How do I install the Thor Scan skill?

Run npx skillmds@latest add majiayu000/thor-scan in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Thor Scan safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Thor Scan?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Thor Scan free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Thor Scan?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Thor Scan by majiayu000 — Agent Skill

Name: Thor Scan
Rating: 4.2 (5 reviews)
Author: majiayu000

File contents

THOR Scan Skill

Goal: produce a safe, reproducible THOR command line and minimal preflight checks.

Rules

Prefer THOR v10 stable unless the user explicitly wants v11 TechPreview features.
Always start with environment detection: OS, THOR path, license presence, and whether thor-util exists.
Identify if user has full THOR or THOR Lite (different binaries, different capabilities).
Avoid "magic flags". Explain why each non-trivial flag is used.
Default to focusing on forensic / lab workflows; if it's live endpoint scanning, keep it conservative.

Preflight checklist

List the THOR install directory first (ls or dir). This immediately tells you:
- Which THOR version you have (binary names contain "lite" for THOR Lite)
- What binaries and tools are available
- What license files exist
Verify the correct binary exists:
- Full THOR: thor64.exe (Windows), thor-linux-64 (Linux), thor-macosx (macOS)
- THOR Lite: thor64-lite.exe (Windows), thor-lite-linux-64 (Linux), thor-lite-macos (macOS)
If recommending --lab mode, check license type first:
- grep -i forensiclab *.lic - if found, --lab is available
- If not found (or THOR Lite), use alternative: -a Filescan --intense --norescontrol --cross-platform
Check thor-util presence for update/diagnostics/report tasks.
Identify scan target type:
- live path, mounted image, memory dump, extracted dumps, SSHFS-mounted remote
Choose scan mode and output location; keep outputs deterministic.
If THOR Lite: note that lab mode and Sigma are unavailable. See THOR Lite limitations.

Important flag rules

Never use --lab --intense together - --lab already includes intense mode
Check license before recommending --lab - requires Forensic Lab license
THOR Lite has no --lab - always use the alternative flag combination

Use these references when needed

Environment detection: reference/env-detection.md
Scan modes overview: reference/scan-modes.md
Forensic lab mode: reference/lab-mode.md
Performance and threading: reference/performance.md
Output and reports: reference/output-and-reporting.md
Signature selectors/filters: reference/signature-filtering.md
THOR Lite limitations: ../thor-lite/reference/limitations.md

Example templates

examples/windows-live-scan.md
examples/linux-mounted-image.md
examples/macos-scan.md
examples/memory-dump.md
examples/sshfs-remote-scan.md - for appliances and unsupported architectures

Output format

First line: one recommended command (single-line).
Then: short explanation of key flags.
Then: "If it fails" section with 2-3 likely causes and next commands to run.

---name: thor-scandescription: Run THOR scans and propose the exact command line for Windows, Linux, or macOS. Use when the user wants to scan a host, a directory, a mounted image, or a memory dump with THOR v10/v11.---# THOR Scan Skill Goal: produce a safe, reproducible THOR command line and minimal preflight checks. Rules - Prefer THOR v10 stable unless the user explicitly wants v11 TechPreview features. - Always start with environment detection: OS, THOR path, license presence, and whether thor-util exists. - Identify if user has full THOR or THOR Lite (different binaries, different capabilities). - Avoid "magic flags". Explain why each non-trivial flag is used. - Default to focusing on forensic / lab workflows; if it's live endpoint scanning, keep it conservative. Preflight checklist 1. List the THOR install directory first (`ls` or `dir`). This immediately tells you: - Which THOR version you have (binary names contain "lite" for THOR Lite) - What binaries and tools are available - What license files exist 2. Verify the correct binary exists: - Full THOR: `thor64.exe` (Windows), `thor-linux-64` (Linux), `thor-macosx` (macOS) - THOR Lite: `thor64-lite.exe` (Windows), `thor-lite-linux-64` (Linux), `thor-lite-macos` (macOS) 3. If recommending `--lab` mode, check license type first: - `grep -i forensiclab *.lic` - if found, `--lab` is available - If not found (or THOR Lite), use alternative: `-a Filescan --intense --norescontrol --cross-platform` 4. Check thor-util presence for update/diagnostics/report tasks. 5. Identify scan target type: - live path, mounted image, memory dump, extracted dumps, SSHFS-mounted remote 6. Choose scan mode and output location; keep outputs deterministic. 7. If THOR Lite: note that lab mode and Sigma are unavailable. See [THOR Lite limitations](../thor-lite/SKILL.md). Important flag rules - **Never use `--lab --intense` together** - `--lab` already includes intense mode - **Check license before recommending `--lab`** - requires Forensic Lab license - **THOR Lite has no `--lab`** - always use the alternative flag combination Use these references when needed - Environment detection: [reference/env-detection.md](reference/env-detection.md) - Scan modes overview: [reference/scan-modes.md](reference/scan-modes.md) - Forensic lab mode: [reference/lab-mode.md](reference/lab-mode.md) - Performance and threading: [reference/performance.md](reference/performance.md) - Output and reports: [reference/output-and-reporting.md](reference/output-and-reporting.md) - Signature selectors/filters: [reference/signature-filtering.md](reference/signature-filtering.md) - THOR Lite limitations: [../thor-lite/reference/limitations.md](../thor-lite/reference/limitations.md) Example templates - examples/windows-live-scan.md - examples/linux-mounted-image.md - examples/macos-scan.md - examples/memory-dump.md - examples/sshfs-remote-scan.md - for appliances and unsupported architectures Output format - First line: one recommended command (single-line). - Then: short explanation of key flags. - Then: "If it fails" section with 2-3 likely causes and next commands to run.

Frequently asked questions

Thor Scan