ctf-forensics

Digital forensics CTF workflow.

IndexedMIT

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/onesword-ai-ctf-forensics

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Digital forensics CTF workflow. Use for PCAPs, disk images, memory dumps, logs, documents, images, archives, carved files, metadata, timeline analysis, steganography-adjacent artifacts, and evidence extraction.

Use cases: productivity

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/ctf-forensics

What's inside

Skill name: ctf-forensics
Description: Digital forensics CTF workflow. Use for PCAPs, disk images, memory dumps, logs, documents, images, archives, carved files, metadata, timeline analysis, steganography-adjacent artifacts, and evidence extraction.
License: MIT
Instructions: 19 lines in SKILL.md · view on GitHub

Files (2)

SKILL.md
openai.yaml · agents/

SKILL.md (first lines)

# CTF Forensics

## Workflow

1. Preserve artifact paths and hashes before analysis when possible.
2. Identify file types, container layers, embedded files, compression, encryption, metadata, and timestamps.
3. Extract low-cost evidence first: file, strings, exiftool-style metadata, archive listings, binwalk-like signatures, and PCAP conversations.
4. Follow recovered indicators into focused analysis: carved files, credentials, HTTP objects, DNS queries, clipboard data, process memory, or document macros.
5. Decode candidate data through common encodings only when evidence supports it.

## Evidence Rules

Record source artifact, extraction command, offset/path/stream, decoded value, and final flag location. Keep intermediate artifacts under the run artifacts directory.

## Output

Return evidence chain, extracted files, candidate flags, and next actions for missing passwords, encrypted archives, or deeper memory/network analysis.

From OneSword-AI/CyberAgent, MIT.

Signals

Stars: 0
Forks: 0
Open issues: 0
Last commit (this folder): Aug 18, 2026 (2 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License: MIT
Repository: github.com/OneSword-AI/CyberAgent
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from OneSword-AI

Cite this page

ctf-forensics skill. Agent Mart. https://agentmart.dev/skills/onesword-ai-ctf-forensics (last updated 2026-10-24)