analyzing-windows-amcache-artifacts

Parses the Windows Amcache.hve registry hive with Eric Zimmerman's AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and driver loading, including SHA-1 hash correlation with threat intel and timeline reconstruction. Use for Amcache forensics, program execution evidence gathering, or application compatibility cache investigations in DFIR work.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable and well-sequenced forensic workflow with strong executable guidance and verification steps, undermined only by orphaned bundle files that the body never points to.

Suggestions

Add clearly signaled one-level-deep links to the bundled materials, e.g. 'API reference and registry key paths: See [references/api-reference.md]' and 'Programmatic parsing with regipy: See [scripts/agent.py]'.

Move the duplicated AmcacheParser usage and CSV column definitions out of the body into references/api-reference.md to reduce overlap and respect the token budget.

Consolidate the Key Concepts table so it covers only non-obvious forensic nuance (e.g. transaction-log replay, LinkDate timestomping) rather than redefining the artifact and column names already detailed in the steps.

Dimension	Reasoning	Score
Conciseness	Mostly efficient — uses commands, tables, and column lists rather than restating concepts Claude already knows — though the Key Concepts table and some column descriptions slightly overlap content that also appears in the bundled api-reference.md.	4 / 5
Actionability	Fully executable PowerShell and AmcacheParser commands with concrete flags, paths, CSV outputs, defined columns, and Timeline Explorer filter examples that cover the common cases and are copy-paste ready.	5 / 5
Workflow Clarity	A clear 7-step sequence (acquire, parse, analyze, correlate, programs, drivers, timeline) with a dedicated Verification checklist and explicit per-step guidance such as collecting transaction logs, providing validation checkpoints and a feedback loop.	5 / 5
Progressive Disclosure	The body is well-sectioned inline, but the bundled references/api-reference.md and scripts/agent.py are never referenced or signaled from the body, and the API reference duplicates column/parser content that could have been linked rather than inlined.	3 / 5
	Total	17 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states concrete capabilities and explicit use-when triggers with natural forensic terms. Only minor room for improvement in synonym coverage of trigger phrases.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Parses the Windows Amcache.hve registry hive', 'extract evidence of program execution, application installation, and driver loading', 'SHA-1 hash correlation with threat intel', 'timeline reconstruction' — giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both 'what' (parses Amcache.hve to extract execution/installation/driver evidence and correlate hashes) and 'when' ('Use for Amcache forensics, program execution evidence gathering, or application compatibility cache investigations in DFIR work') with concrete triggers.	5 / 5
Trigger Term Quality	Has natural terms users say ('Amcache forensics', 'program execution evidence', 'DFIR work', 'application compatibility cache') but lacks some common synonyms and would not perfectly cover every phrasing a user might use.	4 / 5
Distinctiveness Conflict Risk	Amcache.hve parsing is a highly specific niche with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-windows-amcache-artifacts/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.