analyzing-usb-device-connection-history

Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged timestamps, and drive letter mappings. Use when investigating removable media usage, tracking device provenance, or building a timeline for suspected data exfiltration.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, highly actionable forensic workflow with executable code at every step, but it is verbose and monolithic: it duplicates the bundled agent.py inline and never points readers to the existing references/api-reference.md or scripts/agent.py, with no validation checkpoints between steps.

Suggestions

Replace the inline Python heredocs with calls to scripts/agent.py (documenting its CLI flags) and link to references/api-reference.md for registry-path and event-ID details, cutting the body substantially.

Add explicit validation checkpoints between steps — e.g. after extracting artifacts, verify each hive/log opened successfully before parsing, and confirm device counts are non-zero before building the timeline.

Add a brief 'References' section at the end of the body pointing to references/api-reference.md and scripts/agent.py so the bundle structure is actually discoverable.

Dimension	Reasoning	Score
Conciseness	The ~340-line body embeds five large Python heredocs that largely duplicate the bundled scripts/agent.py, plus full Key Concepts, Tools, Scenarios and Output Format sections; mostly useful but could be tightened by leaning on the bundle instead of inlining everything.	2 / 3
Actionability	Every workflow step ships copy-paste-ready, executable bash/python with concrete paths, registry key names, and parsing logic — e.g. the USBSTOR parser resolving the active ControlSet and extracting vendor/product/serial.	3 / 3
Workflow Clarity	Steps 1–5 are clearly sequenced, but there are no explicit validation checkpoints or feedback loops between steps (e.g. confirm a hive parsed before proceeding), so it sits at the sequence-present-but-checkpoints-implicit level.	2 / 3
Progressive Disclosure	Bundle files references/api-reference.md and scripts/agent.py exist but are never linked or signaled from the body, while equivalent content is inlined as monolithic code blocks — content that should be separate is inline and references are not clearly surfaced.	2 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that states concrete capabilities and gives an explicit 'Use when' trigger covering several natural scenarios. It is concise, distinctive, and free of fluff or over-claims.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged timestamps, and drive letter mappings' — naming specific sources and three distinct outputs.	3 / 3
Completeness	Explicitly answers both what ('Correlate ... to reconstruct ...') and when via a dedicated 'Use when investigating ...' trigger clause, satisfying the explicit-trigger requirement.	3 / 3
Trigger Term Quality	The 'Use when' clause surfaces natural phrasings a forensic analyst would actually say: 'removable media usage', 'tracking device provenance', and 'building a timeline for suspected data exfiltration', alongside concrete artifact names.	3 / 3
Distinctiveness Conflict Risk	The USB-forensics niche with named registry keys (USBSTOR, MountedDevices) and setupapi.dev.log is highly specific and unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-usb-device-connection-history/SKILL.md
Commit: e612f49

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.