analyzing-usb-device-connection-history

Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration.

Quality

73%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Passed

No known issues

Optimize this skill with Tessl

npx tessl skill review --optimize ./skills/analyzing-usb-device-connection-history/SKILL.md

Quality

Content

64%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a highly actionable forensic skill with excellent executable code examples covering the full USB artifact analysis pipeline. Its main weaknesses are verbosity (reference tables and scenario descriptions that Claude doesn't need inline) and the lack of validation checkpoints in a forensic workflow where data integrity verification is critical. Splitting reference material into bundle files and adding verification steps would significantly improve it.

Suggestions

Add explicit validation checkpoints after key steps — e.g., verify registry hive integrity before parsing, confirm artifact counts match expectations, validate that the forensic image mount is read-only.

Move the 'Key Concepts', 'Tools & Systems', and 'Common Scenarios' sections into separate bundle reference files (e.g., REFERENCE.md, SCENARIOS.md) and link to them from the main skill.

Remove explanatory descriptions from tables that Claude already knows (e.g., 'VID/PID - Vendor ID and Product ID uniquely identifying USB device manufacturer and model') to reduce token usage.

Dimension	Reasoning	Score
Conciseness	The skill is fairly detailed and includes useful executable code, but the 'Key Concepts' and 'Tools & Systems' tables explain things Claude already knows (e.g., what VID/PID means, what FTK Imager does). The 'Common Scenarios' section is descriptive prose that adds length without actionable steps. The 'When to Use' and 'Prerequisites' sections also contain some obvious padding.	2 / 3
Actionability	The skill provides fully executable Python scripts with specific registry paths, parsing logic, and bash commands for artifact extraction. Code uses real libraries (python-registry, evtx), handles edge cases, and produces concrete outputs (JSON, CSV). The scripts are copy-paste ready with realistic file paths and data structures.	3 / 3
Workflow Clarity	The 5-step workflow is clearly sequenced and logically ordered from extraction through timeline building. However, there are no explicit validation checkpoints — no verification that registry hives loaded correctly, no checks that extracted artifacts are complete or uncorrupted, and no error recovery guidance for common failures like missing hives or corrupted logs. For forensic operations where data integrity matters, this is a notable gap.	2 / 3
Progressive Disclosure	The content is a monolithic document with everything inline — the Key Concepts table, Tools table, Common Scenarios, and Output Format could all be in separate reference files. At ~250+ lines, this is too much for a single SKILL.md with no bundle files to offload reference material. The structure within the file is decent with clear headers, but the overall organization would benefit from splitting.	2 / 3
	Total	9 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a strong, specific description that clearly identifies the forensic domain (USB device investigation on Windows) with concrete data sources and use cases. Its main weakness is the absence of an explicit 'Use when...' clause, which would help Claude know exactly when to select this skill. The trigger terms are naturally aligned with how forensic analysts and security professionals would phrase their requests.

Suggestions

Add an explicit 'Use when...' clause, e.g., 'Use when the user asks about USB forensics, removable device tracking, or investigating data exfiltration via USB on Windows systems.'

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions: investigate USB device connection history, track removable media usage, and detect potential data exfiltration. Also specifies concrete data sources: Windows registry, event logs, and setupapi logs.	3 / 3
Completeness	Clearly answers 'what does this do' (investigate USB device connection history from specific sources), but lacks an explicit 'Use when...' clause or equivalent trigger guidance, which caps this dimension at 2 per the rubric.	2 / 3
Trigger Term Quality	Includes strong natural keywords users would say: 'USB device', 'connection history', 'Windows registry', 'event logs', 'setupapi logs', 'removable media', 'data exfiltration'. These cover both forensic investigator terminology and common user language.	3 / 3
Distinctiveness Conflict Risk	Highly distinctive niche combining USB forensics, Windows-specific artifacts (registry, setupapi logs), and data exfiltration tracking. Very unlikely to conflict with other skills due to the specific forensic domain and platform focus.	3 / 3
	Total	11 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Commit: 0445030

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.