Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xamirhamza77/reverseops-skill/digital-forensicsnpx skills add xAmirHamza77/ReverseOps-Skill --skill digital-forensicsgit clone --depth 1 https://github.com/xAmirHamza77/ReverseOps-SkillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xamirhamza77/reverseops-skill/digital-forensics)<a href="https://agentmods.dev/skills/xamirhamza77/reverseops-skill/digital-forensics"><img src="https://agentmods.dev/badge/skills/xamirhamza77/reverseops-skill/digital-forensics.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00030 | $0.00590 |
| Opus 5 | $0.00015 | $0.00295 |
| Sonnet 5 | $0.00006 | $0.00118 |
| Haiku 4.5 | $0.00003 | $0.00059 |
Grade A, and why
digital-forensics scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Digital Forensics & IR Artifacts
ACTION REQUIRED (execute immediately after reading)
NOW: Read../field-journal/precedent-pentest.mdor the organization's IR authorization statementNOW: Confirm this is forensics/tracing, not offensive scanningNOW: Set up the case; work on read-only copies of evidence first (write-protect original media)NEXT: tool-index; Volatility etc. are often manual installsACT: Preserve hashes → timeline → key artifacts
Applicable Scenarios
- Memory dump analysis (Volatility 2/3)
- Disk / E01 / dropped-file timelines
- PCAP tracing and protocol reconstruction (can be combined with
protocol-reverse/) - Host artifacts: Prefetch, Shimcache, Event Logs, browser history
- IOC extraction for incident response (combined with
malware-analysis//threat-hunting/)
Workflow
1. Preservation
□ Compute SHA256; record timezone and acquisition commands
□ Work on a copy; keep the original read-only
□ Add chain-of-custody notes to the timeline
2. Memory
vol -f mem.dmp windows.info
vol -f mem.dmp windows.pslist
vol -f mem.dmp windows.netscan
vol -f mem.dmp windows.cmdline
3. Host Artifacts
□ Event logs: Security / PowerShell / Sysmon
□ Persistence: Run keys, services, scheduled tasks, WMI
□ Execution traces: Amcache, Prefetch, BAM
4. Network
□ tshark session and DNS statistics
□ Export suspicious streams → protocol-reverse or malware C2 analysis
Toolchain
| Tool | Purpose |
|---|---|
| Volatility 3 | Memory |
| Timeline Explorer / Plaso | Super timeline |
| tshark | PCAP |
| Eric Zimmerman's tools | Windows artifacts |
| Autopsy / FTK Imager | Disk |
References
references/forensics-triage.md../malware-analysis/../threat-hunting/../protocol-reverse/
Routing Context
Upstream: MASTER R25
Downstream: deeper malware sample analysis → malware-analysis; detection rules → threat-hunting
Task Completion Checklist
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 83 lines · 30 tokens per session scan A 0a0b678a6abf
digital-forensics is a skill published in the GitHub repository xAmirHamza77/ReverseOps-Skill (4 stars, last pushed 1mo ago), licensed MIT. It adds 30 tokens to every session and 590 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
guardian-memory
Maintain project context in Project Guardian's memory.db knowledge graph. Use during coding, debugging, planning, and project-management sessions to restore relevant context and record significant decisions, changes, tasks, and milestones.
guardian-tracker
Auto-tracking skill for Project-Guardian. Automatically records file changes, code edits, decisions, and bug fixes to memory.db. Trigger after every significant operation (file edit, git commit, bug fix, refactor). Uses git diff and file analysis to generate observations.
guardian-session
Restore relevant Project Guardian context from memory.db at session start. Use when resuming project work, switching repositories, or answering what was previously in progress; surface active tasks, open bugs, recent observations, and blockers.
state-memory-mcp
Teaches the agent to use the state-memory-mcp MCP server to track workflow state, tasks, decisions, blockers, artifacts, plans, milestones, and their semantic relationships in a persistent graph database.
video-ingest
Teaches the agent to process, ingest, analyze, and compare WebM, MP4, and GIF video recordings using vision-memory-mcp and state-memory-mcp.
vision-memory-mcp
Teaches the agent to use the Visual Memory MCP server to cache webpage and application screenshots, matching layout states and avoiding redundant LLM vision calls.