analyzing-memory-forensics-with-lime-and-volatility

Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-memory-forensics-with-lime-and-volatility/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body gives concrete, mostly executable LiME/Volatility commands and a clear step sequence, but suffers from templated filler, redundant code blocks, an incomplete Python example, no evidence-validation checkpoints, and orphaned bundle files that are never linked from the body.

Suggestions

Replace the templated 'When to Use' bullets with LiME/Volatility-specific triggers and remove the bash duplication between Instructions and Examples to tighten conciseness.

Add validation checkpoints to the acquisition workflow (e.g., verify the .lime image hash and confirm insmod succeeded before analysis) to lift workflow clarity above the destructive-operation cap of 3.

Link to the existing references/api-reference.md and scripts/agent.py from the body (e.g., an 'API reference' / 'Automation' section) so the bundle files are discoverable rather than orphaned.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with sections and code, but the templated 'When to Use' bullets, redundancy between the Instructions and Examples bash blocks, and an incomplete Python snippet that sets up a context without using it add unnecessary tokens, fitting the 3 anchor rather than the lean 4 or 5 anchors.	3 / 5
Actionability	Provides concrete, mostly executable commands (insmod LiME, vol3 plugin invocations) and a numbered step list, but the Python block only initializes a Context and automagics without running a plugin, leaving a minor gap that fits the 4 anchor below the fully copy-paste-ready 5 anchor.	4 / 5
Workflow Clarity	A clear sequenced 5-step list is present, but the workflow involves evidence acquisition (loading a kernel module, capturing RAM) with no validation or verification checkpoints (e.g., image hashing, acquisition-success checks), so per the destructive/batch cap workflow clarity cannot exceed 3.	3 / 5
Progressive Disclosure	The body is organized into sections, but it never references the existing bundle files (references/api-reference.md, scripts/agent.py) and inlines plugin coverage instead of linking out, fitting the 3 anchor (some structure, references not clearly signaled) rather than the well-signaled 4/5 anchors.	3 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states concrete capabilities and an explicit use-when trigger for incident response on compromised Linux systems. Minor gap: a few natural synonyms (memory dump, RAM capture) are absent.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('Performs Linux memory acquisition using LiME', 'Extracts process lists, network connections, bash history, loaded kernel modules, and injected code') with comprehensive coverage, matching the score-5 anchor rather than the 4 anchor which expects minor gaps.	5 / 5
Completeness	Explicitly answers both what (acquisition and analysis extracting named artifacts) and when ('Use when performing incident response on compromised Linux systems') with concrete trigger phrases, matching the 5 anchor.	5 / 5
Trigger Term Quality	Includes good natural terms users would say ('incident response', 'compromised Linux systems', 'memory images', 'LiME', 'Volatility 3') but misses common synonyms like 'memory dump' or 'RAM capture', fitting the 4 anchor (good coverage, a few natural terms missing) below the comprehensive 5 anchor.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche (Linux memory forensics via LiME + Volatility 3) with distinct triggers and minimal overlap with other skills, matching the 5 anchor; voice is third person so no penalty applies.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-memory-forensics-with-lime-and-volatility/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.