Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/unitoneai/securityskills/forensics-checklistnpx skills add UnitOneAI/SecuritySkills --skill forensics-checklistgit clone --depth 1 https://github.com/UnitOneAI/SecuritySkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/unitoneai/securityskills/forensics-checklist)<a href="https://agentmods.dev/skills/unitoneai/securityskills/forensics-checklist"><img src="https://agentmods.dev/badge/skills/unitoneai/securityskills/forensics-checklist.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00085 | $0.06228 |
| Opus 5 | $0.00043 | $0.03114 |
| Sonnet 5 | $0.00017 | $0.01246 |
| Haiku 4.5 | $0.00009 | $0.00623 |
Grade B, and why
forensics-checklist scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo insmod lime-$(uname -r).ko "path=/evidence/[hostname]_memory_[YYYYMMDD_HHMM].lime format=lime" How it starts
The opening of the file, as written. The whole thing — 500 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Digital Forensics Evidence Collection -- NIST SP 800-86 / RFC 3227
Frameworks: NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response), RFC 3227 (Guidelines for Evidence Collection and Archiving) Role: SOC Analyst, Security Engineer Time: 30-60 min Output: Evidence collection plan with volatility-ordered acquisition steps, chain-of-custody forms, integrity hashes, and cloud forensics considerations
1. When to Use
If a target is provided via arguments, focus the review on: $ARGUMENTS
Invoke this skill when any of the following conditions are met:
- Incident requires forensic evidence -- A confirmed or suspected security incident has progressed to a point where evidence must be preserved for root cause analysis, legal proceedings, or regulatory compliance.
- Volatile data capture is needed -- Systems that may contain volatile forensic evidence (memory, running processes, network connections) are at risk of being rebooted, reimaged, or shut down.
- Disk imaging is required -- A system must be forensically imaged before eradication or recovery actions alter the disk state.
- Chain of custody must be established -- Evidence may be used in legal proceedings, regulatory investigations, insurance claims, or internal disciplinary actions requiring documented provenance.
- Cloud environment evidence collection -- Forensic data must be captured from cloud infrastructure (AWS, Azure, GCP) where traditional disk imaging does not apply.
- Log preservation needed -- Logs at risk of rotation, overwrite, or deletion must be preserved before they are lost.
Do not use when: The task is incident classification and response coordination (use ir-playbook), containment strategy selection (use containment), or post-incident retrospective (use post-incident-review).
2. Context the Agent Needs
Before beginning evidence collection, gather or confirm:
- Incident ID and severity -- Reference to the associated incident response case.
- Affected systems -- Hostnames, IP addresses, OS type/version, physical/virtual/cloud, hypervisor type if virtual.
- Current system state -- Powered on (running), powered off, suspended (VM), or unknown.
- Legal hold status -- Has legal counsel issued a preservation directive? Are there litigation or regulatory holds in effect?
- Authorization -- Written authorization from system owner or legal authority to perform forensic acquisition.
- Evidence storage -- Write-protected storage media available (forensic drives, NAS, S3 bucket with object lock).
- Forensic tools available -- Memory capture (WinPmem, LiME, DumpIt), disk imaging (dc3dd, FTK Imager, ewfacquire), network capture (tcpdump, Wireshark).
- Cloud provider access -- IAM permissions for snapshot creation, log export, and API access (if cloud environment).
- Time synchronization -- NTP configuration of affected systems; UTC timestamps preferred.
- Encryption status -- BitLocker, LUKS, FileVault, or cloud-managed encryption on affected volumes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 500 lines · 85 tokens per session scan B 02a1613dff39
forensics-checklist is a skill published in the GitHub repository UnitOneAI/SecuritySkills (59 stars, last pushed 2mo ago), licensed MIT. It adds 85 tokens to every session and 6,228 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Incident Response & Digital Forensics
IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology.
agent-artifact-catalog
Research, author, and validate AI agent artifact catalog entries documenting the forensic artifacts AI agents leave on endpoints - install paths, config and credential files, MCP server configs, listening ports, process trees, registry keys, and the Windows event log records that prove a tool ran. Use this skill…
windows-prefetch-analysis
Analyze Windows prefetch files (.pf) to determine evidence of program execution. This skill details how to extract execution times, run counts, and the paths of files accessed by a program, which is critical for incident response and malware timeline reconstruction.
forensics-osquery
SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases. Enables rapid evidence collection, threat hunting, and incident response across Linux, macOS, and Windows endpoints. Use when: (1) Investigating security incidents and collecting forensic…
analyzing-malware-persistence-with-autoruns
Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.
analyzing-prefetch-files-for-execution-history
Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.