New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Conducting Memory Forensics With Volatility

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident…

Apache-2.0Auto-check passedSecurity

Install Conducting Memory Forensics With Volatility

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-memory-forensics-with-volatility -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills conducting-memory-forensics-with-volatility --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/conducting-memory-forensics-with-volatility .claude/skills/conducting-memory-forensics-with-volatility && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
conducting-memory-forensics-with-volatility
GitHub stars
34k
Token cost
~2.6k tokens
SKILL.md length
788 words
Files
4 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident…

  • Works in 7 steps: Acquire Memory Image → Identify the Operating System and Profile → Analyze Running Processes → …
  • Tasks that involve Digital forensics
  • SKILL.md covers When to Use, Prerequisites, Workflow and Key Concepts, plus 3 more sections
  • Runs Python scripts from its folder

What it does

Conducting Memory Forensics With Volatility is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.

Its SKILL.md is about 2.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).

It sits in Security, covering Digital forensics. It works with Linux. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Digital forensics

Example prompts

  • “Use the conducting-memory-forensics-with-volatility skill to perform memory forensics analysis using Volatility 3 to extract evidence of malware…”
  • “/conducting-memory-forensics-with-volatility”

Requirements

  • Python 3

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. Acquire Memory Image
  2. Identify the Operating System and Profile
  3. Analyze Running Processes
  4. Investigate Network Connections
  5. Detect Process Injection and Malware
  6. Extract Credentials and Artifacts
  7. Generate Forensic Report

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Conducting Memory Forensics With Volatility loads about 2.6k tokens when it runs, and up to ~3.2k if it reads all its reference files. Until then it costs about 126 tokens; SKILL.md has 788 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~126
When it runs · the whole SKILL.md, loaded when a task matches
~2.6k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 788 words, ~2,650 tokens.

Download SKILL.mdSave it as .claude/skills/conducting-memory-forensics-with-volatility/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
conducting-memory-forensics-with-volatility
description
Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.
domain
cybersecurity
subdomain
incident-response
tags
memory-forensics, volatility, RAM-analysis, process-injection, DFIR
mitre_attack
T1055, T1003.001, T1014, T1059.001, T1620
version
1.0.0
author
mahipal
license
Apache-2.0
nist_csf
RS.MA-01, RS.MA-02, RS.AN-03, RC.RP-01

Conducting Memory Forensics with Volatility

When to Use

  • An endpoint has been contained during an active incident and volatile evidence must be preserved
  • EDR alerts suggest process injection or fileless malware that only exists in memory
  • Encryption keys need to be recovered from a ransomware-infected system before shutdown
  • Credential theft (Mimikatz, LSASS dumping) is suspected and evidence must be confirmed
  • A rootkit or kernel-level compromise is suspected and disk-based analysis is insufficient

Do not use for analyzing disk images or file system artifacts; use disk forensics tools (Autopsy, FTK) for those tasks.

Prerequisites

  • Memory acquisition tool deployed or available: WinPmem, Magnet RAM Capture, DumpIt, or AVML (Linux)
  • Volatility 3 installed with Python 3.8+ and required symbol tables
  • Sufficient storage for memory dumps (equal to system RAM size, typically 8-64 GB)
  • YARA rules for malware detection in memory (Florian Roth's signature-base, custom rules)
  • Reference baseline of normal processes and DLLs for the OS version being analyzed
  • Chain of custody documentation for evidence handling

Workflow

Step 1: Acquire Memory Image

Capture RAM from the target system using a forensically sound method:

Windows (WinPmem):

winpmem_mini_x64.exe output.raw

Windows (Magnet RAM Capture):

MagnetRAMCapture.exe
# GUI-based, select output path, generates .raw file

Windows (DumpIt):

DumpIt.exe
# Creates memory dump in current directory automatically

Linux (AVML - Acquire Volatile Memory for Linux):

./avml output.lime

Document acquisition metadata:

Acquisition Record:
━━━━━━━━━━━━━━━━━
Target Host:      WKSTN-042
RAM Size:         16 GB
Dump File:        WKSTN-042_20251115_1445.raw
Dump Size:        16,843,612,160 bytes
SHA-256:          a4b3c2d1e5f6...
Acquisition Tool: WinPmem 4.0
Acquired By:      [Analyst Name]
Timestamp:        2025-11-15T14:45:00Z
Step 2: Identify the Operating System and Profile

