analyzing-windows-prefetch-with-python

Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file/volume lists. Use when investigating renamed or masquerading binaries, verifying program execution timelines, or hunting for suspicious execution patterns in incident response.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-windows-prefetch-with-python/SKILL.md

Quality

Content

50%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-sectioned and the example output illustrates forensic findings well, but it lacks inline executable guidance, omits validation steps, and fails to correctly point readers to the bundled reference and script. Fixing the script-name mismatch and adding concrete code would lift the weakest dimensions.

Suggestions

Replace the abstract Steps with concrete, copy-paste-ready library usage (e.g. import windowsprefetch and parse a .pf file) or correctly invoke scripts/agent.py with its actual CLI signature.

Add a validation/verification checkpoint in the workflow (e.g. confirm parsed counts against directory contents, or sanity-check timestamps) so the batch parse has a feedback loop.

Link the bundle files explicitly — reference references/api-reference.md for the API and scripts/agent.py for the runnable analyzer — and trim the large mock output block to the essentials.

Dimension	Reasoning	Score
Conciseness	Mostly structured but the Overview reiterates the description and the ~45-line mock 'Example Output' block is padded; the templated 'When to Use' bullets add little beyond the description's triggers.	2 / 3
Actionability	The four Steps are abstract descriptions with no inline code, and the example command invokes 'prefetch_analyzer.py' which does not match the bundled scripts/agent.py (different filename and CLI arguments).	2 / 3
Workflow Clarity	Four steps are sequenced but there is no validation or verification checkpoint for a batch parse operation, which caps this dimension at 2 per the rubric.	2 / 3
Progressive Disclosure	Bundle files exist (references/api-reference.md, scripts/agent.py) but the body never links the API reference and misnames the script, so navigation to the supporting materials is not clearly signaled.	2 / 3
	Total	8 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that states concrete capabilities and gives explicit 'Use when' triggers covering investigation, timeline verification, and suspicious-execution hunting. It is distinguishable and concise without padding.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions: 'reconstruct application execution history, run counts, and accessed file/volume lists', plus investigating renamed binaries and verifying execution timelines.	3 / 3
Completeness	Explicitly answers what it does and when to use it via a 'Use when investigating... verifying... hunting for...' clause with explicit triggers.	3 / 3
Trigger Term Quality	Uses natural terms a user would say — 'Windows Prefetch', '.pf files', 'renamed or masquerading binaries', 'program execution timelines', 'suspicious execution patterns', 'incident response'.	3 / 3
Distinctiveness Conflict Risk	Targets a clear niche (Windows Prefetch forensics) with distinct triggers unlikely to collide with other skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-windows-prefetch-with-python/SKILL.md
Commit: e612f49

Reviewed: about 17 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.