CtrlK
BlogDocsLog inGet started
Tessl Logo

analyzing-outlook-pst-for-email-forensics

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing from Outlook archives.

63

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-outlook-pst-for-email-forensics/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is actionable and well-sectioned, with concrete commands, a runnable analyzer, and useful forensic tables, but it is verbose and mis-structured for progressive disclosure: a large duplicated code class and long sample output are inlined while the existing reference/workflow bundle files are never linked. A batch forensic workflow also lacks explicit validation checkpoints, which caps workflow clarity.

Suggestions

Add an explicit numbered analysis workflow with validation checkpoints (hash the original evidence before parsing, verify extracted message/attachment counts against pffexport totals, confirm report integrity) — batch/destructive forensic operations without validation cap workflow_clarity at 3.

Link the existing bundle files from the body instead of inlining duplicated material — e.g., "See references/workflows.md for the end-to-end evidence extraction workflow" and "See references/api-reference.md for MAPI property tags and readpst syntax" — so the orphaned references become one-level-deep navigable resources.

Remove or heavily trim the ~150-line inline PSTForensicAnalyzer class (it duplicates scripts/agent.py) and the ~80-line example output block, or move them into a references file, to reduce token bloat and lift conciseness.

DimensionReasoningScore

Conciseness

Mostly useful forensic content (header table, file-location table, pffexport commands) but padded by a ~150-line inline PSTForensicAnalyzer class that duplicates scripts/agent.py and an ~80-line example output block; the overview also explains PST format basics Claude already knows. Not score 4 because the duplicated class and long sample report are clearly trimmable; not score 2 because the tables and commands are genuinely efficient.

3 / 5

Actionability

Provides concrete, executable guidance — complete pffexport commands with flags and a full runnable Python class plus a header-forensic-value table and file-location table. Not score 5 because the inline class leaves minor gaps (e.g., attachment content_type is left empty) and some cases (recovered-item handling) are shown only via a CLI flag, not in code.

4 / 5

Workflow Clarity

Sections imply an order but there is no explicit numbered workflow with validation checkpoints in the body, and a batch forensic operation without integrity validation is capped at 3 per the rubric. Not score 4 because validation checkpoints (hash-the-original, verify extraction counts, chain-of-custody confirmation) are absent; not score 2 because the section order and tool commands do convey a rough sequence.

3 / 5

Progressive Disclosure

The body has clear section headers and bundle files exist (references/api-reference.md, standards.md, workflows.md, scripts/agent.py), but none are linked from the body — the workflow and API reference are orphaned while large content (the inline class, the example output) that belongs in separate files is inlined. Not score 4 because the bundle references are not signaled at all; not score 2 because the body's own section structure is reasonably organized.

3 / 5

Total

13

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states concrete capabilities, names specific tools, and pairs a clear "what" with an explicit "Use when" trigger clause tied to forensic and e-discovery scenarios. The only minor gap is the absence of explicit file extensions (.pst/.ost) and a few synonyms, which keeps trigger-term quality at 4 rather than 5.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — "extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder" — and names the specific tools (libpff, pst-utils), giving comprehensive coverage. Not score 4 because the action list is thorough rather than having only minor gaps.

5 / 5

Completeness

Clearly answers both "what" (parse PST/OST to extract content, headers, attachments, deleted items, MAPI metadata, recoverable items) and "when" ("Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing") with concrete trigger phrases. Not score 4 because both halves are explicit and concrete, not merely adequate.

5 / 5

Trigger Term Quality

Includes natural terms users would say — "Microsoft Outlook PST and OST files", "email forensic investigations", "legal e-discovery", "incident response", "tracing message routing" — but omits explicit file extensions (.pst/.ost) and common synonyms. Not score 5 because the anchor expects comprehensive synonyms and extensions; not score 3 because coverage is already good with several natural phrases.

4 / 5

Distinctiveness Conflict Risk

Targets a clear niche — Outlook PST/OST email forensics — with distinct triggers (PST/OST archives, e-discovery, message routing) that are unlikely to fire for unrelated skills. Not score 4 because the niche and triggers are sharply specific with minimal overlap risk.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
mukul975/Anthropic-Cybersecurity-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.