analyzing-usb-device-connection-history

Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged timestamps, and drive letter mappings. Use when investigating removable media usage, tracking device provenance, or building a timeline for suspected data exfiltration.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable, well-sequenced forensic workflow with executable code throughout, but it underuses its own bundle: the reference file and automation script are never linked from the body, and inline code duplicates the bundled script, inflating token cost. Tightening these would lift both conciseness and progressive disclosure.

Suggestions

Link the bundle files from the body — e.g. add 'See [references/api-reference.md](references/api-reference.md) for regipy/evtx API details' and 'Run [scripts/agent.py](scripts/agent.py) --system-hive ... for end-to-end automation' — so the orphaned files are discoverable.

Replace the inline Python in Steps 2-5 with shorter snippets that delegate to scripts/agent.py functions (parse_usbstor, parse_mounted_devices, parse_mountpoints2, parse_setupapi_log, build_timeline) to cut duplication and token cost.

Reconcile the library mismatch: the body uses python-registry ('from Registry import Registry') while references/api-reference.md and scripts/agent.py use regipy — pick one and keep them consistent.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient (no basic-concept padding, token-friendly tables) but inlines ~150 lines of Python across Steps 2-5 that largely duplicate scripts/agent.py, which could be trimmed by pointing to the bundled script instead of reproducing it.	3 / 5
Actionability	Provides fully executable, copy-paste-ready guidance: concrete mount commands with computed offsets, complete Python scripts importing real libraries (Registry, evtx.PyEvtxParser), specific registry paths, and working regex patterns covering the common cases.	5 / 5
Workflow Clarity	Five clearly sequenced steps (extract artifacts, parse USBSTOR, drive letters/users, SetupAPI+event logs, build timeline/report) with per-step error handling, though explicit validate-then-proceed checkpoints are implicit rather than called out; this read-only forensic task is not destructive/batch, so the cap-3 rule does not apply.	4 / 5
Progressive Disclosure	The body has good section structure (When to Use, Prerequisites, Workflow, Key Concepts, Tools, Scenarios, Output Format) but never references or links to either bundle file — references/api-reference.md (regipy/evtx API detail) and scripts/agent.py (complete automation) are orphaned, and API content that belongs in the reference file is inlined instead.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both what the skill does and when to use it, using concrete forensic artifacts and natural trigger phrases in third-person voice. The only minor gap is slight synonym/extension coverage in trigger terms.

Dimension	Reasoning	Score
Specificity	Names multiple concrete actions — 'Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged timestamps, and drive letter mappings' — giving comprehensive, specific coverage rather than vague abstraction.	5 / 5
Completeness	Explicitly answers both 'what' (correlate registry keys, event logs, and setupapi.dev.log to reconstruct USB history, timestamps, and drive letter mappings) and 'when' ('Use when investigating removable media usage, tracking device provenance, or building a timeline for suspected data exfiltration') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural phrases a forensic investigator would say — 'investigating removable media usage', 'tracking device provenance', 'building a timeline for suspected data exfiltration' — with good coverage, though a few common synonyms (e.g. 'USB drive', specific file extensions) are absent.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (Windows USB forensics with named registry keys USBSTOR/MountedDevices/MountPoints2) with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-usb-device-connection-history/SKILL.md
Commit: 54a7988

Reviewed: ~1 hour ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.