analyzing-windows-lnk-files-for-artifacts

Parse Windows LNK shortcut files to extract target paths, MAC timestamps, volume serial numbers, and machine identifiers for forensic timeline reconstruction. Use when investigating recently-accessed files, tracking removable media or network paths referenced by shortcuts, or building a DFIR timeline from LNK artifacts.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, highly actionable LNK forensic walkthrough with strong executable code and clear sequencing, weakened by unexplained-concept padding, missing batch validation feedback loops, and failure to route to the existing bundle files that duplicate inlined content.

Suggestions

Replace the inlined Step 3 Python parser with a short invocation of scripts/agent.py (e.g. `python3 scripts/agent.py --lnk-dir ... --action full_analysis`) and link references/api-reference.md for the JSON structure, instead of duplicating both inline.

Trim the Key Concepts table to LNK-specific fields Claude would not already know (e.g. tracker block semantics) and remove the redundant "Output includes" comment block in Step 2.

Add explicit validation checkpoints to the batch workflow, e.g. "Verify collected LNK count matches find output before parsing" and "If any parse errors occur, re-run with --action parse_all and review the error log".

Dimension	Reasoning	Score
Conciseness	Mostly efficient dense code and structured tables, but the Key Concepts table over-explains notions Claude already knows ("MAC address — Network adapter MAC", "Machine ID — NetBIOS name") and the Step 2 "Output includes" comment block overlaps the same fields, so it could be tightened.	3 / 5
Actionability	Copy-paste-ready, fully executable guidance throughout — mount/cp/find shell commands, LECmd/JLECmd invocations, and complete LnkParse3 Python scripts covering removable, network, and startup-persistence cases.	5 / 5
Workflow Clarity	Four steps are clearly sequenced, but this batch forensic operation has only light verification (read-only mount, sha256sum, per-file try/except) and no explicit validate→fix→retry feedback loop, so the batch-operation cap holds it at 3.	3 / 5
Progressive Disclosure	Section structure is reasonable, but the body inlines a full ~85-line Python parser duplicating scripts/agent.py and never signals the existing references/api-reference.md or scripts/agent.py bundle files, so references are present as files yet not clearly signaled.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A well-crafted description that names a precise domain, lists concrete capabilities, and provides explicit, multi-clause trigger guidance in third person. The only minor gap is the absence of the .lnk extension and Jump List terms among the triggers.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete extraction actions — "target paths, MAC timestamps, volume serial numbers, and machine identifiers" — tied to a specific outcome (forensic timeline reconstruction), matching the comprehensive-coverage anchor.	5 / 5
Completeness	Explicitly answers both what ("Parse Windows LNK shortcut files to extract...") and when ("Use when investigating recently-accessed files, tracking removable media or network paths..., or building a DFIR timeline") with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural-term coverage ("LNK shortcut files", "recently-accessed files", "removable media", "network paths", "DFIR timeline", "LNK artifacts") but omits the .lnk file extension and "Jump Lists", so it sits just below the comprehensive synonym-plus-extension anchor.	4 / 5
Distinctiveness Conflict Risk	"Windows LNK shortcut files" plus DFIR-specific triggers carve a clear, narrow niche with minimal overlap risk against other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md
Commit: 54a7988

Reviewed: ~2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.