Individual skill
ctf-forensics
Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.
ctf-forensics/SKILL.md
Source commit a6106aaf5f1f4eeb6b95908f11c2314c7150dfac
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 3,674
- Repository last updated
- Nov 6, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- claude-code-skills Repository topic
- ctf Repository topic
- security Repository topic
- claude-code Repository topic
- codex Repository topic
- codex-cli Repository topic
- gemini Repository topic
- gemini-cli Repository topic
- opencode Repository topic
- devops Derived category
- devops-containers Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
3d-printing.mddoc · 4,210 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesSKILL.mdcore · 37,034 bytesdisk-advanced.mddoc · 21,034 bytesdisk-and-memory.mddoc · 20,078 bytesdisk-recovery.mddoc · 31,594 byteslinux-forensics.mddoc · 19,343 bytesnetwork-advanced.mddoc · 26,655 bytesnetwork.mddoc · 22,311 bytesperipheral-capture.mddoc · 12,367 bytessignals-and-hardware.mddoc · 29,606 bytessteganography.mddoc · 30,660 bytesstego-advanced-2.mddoc · 21,174 bytesstego-advanced.mddoc · 19,975 bytesstego-image.mddoc · 30,398 byteswindows.mddoc · 23,005 bytes
Read excerpt
# CTF Forensics & Blockchain
Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details.
## Prerequisites
**Python packages (all platforms):**
```bash
pip install volatility3 Pillow numpy matplotlib scipy librosa scikit-learn opencv-python-headless pymongo impacket brotli exrex stegano heatshrink2
```
**Linux (apt):**
```bash
apt install binwalk foremost libimage-exiftool-perl tshark sleuthkit \