Ctf Forensics
Battle-tested CTF forensics reference: disk, memory, PCAP, stego, Windows logs, Volatility.
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 20, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · 14f4b88
Fetched the repo tree (monorepo of 8 CTF skills) and the full 462-line ctf-forensics/SKILL.md plus README raw. Frontmatter parses with name+description; all 14 referenced supporting .md files (windows.md, disk-and-memory.md, network.md, etc.) exist in the tree; no exfiltration/base64/hidden-instruction payloads (the "exfil" strings are legit CTF technique descriptions). Output test: skill gave far more specific correct guidance than baseline — exact vol3 windows.cmdline command and a concrete cleared-logs artifact list (USN $J journal, SAM key last_modified timestamps, PowerShell history, Defender MPLog, Prefetch) with Event ID 4720, vs my vaguer baseline.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 8/10
- Docs & honesty 5/5
What Ctf Forensics does
A CTF digital-forensics quick-reference skill: disk/memory/network/PCAP analysis, steganography, Windows event logs, Volatility, PDF and blockchain tracing. Auto-loads (description-triggered) when a task involves analyzing forensic artifacts or recovering hidden/deleted data.
How to install Ctf Forensics
npx skills add ljagiello/ctf-skills (installs the whole suite; ctf-forensics is one dir). Forensics tools (volatility3, binwalk, sleuthkit, exiftool, tshark, steghide, zsteg) must be installed separately via the listed pip/apt/brew/gem commands to actually execute the techniques.
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Ctf Forensics
-
/ctf-forensicsBattle-tested CTF forensics reference: disk, memory, PCAP, stego, Windows logs, Volatility.
It also activates on plain-language prompts like these:
-
Analyze this memory dump for hidden processes -
Extract data from this steganography image -
Recover deleted files from this disk image
Frequently asked questions
- Is the Ctf Forensics skill free?
- Yes. The skill itself is free from ljagiello/ctf-skills. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Ctf Forensics work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 20, 2026. Verdict: Tested · Works. Fetched the repo tree (monorepo of 8 CTF skills) and the full 462-line ctf-forensics/SKILL.md plus README raw. Frontmatter parses with name+description; all 14 referenced supporting .md files (windows.md, disk-and-memory.md, network.md, etc.) exist in the tree; no exfiltration/base64/hidden-instruction payloads (the "exfil" strings are legit CTF technique descriptions). Output test: skill gave far more specific correct guidance than baseline — exact vol3 windows.cmdline command and a concrete cleared-logs artifact list (USN $J journal, SAM key last_modified timestamps, PowerShell history, Defender MPLog, Prefetch) with Event ID 4720, vs my vaguer baseline.
- What is the Ctf Forensics SkillProof Score?
- 9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 5/5.
- How do I install Ctf Forensics?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Ctf Forensics with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.