CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-forensic-timeline

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DFIR chronology, cross-artifact correlation, persistence chains, and incident timeline reconstruction. Use when the user asks to build a forensic timeline, correlate EVTX, PCAP, registry, disk, memory, mailbox, or browser artifacts, explain the order of attacker actions, or pinpoint the stage where the decisive artifact appears. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

75

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A compact, well-structured instruction-only skill with a clear sequenced workflow and a well-signaled reference file. It is token-efficient and respects Claude's competence; the main gap is the absence of explicit validation feedback loops in the workflow.

Suggestions

Add an explicit validate->fix->retry checkpoint (e.g., re-derive the decisive chain from raw artifacts and re-check identifier matches before presenting the final timeline) to raise workflow_clarity.

Optionally include one concrete example of a correlation step (e.g., a sample PID/logon-ID cross-source match) to move actionability from mostly-executable toward fully concrete.

DimensionReasoningScore

Conciseness

Lean and efficient: tight bullets in Quick Start and Workflow, no explanation of concepts Claude already knows (e.g., what EVTX or PCAP is), every line carries load. Minor overlap between Quick Start and Workflow does not rise to verbosity.

5 / 5

Actionability

Concrete domain-specific guidance (specific artifact types, specific identifiers to match: PID, logon ID, GUID, message ID) is actionable for an instruction-only skill, but lacks executable commands/code examples; per scoring notes absence of code is acceptable when guidance is actionable, leaving only a minor gap.

4 / 5

Workflow Clarity

A clear numbered Quick Start (1-5) and a three-stage Workflow with sub-steps, plus explicit separation of confirmed order from inferred gaps ("Separate confirmed event order from inferred gaps"; "Call out missing validation steps separately"). No explicit validate->fix->retry feedback loop, which keeps it just below 5.

4 / 5

Progressive Disclosure

Under 50 lines with well-organized sections and a single clearly-signaled, verified one-level-deep reference ("Load references/forensic-timeline.md"), which matches the simple-skill exception for scoring 5.

5 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-scoped description that clearly states capabilities and provides concrete natural-language triggers, with explicit use-when guidance and a downstream routing clause. It is concise without padding and clearly distinguishable from neighboring forensic skills.

DimensionReasoningScore

Specificity

Lists multiple concrete actions ("DFIR chronology, cross-artifact correlation, persistence chains, and incident timeline reconstruction") plus specific artifact types (EVTX, PCAP, registry, disk, memory, mailbox, browser), giving comprehensive coverage of capabilities.

5 / 5

Completeness

Explicitly answers both what it does (DFIR chronology and timeline reconstruction) and when to use it ("Use when the user asks to build a forensic timeline, correlate... artifacts, explain the order of attacker actions, or pinpoint the stage where the decisive artifact appears").

5 / 5

Trigger Term Quality

Natural trigger phrases a user would actually say ("build a forensic timeline", "correlate EVTX, PCAP, registry...", "explain the order of attacker actions") are present with synonyms and concrete artifact names.

5 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (forensic timeline reconstruction) with distinct triggers and an explicit downstream-scoping clause, minimizing conflict risk with adjacent skills.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.