analyzing-memory-dumps-with-volatility

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-memory-dumps-with-volatility/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable, executable command reference for Volatility memory forensics, but it pads the body with a concepts table and a large sample report, omits validation checkpoints for fragile batch evidence work, and fails to link to its own bundle files.

Suggestions

Link to references/api-reference.md from the body and move the bulk per-plugin tables/details there, keeping only key examples inline.

Add explicit validation checkpoints (verify the dump loads and OS detection succeeds before running plugins; confirm symbol tables match the OS) with a fix-and-retry loop.

Trim the 'Key Concepts' table and the full 'Output Format' sample report to a short template, removing concepts Claude already knows.

Dimension	Reasoning	Score
Conciseness	The workflow steps are lean executable bash commands with terse comments, but the 'Key Concepts' table explains concepts Claude already knows (Memory Forensics, Fileless Malware, VAD) and the ~40-line sample 'Output Format' report plus 'Tools & Systems' prose add padding.	3 / 5
Actionability	Fully executable, copy-paste-ready vol3/vol2 commands throughout, covering process enumeration, injection detection, network analysis, credential extraction, YARA scanning, and reporting, matching the anchor for fully executable guidance.	5 / 5
Workflow Clarity	The 7-step sequence is clearly ordered, but batch/fragile-evidence forensic operations lack explicit validation checkpoints (e.g., verify dump integrity, confirm OS detection before plugin selection) and a validate-fix-retry loop, capping it at 3 per the destructive/batch rule.	3 / 5
Progressive Disclosure	Bundle files references/api-reference.md and scripts/agent.py exist but are never referenced or linked from the body, and the bulk plugin API reference is inlined rather than split out, leaving structure minimal and references buried.	2 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A well-crafted, third-person description that concretely states capabilities and explicit activation triggers with strong keyword coverage. Minor gaps in file-extension and tool-name triggers keep it just short of perfection on trigger term quality.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('identify malicious processes, injected code, network connections, loaded modules, and extracted credentials') with comprehensive coverage, matching the anchor for several specific concrete actions.	5 / 5
Completeness	Explicitly answers both what ('Analyzes RAM memory dumps... to identify...') and when ('Activates for requests involving...') with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	Strong natural keywords and synonyms ('memory forensics, RAM analysis, volatile data examination, process injection detection, memory-resident malware investigation'), but missing common file extensions like .dmp/.raw and 'Volatility' itself as a trigger term.	4 / 5
Distinctiveness Conflict Risk	Clear niche (memory forensics with Volatility), distinct triggers, and the body adds an explicit 'Do not use for disk image analysis' boundary, giving minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-memory-dumps-with-volatility/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.