Is the Ffind skill free?

Yes. The skill itself is free from BrownFineSecurity/iothackbot. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Ffind SkillProof Score?

8.0/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 6/10, docs & honesty 4/5.

How do I install Ffind?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Ffind with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Ffind

File type detection via libmagic plus ext/F2FS filesystem extraction for firmware

by BrownFineSecurity · BrownFineSecurity/iothackbot

Works with setup

Install — copy the command Download source ↗

Test report

Verdict: Works with setup
Score: 8.0/10
Tested: Jul 21, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 88278a1

Cloned the repo and ran bin/ffind live: --help matched the documented flags exactly, and on a 6-file test dir it grouped files by MIME type with counts and emitted structured JSON (total_files, detection_failures). Baseline was `file`/`file --mime-type`: same underlying libmagic descriptions but a flat per-file list, whereas ffind adds recursive dir-walk in one call, MIME grouping, JSON, and bucketed device.pem as application/x-pem-file vs baseline text/plain — a modest improvement, so output ~6. Requires python-magic+libmagic (errors "python-magic not available" otherwise); the headline filesystem-extraction (-e) is Linux-only (losetup/mount) and untestable on macOS. Observed doc bug: SKILL.md claims `-a` toggles artifact-only vs all types, but the text formatter always prints all types so the flag had no effect. Verdict setup because the tool isn't bundled in the skill dir (needs the whole repo on PATH) and extraction needs sudo+e2fsprogs on Linux.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 6/10
Docs & honesty 4/5

What Ffind does

Wraps the iothackbot `ffind` CLI to identify file types via libmagic and optionally extract ext2/3/4 or F2FS filesystems from firmware images, with text/JSON output. Triggers when the user wants to analyze a firmware blob, identify file types across a directory, or extract embedded filesystems. Type detection runs anywhere libmagic is installed; extraction is Linux-only and needs sudo plus e2fsprogs/f2fs-tools.

How to install Ffind

git clone --depth 1 https://github.com/BrownFineSecurity/iothackbot.git /tmp/ffind-src
mkdir -p ~/.claude/skills
cp -R /tmp/ffind-src/skills/ffind ~/.claude/skills/ffind
# The SKILL.md invokes the `ffind` CLI, which is NOT inside the skill dir — it lives in the cloned repo.
# Put it on PATH and install deps to actually run it:
#   export PATH="/tmp/ffind-src/bin:$PATH"   # (bin/ffind adds tools/ to sys.path; keep the repo, don't delete /tmp/ffind-src)
#   pip install python-magic colorama
#   macOS: brew install libmagic   |   Debian/Ubuntu: apt-get install libmagic1
# Usage: ffind <path> [-a] [-v] [--format text|json|quiet]
# Extraction (ffind <path> -e) is Linux-only: needs sudo + losetup/mount + e2fsprogs (ext) / f2fs-tools (F2FS).
# Name collision: The Sleuth Kit also ships /usr/bin/ffind — check `ffind --help` shows --extract/--format, else call bin/ffind by full path.

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Ffind

/ffind File type detection via libmagic plus ext/F2FS filesystem extraction for firmware

It also activates on plain-language prompts like these:

Identify file types inside this firmware dump
Extract the ext4 filesystem from this image
Find embedded F2FS partitions in this firmware file

Frequently asked questions

Is the Ffind skill free?: Yes. The skill itself is free from BrownFineSecurity/iothackbot. SkillProof publishes the install command and an independent test verdict at no cost.
Does Ffind work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 21, 2026. Verdict: Works with setup. Cloned the repo and ran bin/ffind live: --help matched the documented flags exactly, and on a 6-file test dir it grouped files by MIME type with counts and emitted structured JSON (total_files, detection_failures). Baseline was `file`/`file --mime-type`: same underlying libmagic descriptions but a flat per-file list, whereas ffind adds recursive dir-walk in one call, MIME grouping, JSON, and bucketed device.pem as application/x-pem-file vs baseline text/plain — a modest improvement, so output ~6. Requires python-magic+libmagic (errors "python-magic not available" otherwise); the headline filesystem-extraction (-e) is Linux-only (losetup/mount) and untestable on macOS. Observed doc bug: SKILL.md claims `-a` toggles artifact-only vs all types, but the text formatter always prints all types so the flag had no effect. Verdict setup because the tool isn't bundled in the skill dir (needs the whole repo on PATH) and extraction needs sudo+e2fsprogs on Linux.
What is the Ffind SkillProof Score?: 8.0/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 6/10, docs & honesty 4/5.
How do I install Ffind?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Ffind with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.