ctf-forensics

Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with concrete commands and code, but it is over-long as an inline catalog and its progressive-disclosure references point to bundle files that do not exist, leaving the split unrealized. Risky recovery workflows also lack explicit validation checkpoints.

Suggestions

Ship the referenced bundle files (windows.md, network.md, steganography.md, stego-advanced.md, signals-and-hardware.md, etc.) or remove the dead links, so the one-level-deep references resolve and progressive disclosure is real.

Add explicit validation/verification checkpoints (e.g., verify a mounted image is read-only, confirm extracted hashes parse with hashcat --show, re-validate repaired PCAPs with pcapfix -d before analysis) to the destructive/batch recovery workflows to raise workflow clarity.

Trim the inline technique catalog: keep the highest-value one-liners in SKILL.md and move the long per-technique list into the bundle files it already points to, improving token efficiency.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient (commands and one-liners), but it is a ~370-line dense catalog that inlines ~80 technique entries beyond what a lean overview needs; not level 1 because it avoids explaining concepts Claude already knows, but not level 3 because the technique-list bulk could be tightened or delegated to bundle files.	2 / 3
Actionability	It provides fully executable commands and code (vol3 plugin invocations, tshark filters, hashcat modes, Evtx parsing, exact apt/brew install lines) that are copy-paste ready with specific flags and Event IDs, matching the top anchor.	3 / 3
Workflow Clarity	Quick-start sequences exist ('When Logs Are Cleared' has a numbered fallback list), but destructive/risky operations like read-only mounting, carving, and decryption lack explicit validation checkpoints; per the rubric this caps workflow_clarity at 2.	2 / 3
Progressive Disclosure	References are well-signaled and one-level-deep in form ('See windows.md for...'), but the referenced bundle files (windows.md, network.md, stego-advanced.md, etc.) are not actually present in the skill bundle, so the disclosure structure is only partially realized; additionally much detail remains inline that should live in those files.	2 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: third-person, explicit 'Use when' trigger, and a comprehensive list of concrete forensics artifact types that map to natural user phrasing. It clearly separates this skill from adjacent CTF skills.

Dimension	Reasoning	Score
Specificity	The description lists numerous concrete actions and artifact types ('analyzing disk images, memory dumps, event logs, network captures... recovering deleted files and credentials'), matching the anchor for multiple specific concrete actions.	3 / 3
Completeness	It explicitly answers both 'what' ('Provides digital forensics and signal analysis techniques for CTF challenges') and 'when' via an explicit 'Use when analyzing...' clause with concrete triggers, matching the top anchor.	3 / 3
Trigger Term Quality	It covers natural terms a CTF user would actually say ('disk images', 'memory dumps', 'PCAP', 'Volatility', 'steganography', 'Windows registry'), giving good coverage of common variations rather than jargon-only phrasing.	3 / 3
Distinctiveness Conflict Risk	It carves a clear CTF-forensics niche with distinct triggers (Volatility, PCAP, DTMF spectrograms, side-channel power traces) unlikely to fire for unrelated skills; not level 2 because the scope is sharply bounded to forensics artifacts.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 117 missing	Warning

	Total	14 / 16 Passed

Repository: ljagiello/ctf-skills
Path: ctf-forensics/SKILL.md
Commit: d19f35f

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.