analyzing-windows-prefetch-with-python

Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file/volume lists. Use when investigating renamed or masquerading binaries, verifying program execution timelines, or hunting for suspicious execution patterns in incident response.

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-windows-prefetch-with-python/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is well-structured and lean in its prose sections, but the body relies on a large inline example block instead of executable guidance and does not link its bundle files (api-reference.md, agent.py). As a batch forensic workflow it lacks explicit validation checkpoints, capping workflow clarity at 3.

Suggestions

Replace the inline ~50-line example output with a concise 5-8 line sample and link to scripts/agent.py for the runnable analyzer.

Add explicit validation steps to the workflow (e.g., verify the JSON report parsed, confirm file hashes recorded, validate parse errors handled) with a feedback loop.

Add navigation pointers to references/api-reference.md and scripts/agent.py from the relevant sections (e.g., 'See references/api-reference.md for the full API; run scripts/agent.py for the analyzer').

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with brief Overview, Prerequisites, and 4 terse steps, but the very large inline example-output block (lines 71-118) is padded filler that adds tokens without instructive value beyond the API reference.	4 / 5
Actionability	Steps are high-level descriptions ('Extract executable name, run count...', 'Flag known attack tools') rather than executable code; actual runnable code lives only in scripts/agent.py and references/api-reference.md, which are not explicitly linked from the body, leaving key details missing from SKILL.md itself.	3 / 5
Workflow Clarity	A 4-step sequence is listed but with no validation checkpoints or error-recovery feedback loops despite batch processing of potentially destructive forensic evidence; the rubric caps batch/forensic workflows lacking validation at 3.	3 / 5
Progressive Disclosure	Structure is reasonable with clearly labeled sections and a real one-level-deep reference (api-reference.md) and script (agent.py) present in the bundle, but the body never explicitly signals or links these files, a minor navigation gap.	4 / 5
	Total	14 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise, third-person, and clearly defines both capability and trigger context with strong incident-response keywords. Minor specificity gaps (omitting DLL/timestamp extraction and '.pf' as a trigger term) prevent a perfect score on specificity and trigger quality.

Suggestions

Add '.pf' as an explicit file-extension trigger and the standalone term 'prefetch' to broaden natural keyword coverage.

Mention extraction of timestamps and loaded DLLs among the concrete actions for fuller capability coverage.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ('reconstruct application execution history, run counts, and accessed file/volume lists') but does not enumerate every capability (e.g., DLL/timestamp extraction), leaving minor coverage gaps.	4 / 5
Completeness	Explicitly answers what ('Parse Windows Prefetch (.pf) files... reconstruct execution history, run counts, and accessed file/volume lists') and when ('Use when investigating renamed or masquerading binaries, verifying program execution timelines, or hunting for suspicious execution patterns in incident response') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Uses natural incident-response phrasing ('renamed or masquerading binaries', 'execution timelines', 'suspicious execution patterns in incident response') with good coverage, though it omits common synonyms like 'prefetch' as a standalone trigger and file extension '.pf'.	4 / 5
Distinctiveness Conflict Risk	Targets a narrow forensic niche (Windows Prefetch parsing via windowsprefetch) with distinct triggers tied to execution-history analysis, minimal overlap risk with general DFIR skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-windows-prefetch-with-python/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.