welcome
01Command Claude Code
Post-install verification and onboarding for full Valhuntir.
not rated 18
changed 4d ago A 12 tokens
original MIT
case
02Command Claude Code
Manage forensic investigation cases.
not rated 18 today A 6 tokens
original MIT
Skill Claude CodeCodex
Use before calling recordfinding on forensic-mcp, to challenge a drafted forensic finding. An isolated skeptic re-runs the cited tools and tries to refute the observation and interpretation; the investigator then records the finding as it stands, revised, or withdrawn.
not rated 18 today A 57 tokens
original MIT
vhir-ingest
04Skill Claude CodeCodex
How to start an investigation once the evidence is surveyed: which tools to run first, ingesting evidence into OpenSearch (triage packages, memory, delimited files) and querying it. Use after the evidence survey, before analysis, or when ingesting or querying indexed evidence.
not rated 18 today A 61 tokens
original MIT
Skill Claude CodeCodex
When and how to send a suspicious file to REMnux for malware analysis, by what the other tools found (signatures, autoruns, prefetch, entropy, injection, YARA, network). Use when a file, process or binary looks suspicious.
not rated 18 today A 60 tokens
original MIT
Skill Claude CodeCodex
Investigation playbooks: step-by-step procedures, each with its triggers, phases and MITRE techniques. Use when an investigation needs one of: Credential Access Investigation; Data Staging Investigation; DNS Anomaly Investigation; Email Compromise Investigation; Log Tampering Investigation; Malware Analysis…
not rated 18 today A 105 tokens
original MIT
Skill Claude CodeCodex
Writing the investigation report with report-mcp: the report profiles, case metadata, the writing guidance to follow and saving the report. Use once findings are approved and a report is wanted.
not rated 18 today A 42 tokens
original MIT
Skill Claude CodeCodex
Which Valhuntir MCP tool or SIFT tool to use for a question, file, IOC or artifact, and the step-by-step workflows that combine them (IOC investigation, threat actor research, detection engineering, malware analysis, disk, memory, timeline and network). Use when choosing tools or planning a multi-step analysis.
not rated 18 today A 69 tokens
original MIT
vhir-welcome
09Skill Claude CodeCodex
Post-install verification and onboarding for Valhuntir: checks the gateway, backends, tools, knowledge base, report profiles and this client's controls, then explains how to work and how to start a case. Use right after installing, or when asked to verify the installation.
not rated 18 today B 59 tokens
original MIT
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: