analyzing-outlook-pst-for-email-forensics

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing from Outlook archives.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable code and commands, but it is verbose in places and under-uses its own bundle files by inlining a large duplicated Python class and conceptual background. Workflow sequencing and validation checkpoints are also missing for forensic batch operations.

Suggestions

Replace the inline PSTForensicAnalyzer class with a one-line pointer to scripts/agent.py and reference the existing bundle files (e.g., 'API details: see references/api-reference.md; workflow: see references/workflows.md') to fix progressive disclosure and cut tokens.

Trim the Overview's format primer (MAPI, 4KB pages, 50GB/2GB limits) and shorten the mock Example Output to a compact representative excerpt so every token earns its place.

Add a short sequenced forensic workflow with explicit validation checkpoints (hash original file before/after export, verify message counts, confirm chain of custody) to raise workflow clarity above 2.

Dimension	Reasoning	Score
Conciseness	Mostly actionable but padded: the Overview explains concepts Claude knows ('proprietary binary format based on the MAPI property system', 'Unicode format with 4KB pages... up to 50GB'), and the ~80-line mock 'Example Output' report and large inline Python class add tokens that could be tightened or externalized.	2 / 3
Actionability	Provides executable `pffexport`/`pffinfo` commands, a complete runnable `PSTForensicAnalyzer` Python class, and a concrete header-forensic-value table — copy-paste ready guidance.	3 / 3
Workflow Clarity	Sections exist but there is no sequenced end-to-end workflow with validation checkpoints in the body; forensic batch/evidence operations lack inline verification (hashing, chain of custody) before analysis, capping clarity at 2 per the batch-operation guideline.	2 / 3
Progressive Disclosure	Bundle files exist (references/api-reference.md, standards.md, workflows.md, scripts/agent.py) but the body never signals or links them, instead inlining a ~150-line Python class that duplicates agent.py and API content that belongs in the references — content that should be separate is inline.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that pairs concrete capabilities with an explicit use-when trigger clause and a clearly distinct forensic niche. No significant weaknesses; voice and specificity both meet the top anchor.

Dimension	Reasoning	Score
Specificity	Names multiple concrete actions — 'Parse... PST and OST files', 'extract message content, headers, attachments, deleted items, and MAPI metadata', 'recovery of items from the Recoverable Items folder' — matching the multi-action anchor.	3 / 3
Completeness	Explicitly answers both what (parse/extract/recover) and when via the 'Use when conducting email forensic investigations, legal e-discovery, or incident response...' clause, satisfying the explicit-trigger requirement.	3 / 3
Trigger Term Quality	Covers natural terms users would say — 'PST and OST files', 'Outlook archives', 'email forensic investigations', 'legal e-discovery', 'incident response' — with good breadth rather than jargon-only phrasing.	3 / 3
Distinctiveness Conflict Risk	The PST/OST email-forensics niche with libpff/pst-utils and Recoverable Items recovery is distinct and unlikely to trigger for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-outlook-pst-for-email-forensics/SKILL.md
Commit: e612f49

Reviewed: about 11 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.