analyzing-lnk-file-and-jump-list-artifacts

Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file access, program execution, and user activity that persists even after the target file is deleted. Use when investigating Windows user activity, reconstructing file-access or program-execution timelines, or examining recent/frequently-used file evidence in a forensic exam.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands and a complete parser, but it functions as a monolithic reference rather than an overview, ignoring the provided bundle files and omitting validation checkpoints for batch forensic parsing.

Suggestions

Replace the inlined reference material (AppID hash table, Shell Link Header offset table, full Python parser, long example output) with one-level-deep links to the existing references/ and scripts/ bundle files so SKILL.md stays a concise overview.

Add a validation checkpoint to the analysis workflow (e.g. verify CSV row counts against source LNK counts, or re-run LECmd with --json and diff) so batch evidence processing has an explicit validate-then-proceed loop.

Trim the Overview's explanation of when/how LNK files are created and condense the Example Output to a short representative excerpt to reduce token overhead.

Dimension	Reasoning	Score
Conciseness	The dense offset/AppID tables and executable commands earn their tokens, but the Overview paragraph explains creation mechanics Claude largely knows and the ~70-line Example Output block could be trimmed, matching 'mostly efficient but could be tightened'.	3 / 5
Actionability	Copy-paste-ready LECmd/JLECmd PowerShell invocations with real flags (--csv, --csvf, --all, --ld) and a complete struct-based Python parser cover the common cases, matching the fully-executable anchor.	5 / 5
Workflow Clarity	Numbered use-case steps exist but lack validation checkpoints or feedback loops, and batch parsing of evidence folders without validation triggers the destructive/batch cap at 3.	3 / 5
Progressive Disclosure	Bundle files exist in references/, scripts/, and assets/ but the body never references them, while large reference material (AppID table, offset tables, full Python script, long example output) is inlined, matching 'content that clearly belongs in separate files is inlined'.	2 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, third-person, and explicitly pairs concrete capabilities with clear use-when triggers and named tooling. Its only gap is the absence of explicit file-extension trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions in third person ('Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file access, program execution, and user activity'), matching the comprehensive-coverage anchor.	5 / 5
Completeness	Explicitly answers both what ('Analyze ... to establish evidence ...') and when ('Use when investigating Windows user activity, reconstructing file-access or program-execution timelines, or examining recent/frequently-used file evidence in a forensic exam'), with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural terms and synonyms ('LECmd', 'JLECmd', 'Windows user activity', 'recent/frequently-used file evidence', 'forensic exam'), but explicit file extensions such as '.lnk' or '.automaticDestinations-ms' are absent, so it sits just below the comprehensive anchor.	4 / 5
Distinctiveness Conflict Risk	A clear niche (Windows LNK/Jump List forensic analysis) anchored by named tools (LECmd, JLECmd) gives it distinct triggers with minimal overlap risk.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md
Commit: 54a7988

Reviewed: ~1 hour ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.