create-rule
Create Cursor rules for persistent AI guidance. Use when the user wants to create a rule, add coding standards, set up project…
@coco-researchInstall SkillDevelopment
Skill
/digital-forensics
Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.
Claude Code
$ npx -y skills add coco-research/coco --skill digital-forensics --agent claude-code
Codex
$ npx skills add coco-research/coco --skill digital-forensics -a codex -y
Cursor
$ npx skills add coco-research/coco --skill digital-forensics -a cursor -y
Gemini CLI
$ npx skills add coco-research/coco --skill digital-forensics -a gemini-cli -y
GitHub Copilot
$ npx skills add coco-research/coco --skill digital-forensics -a github-copilot -y
OpenCode
$ npx skills add coco-research/coco --skill digital-forensics -a opencode -y
Windsurf
$ npx skills add coco-research/coco --skill digital-forensics -a windsurf -y
SKILL.md
digital-forensics.SKILL.mdname: digital-forensics description: Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation. user-invocable: true
Digital Forensics & IR Artifacts
适用场景
- 内存转储分析（Volatility 2/3）
- 磁盘/ E01 / 落地文件时间线
- PCAP 溯源与协议还原（可联合 `protocol-reverse/`）
- 主机伪影：Prefetch、Shimcache、Event Log、浏览器历史
- 应急响应 IOC 提炼（联合 `malware-analysis/` / `threat-hunting/`）
工作流
1. 保全
□ 计算 SHA256；记录时区与采集命令 □ 工作在副本上；原始只读 □ chain of custody 备注写入 timeline
2. 内存
vol -f mem.dmp windows.info vol -f mem.dmp windows.pslist vol -f mem.dmp windows.netscan vol -f mem.dmp windows.cmdline
3. 主机伪影
□ 事件日志：Security / PowerShell / Sysmon □ 持久化：Run 键、服务、计划任务、WMI □ 执行痕迹：Amcache、Prefetch、BAM
4. 网络
□ tshark 统计会话与 DNS □ 导出可疑流 → protocol-reverse 或 malware C2 分析
工具链
| 工具 | 用途 | |------|------| | Volatility 3 | 内存 | | Timeline Explorer / Plaso | 超级时间线 | | tshark | PCAP | | Eric Zimmerman 工具集 | Windows 伪影 | | Autopsy / FTK Imager | 磁盘 |
参考
- `references/forensics-triage.md`
- `../malware-analysis/` `../threat-hunting/` `../protocol-reverse/`
Ships withcoco
495 personas across 13 departments, 229 skills[^installed] and 388 commands in the full catalog (coco 1.9.0, 2026-10-21). Agent skills, slash commands and subagents for Claude Code, Cursor, Codex and other AI coding agents.
796200 skills53 agents
Stars on GitHub
Momentum
- stars in total
- 796
Other skills on coco.
@coco-researchInstall Skillcreate-skill
Guides users through creating effective Agent Skills for Cursor. Use when the user wants to create, write, or author a new skill,…
@coco-researchInstall Skillcreate-subagent
Create custom subagents for specialized AI tasks. Use when the user wants to create a new type of subagent, set up task-specific…
@coco-researchInstall Skillmigrate-to-skills
Convert 'Applied intelligently' Cursor rules (.cursor/rules/*.mdc) and slash commands (.cursor/commands/*.md) to Agent Skills…
@coco-researchInstall Skillupdate-cursor-settings
Modify Cursor/VSCode user settings in settings.json. Use when the user wants to change editor settings, preferences,…
@coco-researchInstall Skillagent-lightning
Train and optimize AI agents using Microsoft's Agent Lightning framework with reinforcement learning. Use when setting up agent…
@coco-researchInstall SkillMore skills from other plugins.
Auto-invoked
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, modifying behavior, or…
@obraInstall Skillask-matt
Ask which skill or flow fits your situation. A router over the skills in this repo.
@mattpocockInstall SkillAuto-invoked
Questions about digital-forensics.
- Which coding agents can use digital-forensics?
- digital-forensics installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.