Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add killvxk/cybersecurity-skills-zh --skill analyzing-lnk-file-and-jump-list-artifactsgit clone --depth 1 https://github.com/killvxk/cybersecurity-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-lnk-file-and-jump-list-artifacts)<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-lnk-file-and-jump-list-artifacts"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-lnk-file-and-jump-list-artifacts/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-lnk-file-and-jump-list-artifacts"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-lnk-file-and-jump-list-artifacts.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.02340 |
| Opus 5 | $0.00031 | $0.01170 |
| Sonnet 5 | $0.00012 | $0.00468 |
| Haiku 4.5 | $0.00006 | $0.00234 |
Grade A, and why
analyzing-lnk-file-and-jump-list-artifacts scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 192 lines — stays where its author put it; the contents beside it link to each section on GitHub.
分析 LNK 文件和 Jump List 制品
概述
Windows LNK（快捷方式）文件和 Jump List 是关键的取证制品（forensic artifact），提供文件访问、程序执行和用户行为的证据。当用户通过 Windows 资源管理器或"打开/保存"对话框打开文件时，会自动创建 LNK 文件，其中存储了目标文件的元数据，包括原始路径、时间戳、卷序列号、NetBIOS 名称以及主机系统的 MAC 地址。Windows 7 引入的 Jump List 通过维护每个应用程序最近和频繁访问文件的列表来扩展这一功能。即使目标文件被删除，这些制品仍然存在，使其成为证明用户在特定时间访问特定文件的宝贵手段。
前置条件
- LECmd（Eric Zimmerman）用于 LNK 文件解析
- JLECmd（Eric Zimmerman）用于 Jump List 解析
- Python 3.8+ 及 pylnk3 或 LnkParse3 库
- 来自 Windows 系统的取证镜像或分诊（triage）收集
- Timeline Explorer 用于 CSV 分析
LNK 文件位置
| 位置 | 描述 |
|---|---|
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\ |
最近访问的文件 |
%USERPROFILE%\Desktop\ |
用户创建的快捷方式 |
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\ |
开始菜单快捷方式 |
%USERPROFILE%\AppData\Roaming\Microsoft\Office\Recent\ |
Office 最近文档 |
LNK 文件结构
Shell Link 头部（76 字节）
| 偏移 | 大小 | 字段 |
|---|---|---|
| 0x00 | 4 | HeaderSize（始终为 0x0000004C） |
| 0x04 | 16 | LinkCLSID（始终为 00021401-0000-0000-C000-000000000046） |
| 0x14 | 4 | LinkFlags |
| 0x18 | 4 | FileAttributes |
| 0x1C | 8 | CreationTime（FILETIME） |
| 0x24 | 8 | AccessTime（FILETIME） |
| 0x2C | 8 | WriteTime（FILETIME） |
| 0x34 | 4 | 目标文件大小 |
| 0x38 | 4 | IconIndex |
| 0x3C | 4 | ShowCommand |
| 0x40 | 2 | HotKey |
LNK 文件中的关键取证字段
- 目标文件时间戳：被引用文件的创建、访问、修改时间
- 卷信息：序列号、驱动器类型、卷标
- 网络共享信息：UNC 路径、共享名称
- 机器标识符：NetBIOS 名称、MAC 地址（来自 TrackerDataBlock）
- 分布式链接跟踪：机器 ID 和对象 GUID
使用 EZ Tools 分析
LECmd——LNK 文件解析器
# 解析 Recent 文件夹中的所有 LNK 文件
LECmd.exe -d "C:\Evidence\Users\suspect\AppData\Roaming\Microsoft\Windows\Recent" --csv C:\Output --csvf lnk_analysis.csv
# 解析单个 LNK 文件并输出完整详情
LECmd.exe -f "C:\Evidence\Users\suspect\Desktop\Confidential.docx.lnk" --json C:\Output
# 解析 LNK 文件并附加详细级别
LECmd.exe -d "C:\Evidence\Users\suspect\AppData\Roaming\Microsoft\Windows\Recent" --csv C:\Output --csvf lnk_all.csv --all
JLECmd——Jump List 解析器
# 解析自动 Jump List
JLECmd.exe -d "C:\Evidence\Users\suspect\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" --csv C:\Output --csvf jumplists_auto.csv
# 解析自定义 Jump List
JLECmd.exe -d "C:\Evidence\Users\suspect\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" --csv C:\Output --csvf jumplists_custom.csv
# 解析所有 Jump List 并输出详细信息
JLECmd.exe -d "C:\Evidence\Users\suspect\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" --csv C:\Output --csvf jumplists_auto.csv --ld
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 192 lines · 62 tokens per session scan A 330ba7e6edcf
analyzing-lnk-file-and-jump-list-artifacts is a skill published in the GitHub repository killvxk/cybersecurity-skills-zh (45 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 62 tokens to every session and 2,340 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file access, program execution, and user activity that persists even after the target file is deleted. Use when investigating Windows user activity, reconstructing…
analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.
analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.
analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.
analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.
analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.