Volatility 3 automatically identifies the OS, but verify:

bash
# Get system information
vol -f WKSTN-042_20251115_1445.raw windows.info

# Output includes:
# OS: Windows 10 22H2 (Build 19045.3693)
# Kernel Base: 0xf8066c200000
# DTB: 0x1aa000
# Symbols: ntkrnlmp.pdb
Step 3: Analyze Running Processes

Examine the process tree for suspicious activity:

bash
# List all running processes
vol -f memory.raw windows.pslist

# Show process tree (parent-child relationships)
vol -f memory.raw windows.pstree

# Scan for hidden/unlinked processes (rootkit detection)
vol -f memory.raw windows.psscan

# Compare pslist vs psscan to find hidden processes
# Processes in psscan but NOT in pslist may be hidden by rootkits

Key indicators of compromise in process analysis:

  • svchost.exe running without -k parameter or with wrong parent (should be services.exe)
  • csrss.exe or lsass.exe with abnormal parent process
  • Processes with misspelled names (scvhost.exe, lssas.exe)
  • Unusual processes spawned by outlook.exe, winword.exe, or excel.exe
  • Multiple instances of processes that should be singletons (lsass.exe, smss.exe)
Step 4: Investigate Network Connections

Extract active and recently closed network connections:

bash
# List all network connections
vol -f memory.raw windows.netscan

# Focus output fields:
# Offset    Proto  LocalAddr     LocalPort  ForeignAddr    ForeignPort  State     PID  Owner
# 0xe10...  TCPv4  10.1.5.42     49721     185.220.101.42  443         ESTAB     3847  update.exe

Cross-reference suspicious connections with the process tree to identify C2 communications. Look for:

  • Connections to external IPs from unexpected processes
  • High port numbers connecting to port 443/80 from non-browser processes
  • Connections from svchost.exe or system processes to external IPs
Step 5: Detect Process Injection and Malware

Use malfind to identify injected code and memory-resident malware:

bash
# Detect injected code in processes
vol -f memory.raw windows.malfind

# Output shows:
# PID  Process       Start      End        Tag  Protection  Hexdump/Disassembly
# 3847 explorer.exe  0x2a10000  0x2a14000  VadS PAGE_EXECUTE_READWRITE
# MZ header detected - injected PE

# Dump suspicious process memory
vol -f memory.raw windows.memmap --pid 3847 --dump

# List DLLs loaded by a suspicious process
vol -f memory.raw windows.dlllist --pid 3847

# Scan memory with YARA rules
vol -f memory.raw windows.yarascan --yara-file malware_rules.yar
Step 6: Extract Credentials and Artifacts

Recover sensitive data from memory:

bash
# Dump registry hives from memory (for password hash extraction)
vol -f memory.raw windows.registry.hivelist
vol -f memory.raw windows.hashdump

# Extract command line history
vol -f memory.raw windows.cmdline

# List handles (files, registry keys, mutexes)
vol -f memory.raw windows.handles --pid 3847

# Extract clipboard contents
vol -f memory.raw windows.clipboard

# Dump cached files from memory
vol -f memory.raw windows.dumpfiles --pid 3847
Step 7: Generate Forensic Report

Compile findings into a structured analysis report documenting all evidence extracted from memory:

  • Process anomalies with PIDs, parent processes, and timestamps
  • Network connections with associated process context
  • Injected code regions with memory protection flags
  • Extracted IOCs (hashes, IPs, domains, mutexes, registry keys)
  • YARA rule matches with rule names and match offsets
  • Credential exposure (hashes found, accounts at risk)
Show full SKILL.md (372 more words)Show less

