analyzing-windows-registry-for-artifacts

Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise. Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage on a Windows image.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable, well-organized forensic extraction steps, but it duplicates bundle material inline rather than pointing to the provided api-reference.md and agent.py, and its batch workflow lacks explicit validation/feedback checkpoints beyond the initial hive hashing.

Suggestions

Replace the inline python-registry blocks in Steps 3-4 with pointers to scripts/agent.py (e.g., `python scripts/agent.py --software-hive ... --action autorun`) and references/api-reference.md for the regipy API, so the SKILL.md stays a lean overview.

Add explicit validation checkpoints to the workflow: after extraction, compare hive hashes against the source image; before parsing each hive, confirm it loaded successfully and surface a clear error/retry path if a hive is corrupt or dirty.

Add a short 'References' or 'Bundle' section listing references/api-reference.md and scripts/agent.py so the existing bundle files are discoverable and signaled from the body.

Dimension	Reasoning	Score
Conciseness	The prose is lean and assumes forensic competence, but the inline python-registry blocks in Steps 3-4 (e.g., the ~25-line UserAssist decoder) duplicate code already in references/api-reference.md and scripts/agent.py, so not every token earns its place. It is mostly efficient but could be tightened by deferring to the bundle.	2 / 3
Actionability	Every step provides concrete, copy-paste-ready bash/perl/python with real hive paths, real RegRipper plugin names, and real registry key paths, matching the fully-executable anchor.	3 / 3
Workflow Clarity	Steps 1-5 are clearly sequenced and the sha256sum hash after extraction is an integrity checkpoint, but the batch extraction and multi-hive parse steps lack error-recovery feedback loops (e.g., verify a hive loaded before parsing), so per the batch-operations cap it stays at 2 rather than 3.	2 / 3
Progressive Disclosure	The body has good section organization but content that belongs in the bundle (the regipy API reference and the automation agent) is inlined, and the existing references/api-reference.md and scripts/agent.py are never linked or signaled from the body, matching the anchor where content that should be separate is inline and references are present but not signaled.	2 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise, third-person, and clearly states both capability and explicit usage triggers, with domain-specific keywords a practitioner would naturally use. It is well-distinguished from other skills by its narrow Windows-registry-forensics niche.

Dimension	Reasoning	Score
Specificity	It lists multiple concrete actions — "Extract and analyze Windows Registry hives", "uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise" — matching the multi-action anchor rather than the single-action score-2 example.	3 / 3
Completeness	It states both what it does (extract/analyze hives to uncover the listed artifacts) and an explicit "Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage on a Windows image" trigger clause, satisfying the what-and-when anchor.	3 / 3
Trigger Term Quality	It surfaces natural practitioner terms ("registry-based persistence", "DFIR triage", "Windows image", "RegRipper", "Registry Explorer", "user or system activity") that a user would realistically say when needing this skill.	3 / 3
Distinctiveness Conflict Risk	The Windows Registry / DFIR niche with named tools (RegRipper, Registry Explorer) and specific triggers is clearly bounded and unlikely to fire for unrelated skills, matching the clear-niche anchor.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-windows-registry-for-artifacts/SKILL.md
Commit: e612f49

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.