analyzing-disk-image-with-autopsy

Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.

Quality

55%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Advisory

Suggest reviewing before use

Optimize this skill with Tessl

npx tessl skill review --optimize ./skills/analyzing-disk-image-with-autopsy/SKILL.md

Quality

Content

42%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill is highly actionable with concrete, executable commands and specific GUI instructions, but it is severely bloated with unnecessary explanations, reference tables of concepts Claude already knows, and narrative scenario descriptions. The lack of any progressive disclosure or external file references results in a monolithic document that wastes significant context window space. Workflow clarity is adequate but lacks the validation checkpoints critical for forensic analysis where evidence integrity matters.

Suggestions

Remove the 'Key Concepts' and 'Tools & Systems' tables entirely — Claude already knows what MFT, file carving, and hash filtering are, and tool descriptions are evident from usage context.

Move installation instructions, common scenarios, and detailed ingest module descriptions to separate referenced files (e.g., SETUP.md, SCENARIOS.md, MODULES.md) to reduce the main skill to a concise workflow.

Add explicit validation checkpoints: verify image hash before analysis, validate recovered file integrity after extraction, and confirm ingest module completion before proceeding to keyword search/timeline steps.

Remove the prerequisites section or reduce it to a single line — specifying RAM requirements and JRE versions is unnecessary context for Claude.

Dimension	Reasoning	Score
Conciseness	Extremely verbose at ~200+ lines. Explains basic concepts Claude already knows (what MFT is, what file carving is, what NTFS is), includes full installation instructions, lists every ingest module with descriptions, and provides a 'Key Concepts' table that is entirely redundant for Claude. The prerequisites section includes obvious items like 'sufficient disk space' and 'Java Runtime Environment.' The common scenarios section is largely narrative padding.	1 / 3
Actionability	Provides fully executable CLI commands (fls, icat, mactime, mmls, sigfind, srch_strings) with concrete paths, flags, and expected output examples. The GUI steps are specific with exact menu paths and click sequences. Regex patterns for keyword searches are copy-paste ready.	3 / 3
Workflow Clarity	Steps are clearly sequenced (1-6) covering the full forensic workflow from setup through reporting. However, there are no explicit validation checkpoints or feedback loops — for instance, no step to verify image integrity before analysis begins (beyond mentioning the Data Source Integrity module), no verification that recovered files are intact, and no error recovery guidance if ingest modules fail or produce unexpected results. For forensic work where evidence integrity is critical, this is a significant gap.	2 / 3
Progressive Disclosure	Monolithic wall of text with no references to external files and no bundle files. Everything is inline — installation, configuration, analysis, scenarios, reference tables, output format — making this extremely long. Content like the Key Concepts table, Tools & Systems table, Common Scenarios, and detailed installation steps should be in separate referenced files.	1 / 3
	Total	7 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong in specificity and distinctiveness, clearly naming the tool (Autopsy) and listing concrete forensic actions. However, it lacks an explicit 'Use when...' clause, which is critical for Claude to know when to select this skill. Trigger term coverage could also be improved with common user-facing variations.

Suggestions

Add an explicit 'Use when...' clause, e.g., 'Use when the user asks about digital forensics, disk image analysis, evidence recovery, or mentions Autopsy.'

Include additional natural trigger terms users might say, such as 'digital forensics', 'deleted file recovery', 'evidence analysis', '.E01', '.dd', or 'incident response'.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions: 'forensic analysis of disk images', 'recover files', 'examine artifacts', and 'build investigation timelines'. Also names the specific tool (Autopsy).	3 / 3
Completeness	Clearly answers 'what does this do' with specific actions and tool, but lacks an explicit 'Use when...' clause or equivalent trigger guidance, which caps this at 2 per the rubric.	2 / 3
Trigger Term Quality	Includes good terms like 'forensic analysis', 'disk images', 'Autopsy', 'recover files', and 'artifacts', but misses common variations users might say such as 'digital forensics', 'evidence', 'deleted files', 'file carving', '.E01', '.dd', or 'incident response'.	2 / 3
Distinctiveness Conflict Risk	Very clear niche: forensic analysis of disk images using Autopsy. This is highly specific and unlikely to conflict with other skills due to the specialized domain and named tool.	3 / 3
	Total	10 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Commit: 0445030

Reviewed: 15 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.