Key Concepts

TermDefinition
Volatile EvidenceData that exists only in RAM and is lost when a system is powered off; includes running processes, network connections, encryption keys
Process InjectionTechnique where malware inserts code into a legitimate process's memory space to evade detection (malfind detects this)
EPROCESSWindows kernel data structure representing a process; psscan searches for these structures even when unlinked from the active process list
VAD (Virtual Address Descriptor)Windows kernel structure tracking memory regions allocated to a process; malfind examines VADs for executable but non-file-backed regions
Symbol TablesOS-specific data structures that Volatility 3 uses to parse memory; downloaded automatically based on detected OS version
PAGE_EXECUTE_READWRITEMemory protection flag indicating a region is readable, writable, and executable; common indicator of injected malicious code
Memory-Resident MalwareMalware that operates entirely in RAM without writing persistent files to disk, making it invisible to traditional disk-based antivirus

Tools & Systems

  • Volatility 3: Primary open-source memory forensics framework; Python 3 rewrite with automatic symbol resolution
  • WinPmem / DumpIt / Magnet RAM Capture: Memory acquisition tools for Windows systems
  • AVML (Acquire Volatile Memory for Linux): Microsoft's open-source Linux memory acquisition tool
  • YARA: Pattern matching engine for scanning memory dumps against malware signatures and behavioral rules
  • MemProcFS: Memory analysis tool that presents memory as a virtual file system for intuitive browsing

Common Scenarios

Scenario: Detecting Cobalt Strike Beacon in Memory

Context: EDR detects suspicious named pipe activity but cannot identify the source. A memory dump is acquired from the suspect endpoint for analysis.

Approach:

  1. Run windows.pstree to identify the process hierarchy and spot abnormal parent-child relationships
  2. Run windows.malfind to detect injected code regions, particularly in svchost.exe or rundll32.exe
  3. Dump the injected memory region and scan with YARA rules for Cobalt Strike beacon signatures
  4. Run windows.netscan to identify C2 connections and correlate with the injected process PID
  5. Extract the beacon configuration (C2 URLs, sleep time, jitter, watermark) using CobaltStrikeParser
  6. Run windows.cmdline to identify any post-exploitation commands executed

Pitfalls:

  • Analyzing only the process list without running malfind (missing injected code in legitimate processes)
  • Not capturing memory before isolating the endpoint (EDR containment may trigger malware self-deletion)
  • Using Volatility 2 profiles instead of Volatility 3 automatic symbol resolution on newer Windows versions

Output Format

MEMORY FORENSICS ANALYSIS REPORT
==================================
Incident:         INC-2025-1547
Evidence File:    WKSTN-042_20251115_1445.raw
SHA-256:          a4b3c2d1e5f6...
OS Identified:    Windows 10 22H2 (Build 19045)
Analysis Tool:    Volatility 3.2.0

PROCESS ANOMALIES
PID    Process         Parent       Anomaly
3847   update.exe      powershell   Suspicious executable in Temp directory
5102   svchost.exe     explorer     Wrong parent (expected services.exe)
---    [hidden]        ---          Found in psscan but not pslist

INJECTED CODE
PID    Process        Address Range        Protection              Finding
5102   svchost.exe    0x00A10000-0x00A14   PAGE_EXECUTE_READWRITE  MZ header (PE injection)

NETWORK CONNECTIONS
PID    Process      Local              Foreign             State
3847   update.exe   10.1.5.42:49721    185.220.101.42:443  ESTABLISHED
5102   svchost.exe  10.1.5.42:51003    91.215.85.17:8443   ESTABLISHED

YARA MATCHES
Rule: CobaltStrike_Beacon_x64
Match PID: 5102 (svchost.exe)
Offset: 0x00A10240

EXTRACTED IOCS
Hashes:     [SHA-256 of dumped injected code]
C2 IPs:     185.220.101.42, 91.215.85.17
C2 Domains: [extracted from beacon config]
Mutexes:    Global\MSCTF.Shared.MUTEX.ZRQ

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in skills/conducting-memory-forensics-with-volatility of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Conducting Memory Forensics With Volatility next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Conducting Memory Forensics With Volatility compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Conducting Memory Forensics With Volatility this skillmukul975/Anthropic-Cybersecurity-Skills34k—~2.6kAutomated safety check: PassApache-2.0
Forensics OsqueryAgentSecOps/SecOpsAgentKit2201 repos~4.9kAutomated safety check: NotesCustom licence
Linux Platform Securitygmh5225/awesome-game-security3.6k—~220Automated safety check: PassMIT
Memory Forensics Volatilityyaklang/hack-skills2.4k—~2.5kAutomated safety check: PassMIT
Log Evasionwgpsec/AboutSecurity1.8k—~1.2kAutomated safety check: PassNone
Re Disk Forensicsdslsdzc/rev-skills130—~1.9kAutomated safety check: PassApache-2.0

Similar skills

  • Forensics Osquery

    AgentSecOps/SecOpsAgentKit

    SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.

