ctf-forensics

Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable CTF forensics reference with excellent progressive disclosure and concrete commands. Its main weakness is that destructive/batch forensics operations lack explicit validation checkpoints, capping workflow clarity.

Suggestions

Add a short validation step to image-mounting and carving workflows (e.g., verify mount succeeded before running fls/photorec; check photorec output before declaring recovery complete).

Consider trimming the long 'Additional Technique Quick References' bullet list by moving entries that already have dedicated reference files into those files, keeping the index concise.

For hash-cracking and key-recovery steps, add an explicit 'verify cracked plaintext' checkpoint (e.g., check that decrypted output has expected magic bytes) before treating a result as the flag.

Dimension	Reasoning	Score
Conciseness	Largely lean with one-liner techniques and executable commands, but the very long 'Additional Technique Quick References' bullet list and several repeated inline technique blurds add length that could be trimmed. Not a 5 because some inline entries restate content already pointed to by reference files.	4 / 5
Actionability	Provides copy-paste-ready commands and code throughout (vol plugins, tshark filters, hashcat modes, python Evtx parsing, grep pipelines) with concrete options and examples covering common CTF forensics cases.	5 / 5
Workflow Clarity	The body is a reference catalog of techniques rather than sequenced workflows; destructive/batch operations (mounting images, dumping files, cracking hashes) lack explicit validate-then-proceed checkpoints, so it caps at 3 per the destructive-operations rule.	3 / 5
Progressive Disclosure	Clear overview structure with one-level-deep, well-signaled markdown links to topic files (windows.md, network-advanced.md, stego-advanced.md, etc.) per technique; references are clearly labeled and easy to navigate.	5 / 5
	Total	17 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific, third-person description that clearly states what the skill does and when to use it with concrete CTF forensics triggers and tool names. It is comprehensive without being vague or padded.

Dimension	Reasoning	Score
Specificity	Lists many concrete, specific actions and artifact types — 'analyzing disk images, memory dumps, event logs, network captures ... recovering deleted files and credentials' — giving comprehensive coverage rather than generic language.	5 / 5
Completeness	Explicitly answers both 'what' ('Provides digital forensics and signal analysis techniques') and 'when' ('Use when analyzing ...') with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	Covers natural terms and tool/format names users would say (PCAP, Volatility, steganography, Docker images, DTMF, Windows registry) plus synonyms and extensions; comprehensive keyword coverage.	5 / 5
Distinctiveness Conflict Risk	Defines a clear CTF forensics niche with distinct trigger artifacts and tools; minimal overlap risk with other skill categories.	5 / 5
	Total	20 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 117 missing	Warning

	Total	14 / 16 Passed

Repository: ljagiello/ctf-skills
Path: ctf-forensics/SKILL.md
Commit: c332c7b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.