12 tagged digital forensics, measured the same way as everything else here.
Browse within: dfir 8forensics 6incident-response 6
Skill Claude CodeCodex
Cyber threat intelligence and OSINT analysis toolkit. Runs structured investigations and delivers analyst-grade intelligence products with sourced, trust-scored findings. Use for OSINT and CTI cases, digital-footprint and exposure review, domain/subdomain/DNS/certificate recon, web-infrastructure pivoting (favicon…
Skill Claude CodeCodexCursor
Process image files into validated CASE/UCO or CAC knowledge graphs. Use when the user provides images, receipts, screenshots, scans, photos, OCR output, or asks to convert an image file into CASE/UCO/CAC JSON-LD.
Skill Claude CodeCodex
Local-first AI watermark detection, Unicode steganography forensics, document sanitization, and C2PA provenance extraction.
kev365/xways-xtension-builder-skill
Skill Claude CodeCodex
This skill should be used when the user asks to "create/scaffold a new X-Tension", "wrap a CLI tool in an X-Tension", "port a convention into an X-Tension" (helper-exe verification, Ctrl-to-save, output-dir), "audit/modernize an X-Tension", "build/compile an X-Tension", "prep an X-Tension for public release", or asks…
Skill Claude CodeCodex
REQUIRED when the user says "start investigation", "investigate", "analyze case", "Read case-templates/manifest.json", references a manifest.json, or provides a SAVVYDFIR-MCP caseid. Defines the 5-phase DFIR methodology from evidence mounting through report generation, with mandatory tools, decision points, and…
Skill Claude CodeCodex
Load when you have an initial finding and need to determine what to investigate next. Defines universal pivot chains from each artifact type to related evidence, enabling systematic investigation expansion.
Skill Claude CodeCodex
Load when you need exact command syntax for SIFT Workstation tools. Covers Volatility 3, Sleuth Kit, EZ Tools, Plaso, YARA, and Regripper with actual invocation examples and output parsing guidance.
Skill Claude CodeCodex
Use when writing or creating Sigma rules, reviewing detection rules, discussing detection coverage, or working with YAML detection files. Enforces this project's detection rule standards (ATT&CK mapping, severity justification, false positive documentation, test cases, naming conventions).
Skill Claude CodeCodex
Use when ingesting threat-intelligence IOC data (native JSON lists, MISP JSON event exports), normalizing indicators to a common schema, or correlating them across sources and against this project's Sigma rule coverage. Enforces the normalized IOC schema and the v1 scope limits below.