    220 GitHub starsUsed in 1 repo~4.9k tokens
    SecurityAuto-check: notes

  • Linux Platform Security

    gmh5225/awesome-game-security

    Analyze Linux, SteamOS, Steam Deck, Wine, or Proton game-security boundaries.

    3.6k GitHub stars~220 tokensUpdated today
    SecurityAuto-check passed

  • Memory Forensics Volatility

    yaklang/hack-skills

    Memory forensics playbook using Volatility 2/3. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~2.5k tokensUpdated 26 days ago
    SecurityAuto-check passed

  • Log Evasion

    wgpsec/AboutSecurity

    日志分析与日志逃逸方法论。理解蓝队如何通过日志追踪攻击行为（SIEM/Event Log/Syslog），以及红队如何规避日志记录或精准清除痕迹。当需要设计无痕操作或分析日志监控覆盖范围时使用

    1.8k GitHub stars~1.2k tokensUpdated yesterday
    SecurityAuto-check passed

  • Re Disk Forensics

    dslsdzc/rev-skills

    磁盘/文件系统取证：删除恢复、时间线、可疑文件定位. An agent skill from dslsdzc/rev-skills.

    130 GitHub stars~1.9k tokensUpdated 4 days ago
    SecurityAuto-check passed

  • Runtime Memory Sample Acquisition

    dslsdzc/rev-skills

    Captures an analyzable sample from a live system when the target leaves no file on disk, by finding abnormal executable memory and the execution context that reached it.

    130 GitHub stars~2k tokensUpdated 4 days ago
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Conducting Memory Forensics With Volatility

What does Conducting Memory Forensics With Volatility do?

Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident…. Conducting Memory Forensics With Volatility is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response.

When should I use Conducting Memory Forensics With Volatility?

Conducting Memory Forensics With Volatility fits situations like: tasks that involve Digital forensics.

How do I install Conducting Memory Forensics With Volatility in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-memory-forensics-with-volatility -a claude-code`. Or copy the skill folder (skills/conducting-memory-forensics-with-volatility in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/conducting-memory-forensics-with-volatility in your project. Claude Code loads it when a task matches its description.

How do I install Conducting Memory Forensics With Volatility in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-memory-forensics-with-volatility -a codex`. Or copy the skill folder (skills/conducting-memory-forensics-with-volatility in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/conducting-memory-forensics-with-volatility in your project. Codex loads it when a task matches its description.

Can I use Conducting Memory Forensics With Volatility in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-memory-forensics-with-volatility -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/conducting-memory-forensics-with-volatility, .gemini/skills/conducting-memory-forensics-with-volatility, .github/skills/conducting-memory-forensics-with-volatility and .opencode/skills/conducting-memory-forensics-with-volatility in your project.

What does Conducting Memory Forensics With Volatility need to run?

Going by SKILL.md and its folder, Conducting Memory Forensics With Volatility needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Conducting Memory Forensics With Volatility access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Conducting Memory Forensics With Volatility safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Conducting Memory Forensics With Volatility use?

Conducting Memory Forensics With Volatility is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Conducting Memory Forensics With Volatility use?

About 2.6k tokens (SKILL.md is roughly 11k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 591 tokens, read only when the agent opens those files.

What are the alternatives to Conducting Memory Forensics With Volatility?

Skills that share tags, products or a category with Conducting Memory Forensics With Volatility: Forensics Osquery (AgentSecOps/SecOpsAgentKit, 220 stars), Linux Platform Security (gmh5225/awesome-game-security, 3.6k stars), Memory Forensics Volatility (yaklang/hack-skills, 2.4k stars) and Log Evasion (wgpsec/AboutSecurity, 1.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Conducting Memory Forensics With Volatility?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,993 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.