252 个 · 按相关度排序
Examine Linux authentication logs, shell history, SSH keys, scheduled tasks, and system settings to investigate a compromise. Help reconstruct activity, identify ways attackers maintain access, and document suspicious accounts, files, and configuration changes.
中文简介正在准备中。当前显示英语简介。
Investigate captured network traffic and connection records with Wireshark, Zeek, and NetFlow analysis. Identify communications with attacker infrastructure, trace movement between internal systems, estimate data transfers, and produce findings linked to packet evidence and timestamps.
中文简介正在准备中。当前显示英语简介。
Investigate Linux kernel rootkits, malware that hides inside the operating system's core. Analyze memory dumps with Volatility3, compare system views, and run live scans to identify hidden modules, altered calls, and suspicious inconsistencies.
中文简介正在准备中。当前显示英语简介。
Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.
中文简介正在准备中。当前显示原文说明。
Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.
中文简介正在准备中。当前显示原文说明。
Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
中文简介正在准备中。当前显示原文说明。
Intent-based observability + traceability router across layers, boundaries, and signals. Routes to vendor-specific skills via category taxonomy; owns transport tuning, meta-observability, incident forensics. Use for observability, traceability, telemetry, APM, RUM, metrics, logs, traces, profiles, SLO, incident forensics, tracing architecture work.
中文简介正在准备中。当前显示原文说明。
Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.
中文简介正在准备中。当前显示原文说明。
Use when a GSD run failed, stalled, or produced the wrong result and the cause is unclear. Reads git history and .planning/ state and phase artifacts to diagnose root cause, then writes a report to .planning/forensics/.
中文简介正在准备中。当前显示原文说明。
IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology
中文简介正在准备中。当前显示原文说明。
Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining, anti-forensics detection, cloud IR, ransomware/ESXi response
中文简介正在准备中。当前显示原文说明。
Cross-agent self-inspection of your AI-agent stack. Audits skills, MCP servers, hooks, plugins, commands, credentials, and memory files across Claude Code, Codex, OpenClaw, and NanoClaw. Produces a structured inventory and narrative briefing with cross-ecosystem risk analysis. Use when the user asks to audit their own setup, check what they have installed, review their agent stack security posture, or understand cross-tool interactions. Use when a user has accumulated skills/plugins/MCP servers over time and wants visibility into their attack surface. Use after installing new skills or plugins. Do NOT use for vetting external code before install (that is repo-forensics). Do NOT use for incident response during active attacks. Do NOT use for fixing or patching vulnerabilities (forensify is read-only).
中文简介正在准备中。当前显示原文说明。
Audit experiment integrity against the evidence ledger. At L2 (repo + result files present) a fresh cross-model reviewer reads the eval code line-by-line for fake/derived ground truth, score self-normalization, phantom results (a paper number with no backing file/key), dead/uncalled metric code, verified-scope inflation, method-described ≠ method-evaluated drift, synthesized-looking results, placeholder/fake data still wired into a released result, code-output ≠ reported-number mismatch, and missing reproducibility artifacts (an empirical/agent/LLM paper shipping neither code nor the prompts/configs its results need) — every finding span-anchored to a ledger claim_id. At L0/L1 (PDF / source only) the same patterns are surfaced as info-level 'could-not-verify' signals where the ledger gives an anchor (observability_level_required:2) — NEVER a fraud verdict from a PDF. The reviewer PROPOSES findings; tools/adjudicate_findings.py computes the verdict. Detect-only. Triggers: "experiment forensics", "audit the results", "check the eval code", "实验诚实度".
中文简介正在准备中。当前显示原文说明。
Digital forensics techniques for detecting device compromise, analyzing malware indicators, and investigating targeted surveillance. Based on methodologies from Citizen Lab's Pegasus Project and Predator investigations.
中文简介正在准备中。当前显示原文说明。
Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
中文简介正在准备中。当前显示原文说明。
Digital forensics and incident response triage skill for disk, memory, network, cloud, and endpoint artifacts. Covers Volatility 3, Velociraptor, KAPE, Plaso, Autopsy, Chainsaw, Hayabusa, Zeek, Arkime, EVTX, AWS/Azure/GCP audit logs, and timeline reconstruction. Use to extract IOCs, build incident timelines, and produce defensible analyst reports.
中文简介正在准备中。当前显示原文说明。
Conduct digital forensics investigations — evidence acquisition, timeline analysis, and court-ready documentation.
中文简介正在准备中。当前显示原文说明。
Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.
中文简介正在准备中。当前显示原文说明。
Analyzes a memory image with Volatility 3 to find malware: rogue processes, injected code, suspicious network connections, loaded modules, and persistence, then extracts artifacts for further analysis. Activates for requests to do memory forensics, analyze a RAM dump, or hunt malware in memory with Volatility.
中文简介正在准备中。当前显示原文说明。
Use when a task needs the judgment of a Digital Forensics Analyst — capturing volatile evidence before it's lost, creating and hash-verifying a forensic disk image, documenting chain of custody from point of seizure, correcting for clock skew and timezone mismatches when building a cross-source timeline, or identifying anti-forensic activity (log wiping, timestomping) in an investigation.
中文简介正在准备中。当前显示原文说明。
Use common CLI, Kali, and shell tools to inspect web Targets, captured assets, logs, HAR/PCAP files, packages, and generated artifacts, then turn observations into Evidence, Security Signals, and ranked Hypotheses. Use when the user asks for web bug-hunting inspection, digital records, URL maps, crawling, endpoint discovery, JS bundle/package analysis, light forensics, or command-line investigation workflows.
中文简介正在准备中。当前显示原文说明。
Use when a release review needs machine-derived evidence from git history — hotspot risk and change-coupling analyzers. Triggers on 'hotspot', 'what changes together', 'release forensics'.
中文简介正在准备中。当前显示原文说明。
Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques. Activates for requests involving rootkit detection, hidden process discovery, kernel integrity checking, or system call hook analysis.
中文简介正在准备中。当前显示原文说明。
Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.
中文简介正在准备中。当前显示原文说明。