How do I install the Forensics skill?

Run npx skillmds@latest add majiayu000/forensics in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Forensics safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Forensics?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Forensics free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Forensics?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Forensics by majiayu000 — Agent Skill

Name: Forensics
Rating: 4.2 (5 reviews)
Author: majiayu000

File contents

Forensics Analysis Skill

Quick Workflow

Progress:
- [ ] Identify file type (file, xxd)
- [ ] Check metadata (exiftool)
- [ ] Search strings for flag
- [ ] Check for embedded data (binwalk)
- [ ] Try steganography tools
- [ ] Extract hidden content

Step 1: Quick Analysis

file suspicious_file
exiftool suspicious_file
strings suspicious_file | grep -iE "flag|ctf|secret|key"
binwalk suspicious_file

Step 2: Identify Challenge Type

File Type	Approach	Reference
Image (PNG/JPG)	Steganography	reference/steganography.md
Memory dump	Volatility	reference/memory.md
Unknown/corrupted	File analysis	reference/file-analysis.md
PCAP	Network skill	Use `networking` skill

Image Stego - Quick Start

# Try AperiSolve first (online)
# https://www.aperisolve.com/

# PNG
zsteg image.png
zsteg -a image.png

# JPEG
steghide extract -sf image.jpg
stegseek image.jpg rockyou.txt  # Brute force

Full techniques: reference/steganography.md

Memory Dump - Quick Start

# Volatility 3
vol -f memory.dmp windows.info
vol -f memory.dmp windows.pslist
vol -f memory.dmp windows.filescan | grep -i flag

Full techniques: reference/memory.md

File Carving - Quick Start

binwalk -e suspicious_file      # Extract embedded files
foremost -i file -o output/     # Carve files

# Fix corrupted header
xxd file | head -10             # Check magic bytes

Full techniques: reference/file-analysis.md

Online Tools

Tool	URL	Purpose
AperiSolve	aperisolve.com	All-in-one stego
StegOnline	stegonline.georgeom.net	Image analysis
CyberChef	gchq.github.io/CyberChef	Data transform

Reference Files

Steganography: Image/audio stego, LSB, AperiSolve
Memory: Volatility 2/3, process analysis
File Analysis: Magic bytes, binwalk, password cracking

---name: forensicsdescription: Extracts hidden data from files and analyzes forensic artifacts. Use when working with images, memory dumps, disk images, steganography, file carving, or when searching for hidden flags in files.--- # Forensics Analysis Skill ## Quick Workflow ``` Progress: - [ ] Identify file type (file, xxd) - [ ] Check metadata (exiftool) - [ ] Search strings for flag - [ ] Check for embedded data (binwalk) - [ ] Try steganography tools - [ ] Extract hidden content ``` ## Step 1: Quick Analysis ```bash file suspicious_file exiftool suspicious_file strings suspicious_file | grep -iE "flag|ctf|secret|key" binwalk suspicious_file ``` ## Step 2: Identify Challenge Type | File Type | Approach | Reference | |-----------|----------|-----------| | Image (PNG/JPG) | Steganography | [reference/steganography.md](reference/steganography.md) | | Memory dump | Volatility | [reference/memory.md](reference/memory.md) | | Unknown/corrupted | File analysis | [reference/file-analysis.md](reference/file-analysis.md) | | PCAP | Network skill | Use `networking` skill | ## Image Stego - Quick Start ```bash # Try AperiSolve first (online) # https://www.aperisolve.com/ # PNG zsteg image.png zsteg -a image.png # JPEG steghide extract -sf image.jpg stegseek image.jpg rockyou.txt # Brute force ``` **Full techniques**: [reference/steganography.md](reference/steganography.md) ## Memory Dump - Quick Start ```bash # Volatility 3 vol -f memory.dmp windows.info vol -f memory.dmp windows.pslist vol -f memory.dmp windows.filescan | grep -i flag ``` **Full techniques**: [reference/memory.md](reference/memory.md) ## File Carving - Quick Start ```bash binwalk -e suspicious_file # Extract embedded files foremost -i file -o output/ # Carve files # Fix corrupted header xxd file | head -10 # Check magic bytes ``` **Full techniques**: [reference/file-analysis.md](reference/file-analysis.md) ## Online Tools | Tool | URL | Purpose | |------|-----|---------| | AperiSolve | aperisolve.com | All-in-one stego | | StegOnline | stegonline.georgeom.net | Image analysis | | CyberChef | gchq.github.io/CyberChef | Data transform | ## Reference Files - **[Steganography](reference/steganography.md)**: Image/audio stego, LSB, AperiSolve - **[Memory](reference/memory.md)**: Volatility 2/3, process analysis - **[File Analysis](reference/file-analysis.md)**: Magic bytes, binwalk, password cracking

Frequently asked questions

Forensics