memory-forensics

memory-forensics is a skill for Claude Code, Codex from rmyndharis/antigravity-skills. It costs 43 tokens per session (2,818 once invoked), scanned A, original, MIT.

A guide to investigating computer memory dumps, which are captured snapshots of a system’s RAM.

In plain words
What is it for?
It covers acquiring memory from Windows, Linux, macOS, and virtual machines, then analyzing and extracting artifacts with tools such as Volatility.
Why use it?
It helps incident responders find evidence that may not remain on disk, including running processes and traces of malicious activity.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit It covers acquiring memory from Windows, Linux, macOS, and virtual machines, then analyzing and extracting artifacts with tools such as Volatility.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/rmyndharis/antigravity-skills/memory-forensics
About the project

Antigravity Skill Vault is a collection of reusable Agent Skills for Google Antigravity, covering software development, operations, security, and business work. It is for people who want Antigravity agents to follow specialized expertise, personas, and structured workflows. The catalogue skills are entries from this collection.

rmyndharis/antigravity-skills · 1,529 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add rmyndharis/antigravity-skills --skill memory-forensics
Clone the repo
git clone --depth 1 https://github.com/rmyndharis/antigravity-skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for memory-forensics

README.md
[![agentmods](https://agentmods.dev/badge/skills/rmyndharis/antigravity-skills/memory-forensics/github.svg)](https://agentmods.dev/skills/rmyndharis/antigravity-skills/memory-forensics)
Your own site
<a href="https://agentmods.dev/skills/rmyndharis/antigravity-skills/memory-forensics"><img src="https://agentmods.dev/badge/skills/rmyndharis/antigravity-skills/memory-forensics/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for memory-forensics

Your own site · 80×15
<a href="https://agentmods.dev/skills/rmyndharis/antigravity-skills/memory-forensics"><img src="https://agentmods.dev/badge/skills/rmyndharis/antigravity-skills/memory-forensics.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 43 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,818 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 5 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high YARA Match · line 386
    YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
    Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
  • medium Privilege Escalation · line 48
    Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
    Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
  • medium Privilege Escalation · line 54
    Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
    Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
  • medium Privilege Escalation · line 60
    Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
    Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
  • medium Privilege Escalation · line 51
    Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
    Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00043 $0.02818
Opus 5 $0.00022 $0.01409
Sonnet 5 $0.00009 $0.00564
Haiku 4.5 $0.00004 $0.00282

Measured 9d ago against content hash 3a6a1ff995df, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

memory-forensics scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootlowPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

skills/memory-forensics/SKILL.md · 491 lines

How it starts

The opening of the file, as written. The whole thing — 491 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Memory Forensics

Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.

Use this skill when

  • Working on memory forensics tasks or workflows
  • Needing guidance, best practices, or checklists for memory forensics

Do not use this skill when

  • The task is unrelated to memory forensics
  • You need a different domain or tool outside this scope

Instructions

  • Clarify goals, constraints, and required inputs.
  • Apply relevant best practices and validate outcomes.
  • Provide actionable steps and verification.

Memory Acquisition

Live Acquisition Tools

Windows
# WinPmem (Recommended)
winpmem_mini_x64.exe memory.raw

# DumpIt
DumpIt.exe

# Belkasoft RAM Capturer
# GUI-based, outputs raw format

# Magnet RAM Capture
# GUI-based, outputs raw format
Linux
# LiME (Linux Memory Extractor)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (limited, requires permissions)
sudo dd if=/dev/mem of=memory.raw bs=1M

# /proc/kcore (ELF format)
sudo cp /proc/kcore memory.elf
macOS
# osxpmem
sudo ./osxpmem -o memory.raw

# MacQuisition (commercial)

Virtual Machine Memory

# VMware: .vmem file is raw memory
cp vm.vmem memory.raw

# VirtualBox: Use debug console
vboxmanage debugvm "VMName" dumpvmcore --filename memory.elf

# QEMU
virsh dump <domain> memory.raw --memory-only

# Hyper-V
# Checkpoint contains memory state

Volatility 3 Framework

Installation and Setup

# Install Volatility 3
pip install volatility3

# Install symbol tables (Windows)
# Download from https://downloads.volatilityfoundation.org/volatility3/symbols/

# Basic usage
vol -f memory.raw <plugin>

# With symbol path
vol -f memory.raw -s /path/to/symbols windows.pslist

Essential Plugins

Process Analysis
# List processes
vol -f memory.raw windows.pslist

# Process tree (parent-child relationships)
vol -f memory.raw windows.pstree

# Hidden process detection
vol -f memory.raw windows.psscan

# Process memory dumps
vol -f memory.raw windows.memmap --pid <PID> --dump

# Process environment variables
vol -f memory.raw windows.envars --pid <PID>

# Command line arguments
vol -f memory.raw windows.cmdline

Read the full file on GitHub · 491 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 491 lines · 43 tokens per session scan A 3a6a1ff995df

Subscribe to this mod's changes

memory-forensics is a skill published in the GitHub repository rmyndharis/antigravity-skills (1,529 stars, last pushed 1mo ago), licensed MIT. It adds 43 tokens to every session and 2,818 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

code-review

Systematic code review skill covering both requesting a review (pre-commit checklist) and receiving and responding to review feedback. Checks code quality, security, test coverage, architectural alignment, and documentation before any code is committed.

omergocmen/vibe-coder-kit · 47 tokens

writing-plans

TÜRKÇE AÇIKLAMA ─────────────── Bu skill, onaylanmış bir scope veya fikirden somut, uygulanabilir bir implementasyon planı üretir. Hangi dosya değişecek, hangi sırayla, kim yapacak, ne kadar sürecek, hangi riskler var — hepsini netleştirir. Planın çıktısı doğrudan executing-plans veya dispatching-parallel-agents…

omergocmen/vibe-coder-kit · 0 tokens

brainstorming

TÜRKÇE AÇIKLAMA ─────────────── Bu skill, bir fikir veya problemi Sokratik yöntemle rafine eder. Agent sana cevap vermez — sorular sorar. Bu sorular aracılığıyla fikrin netleşir, varsayımlar sorgulanır, kapsam belirlenir ve gerçek ihtiyaç ortaya çıkar. "Ne yapalım?" sorusunu "Tam olarak ne yapmamız gerekiyor ve…

omergocmen/vibe-coder-kit · 0 tokens

project-context-primer

Run this skill at the very start of any new conversation or agent session before writing a single line of code. It loads the project's architectural decisions, conventions, known gotchas, and current task status so the agent operates with full context — not as a blank slate.

omergocmen/vibe-coder-kit · 58 tokens

test-driven-execution

Before writing any implementation code, define the acceptance criteria and test cases that the code must satisfy. Agents then write code to pass these tests — not to match a vague description. Eliminates "it works on my machine" and "I think this is what you wanted" outcomes.

omergocmen/vibe-coder-kit · 61 tokens

idea-validator

Structured validation framework that scores product ideas. Use when evaluating problem severity, willingness-to-pay, or founder-market fit. For market intelligence, see market-research.

tuliosousapro/SaaS-blueprint · 35 tokens