑斓黑 (colorful black)—with OKLCH, WebGL/CSS fallback, vision gating, screenshot QA, and total/per-color intensity reports. Use when a UI request names either mode or needs measured color parameters.
68SKILL.mdUpdated Aug 30, 2026
FrancoStino/kimi-delegate
tools
VerifiedTrustedCommunity
Delegate coding tasks to the Kimi Code CLI (`kimi`) only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.
68SKILL.mdUpdated Aug 30, 2026
FrancoStino/js-reverse
development
VerifiedTrustedCommunity
Front-end JavaScript reverse engineering: locate signature chains, analyze encrypted request parameters, sample runtime behavior, and reproduce logic locally in Node for evidence-based output.
68SKILL.mdUpdated Aug 30, 2026