xalgorix/xalgorix is a self-hosted AI penetration-testing tool in which an LLM agent performs reconnaissance, looks for vulnerabilities, and coordinates exploitation, while a separate verifier re-tests findings before reporting them. It is for security teams, ethical hackers, and bug bounty work using a private, bring-your-own-LLM setup. The catalogue skills extend the agent's pentesting workflow.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add xalgorix/xalgorix --skill performing-endpoint-forensics-investigationgit clone --depth 1 https://github.com/xalgorix/xalgorixWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xalgorix/xalgorix/performing-endpoint-forensics-investigation)<a href="https://agentmods.dev/skills/xalgorix/xalgorix/performing-endpoint-forensics-investigation"><img src="https://agentmods.dev/badge/skills/xalgorix/xalgorix/performing-endpoint-forensics-investigation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xalgorix/xalgorix/performing-endpoint-forensics-investigation"><img src="https://agentmods.dev/badge/skills/xalgorix/xalgorix/performing-endpoint-forensics-investigation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.02343 |
| Opus 5.5 | $0.00028 | $0.00937 |
| Sonnet 5.5 | $0.00014 | $0.00469 |
| Haiku 4.5 | $0.00007 | $0.00234 |
Grade A, and why
performing-endpoint-forensics-investigation scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo insmod lime.ko "path=/evidence/memory.lime format=lime" Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 252 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Performing Endpoint Forensics Investigation
When to Use
Use this skill when:
- Investigating a confirmed or suspected endpoint compromise requiring forensic analysis
- Collecting volatile and non-volatile evidence for incident response or legal proceedings
- Analyzing memory dumps for malware, injected code, or credential theft artifacts
- Reconstructing attacker timelines from endpoint artifacts (prefetch, shimcache, amcache)
Do not use this skill for live threat hunting (use EDR/SIEM) or network forensics.
Detection Gaps & Validation
- Anti-forensics erases the obvious artifacts: attackers run
wevtutil cl, clear$UsnJrnl(fsutil usn deletejournal), timestomp viaSetFileTime, or delete Prefetch. Don't conclude "no activity" from an empty log — corroborate with sources they rarely clean:$MFT$SIvs$FNtimestamp mismatches (timestomping tell),$LogFile, SRUM, AmCache/ShimCache (survive file deletion), and memory. - Memory-only / fileless misses: PowerShell
-enc, reflective DLL injection, and process hollowing leave little on disk. Always acquire RAM first and runwindows.malfind,windows.cmdline, andwindows.netscan; absence of a binary on disk is not absence of compromise. - Single-artifact conclusions: Prefetch proves execution but a missing Prefetch entry doesn't prove non-execution (disabled on SSDs/servers, or deleted). Cross-corroborate execution across Prefetch + AmCache + ShimCache + Security 4688 + Sysmon 1 before ruling in or out.
- Timestamp/timezone drift: mixing UTC and local-time artifacts builds a false timeline. Normalize everything to UTC in plaso and confirm system timezone (SYSTEM hive) before sequencing events.
- Validation: verify image integrity (acquisition hash == verification hash) before analysis, and confirm a known event you can ground-truth (e.g., the responder's own logon) appears correctly in the super timeline before trusting attacker-event placement.
Prerequisites
- Forensic workstation with analysis tools (Volatility 3, KAPE, Autopsy, Eric Zimmerman tools)
- Write-blocker for disk imaging (hardware or software)
- Secure evidence storage with chain-of-custody documentation
- Memory acquisition tool (WinPMEM, FTK Imager, Magnet RAM Capture)
- Administrative access to the target endpoint (or physical access)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 252 lines · 70 tokens per session scan A d5205ee895ec
performing-endpoint-forensics-investigation is a skill published in the GitHub repository xalgorix/xalgorix (1,294 stars, last pushed today), licensed Apache-2.0. It adds 70 tokens to every session and 2,343 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-29.
Other skills, from other repositories
analyzing-linux-system-artifacts
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.
acquiring-disk-image-with-dd-and-dcfldd
Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.
analyzing-linux-system-artifacts
Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user/attacker activity. Use when investigating a compromised Linux server or workstation, hunting for persistence…
acquiring-disk-image-with-dd-and-dcfldd
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident…
analyzing-email-headers-for-phishing-investigation
Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.
analyzing-prefetch-files-for-execution-history
Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.