analyzing-windows-registry-for-artifacts

Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise. Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage on a Windows image.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable code and a clear sequenced workflow, but it is let down by progressive disclosure: bundle files exist yet are never linked, and inline Python duplicates the bundled agent (using python-registry where the bundle uses regipy). Tightening redundancy and pointing to the bundle would raise conciseness and disclosure.

Suggestions

Link the bundle files from the body — e.g., add a Tools/References section pointing to references/api-reference.md for the full path table and scripts/agent.py for automated extraction — instead of inlining that material.

Consolidate the repetitive RegRipper rip.pl invocations (one per hive) into a compact loop or a single table mapping hive to plugin set, and remove the inline python-registry UserAssist/autorun heredocs that duplicate scripts/agent.py.

Reconcile the library choice across the skill: the body uses python-registry while references/api-reference.md and scripts/agent.py use regipy — pick one and keep the body consistent with the bundle to avoid conflicting guidance.

Dimension	Reasoning	Score
Conciseness	Mostly executable code with minimal prose padding, but the inline Python heredocs in Steps 3-4 duplicate the bundled scripts/agent.py and the repetitive RegRipper rip.pl invocations could be consolidated.	3 / 5
Actionability	Concrete, copy-paste-ready bash and Python with specific plugins (userassist, recentdocs, usbstor, compname, nic2, networklist, uninstall) covering the common forensic cases.	5 / 5
Workflow Clarity	Five clearly sequenced steps with a read-only mount and a sha256sum integrity checkpoint in Step 1, but no explicit verify-before-proceeding checkpoints or error-recovery loops between analysis steps.	4 / 5
Progressive Disclosure	Body is well-sectioned but never references the existing bundle files (references/api-reference.md, scripts/agent.py), and inlines API/automation content that belongs in those separate files; references present on disk are not signaled in the body.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and distinctive, explicitly covering both capabilities and trigger conditions in third person. It could add hive filename synonyms (NTUSER.DAT, SAM, SYSTEM, SOFTWARE) to round out trigger term coverage.

Dimension	Reasoning	Score
Specificity	"Extract and analyze Windows Registry hives" plus "uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise" lists multiple concrete actions with comprehensive coverage.	5 / 5
Completeness	Clearly states what ("Extract and analyze Windows Registry hives...") and when ("Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage...") with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural terms ("registry-based persistence", "reconstructing user or system activity", "DFIR triage", "Windows image") but missing hive filename synonyms (NTUSER.DAT, SAM, SYSTEM) a practitioner might say.	4 / 5
Distinctiveness Conflict Risk	Niche is sharply defined (Windows Registry hive forensics) with distinct tools (RegRipper, Registry Explorer) and triggers, minimizing overlap with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-windows-registry-for-artifacts/SKILL.md
Commit: 54a7988

Reviewed: ~1 hour ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.