Skill collection
tsale/awesome-dfir-skills agent skills
- skills
- 5
- GitHub stars
- 323
GitHub description: “A curated collection of DFIR skills and workflows for InfoSec practitioners.”
- Stars
- 323 (36 forks)
- Licence
- Apache-2.0
- Last push
- May 2026
- Created
- Dec 2025
Install all skills
npx skills add tsale/awesome-dfir-skillsAdd --skill <name> for a single skill and -a <agent> to choose the agent (see the agent guides).
Skills in tsale/awesome-dfir-skills, ranked
Ranked by score. Sort bymost stars,trending,newest,recently updated
| # | Skill | Repository | Stars | Used in | Tokens | Auto-check | Licence | Updated |
|---|---|---|---|---|---|---|---|---|
| 1 | Professional malware analysis workflow for PE executables and suspicious files. | tsale/ | 323 | — | ~2.5k | Automated safety check: Pass | Apache-2.0 | 5 mo ago |
| 2 | Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach analysis. | tsale/ | 323 | — | ~3.4k | Automated safety check: Pass | Apache-2.0 | 5 mo ago |
| 3 | Analyse Mitre ATT&CK tactics, techniques and sub-techniques. | tsale/ | 323 | — | ~1.4k | Automated safety check: Pass | Apache-2.0 | 5 mo ago |
| 4 | Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source. | tsale/ | 323 | — | ~1.5k | Automated safety check: Pass | Apache-2.0 | 5 mo ago |
| 5 | Build structured threat actor profiles using the 5W1H framework and the Diamond Model. | tsale/ | 323 | — | ~2.8k | Automated safety check: Pass | Apache-2.0 | 5 mo ago |
Questions, answered from the data.
What is the best skill in tsale/awesome-dfir-skills?
Malware Analysis from tsale/awesome-dfir-skills ranks first of the 5 skills in tsale/awesome-dfir-skills listed here, with the highest score: its repository has 323 GitHub stars, its SKILL.md loads about 2.5k tokens and it passes the automated safety check with no findings. Next come Admiralty System and Analysing Attack.
Are the skills in tsale/awesome-dfir-skills official?
None yet. All 5 skills in tsale/awesome-dfir-skills listed here come from community repositories; a skill counts as official when the product's own GitHub organization publishes it.
How do I install all skills from tsale/awesome-dfir-skills?
Run npx skills add tsale/awesome-dfir-skills in your project: the open-source skills CLI installs the repository's skills into your coding agent's skills folder. To install a single skill, open its page here for the exact command.
How are these skills ranked?
By Skill Navigator score, which combines the GitHub stars of the skill's repository (shared across that repo's skills and discounted for large collections), how many other GitHub owners carry a copy of the skill, and automated SKILL.md quality checks, minus penalties for safety-check warnings and for each further skill from the same repository. Skills that fail the safety check are not listed.