New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Performing Memory Forensics With Volatility3

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process…

Apache-2.0Auto-check: notesSecurity

Install Performing Memory Forensics With Volatility3

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-memory-forensics-with-volatility3 -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills performing-memory-forensics-with-volatility3 --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/performing-memory-forensics-with-volatility3 .claude/skills/performing-memory-forensics-with-volatility3 && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
performing-memory-forensics-with-volatility3
GitHub stars
34k
Token cost
~3k tokens
SKILL.md length
489 words
Files
5 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process…

  • Works in 7 steps: Acquire Memory Dump and Install… → Identify the Operating System Profile → Enumerate Processes and Detect Anomalies → …
  • Tasks that involve Digital forensics
  • SKILL.md covers When to Use, Prerequisites, Workflow and Key Concepts, plus 3 more sections
  • Runs Python scripts from its folder; calls pip, wget and git; reaches downloads.volatilityfoundation.org and github.com

What it does

Performing Memory Forensics With Volatility3 is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process hollowing, DLL injection, or hidden processes/rootkits. Use during incident response on a compromised or suspect system when disk-based forensics alone is insufficient and volatile evidence of malware or intrusion must be recovered from memory.

Its SKILL.md is about 3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 6 other files, including scripts and reference files (for example `SKILL.es.md`, `references/api-reference.md` and `scripts/agent.py`).

It sits in Security, covering Digital forensics and Incident response. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Digital forensics
  • Tasks that involve Incident response

Example prompts

  • “/performing-memory-forensics-with-volatility3”

Requirements

  • Python 3

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. Acquire Memory Dump and Install Volatility 3
  2. Identify the Operating System Profile
  3. Enumerate Processes and Detect Anomalies
  4. Analyze Network Connections and Registry
  5. Extract Credentials and Sensitive Data
  6. Scan for Malware with YARA Rules
  7. Compile Findings into a Report

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • pip
    • wget
    • git

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • downloads.volatilityfoundation.org
    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Performing Memory Forensics With Volatility3 loads about 3k tokens when it runs, and up to ~3.5k if it reads all its reference files. Until then it costs about 120 tokens; SKILL.md has 489 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~120
When it runs · the whole SKILL.md, loaded when a task matches
~3k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteRuns commands with sudoSKILL.md:75
    sudo insmod lime-$(uname -r).ko "path=/cases/memory/linux_mem.lime format=lime"

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 489 words, ~3,003 tokens.

Download SKILL.mdSave it as .claude/skills/performing-memory-forensics-with-volatility3/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.
name
performing-memory-forensics-with-volatility3
description
Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process hollowing, DLL injection, or hidden processes/rootkits. Use during incident response on a compromised or suspect system when disk-based forensics alone is insufficient and volatile evidence of malware or intrusion must be recovered from memory.
domain
cybersecurity
subdomain
digital-forensics
tags
forensics, memory-forensics, volatility, ram-analysis, malware-detection, incident-response
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
RS.AN-03, DE.AE-02, RS.MA-01
mitre_attack
T1005, T1074, T1119, T1070, T1059

Performing Memory Forensics with Volatility 3

When to Use

  • When analyzing a RAM dump from a compromised or suspect system
  • During incident response to identify running malware, injected code, or rootkits
  • When you need to extract credentials, encryption keys, or network connections from memory
  • For detecting process hollowing, DLL injection, or hidden processes
  • When disk-based forensics alone is insufficient and volatile data is critical

Prerequisites

  • Python 3.7+ installed
  • Volatility 3 framework installed (pip install volatility3)
  • Memory dump in raw, ELF, or crash dump format
  • Appropriate symbol tables (ISF files) for the target OS version
  • Sufficient disk space for analysis output (2-3x memory dump size)
  • Optional: YARA rules for malware scanning in memory

Workflow

Step 1: Acquire Memory Dump and Install Volatility 3
bash
# Install Volatility 3
pip install volatility3

# Or install from source for latest features
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
pip install -e .

# Download Windows symbol tables (ISF packs)
# Place in volatility3/symbols/ directory
wget https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip
unzip windows.zip -d /opt/volatility3/volatility3/symbols/

# Download Linux and Mac symbol packs
wget https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
wget https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip

# Memory acquisition tools (for live systems):
# Windows: winpmem, DumpIt, FTK Imager
# Linux: LiME (Linux Memory Extractor)
sudo insmod lime-$(uname -r).ko "path=/cases/memory/linux_mem.lime format=lime"

# Verify the memory dump
file /cases/case-2024-001/memory/memory.raw
ls -lh /cases/case-2024-001/memory/memory.raw
Step 2: Identify the Operating System Profile
bash
# Run banners plugin to identify the OS
vol -f /cases/case-2024-001/memory/memory.raw banners

# For Windows, identify the OS version
vol -f /cases/case-2024-001/memory/memory.raw windows.info

# Output example:
# Variable        Value
# Kernel Base     0xf8047e200000
# DTB             0x1ad000
# Symbols         ntkrnlmp.pdb/GUID
# Is64Bit         True
# IsPAE           False
# primary layer   Intel32e
# KdVersionBlock  0xf8047ee232c0
# Major/Minor     15.19041
# Machine Type    34404
# KeNumberProcessors 4
# SystemTime      2024-01-18 14:32:15 UTC
# NtBuildLab      19041.1.amd64fre.vb_release.191206-1406
# NtProductType   NtProductWinNt
# NtSystemRoot    C:\WINDOWS
# PE MajorOperatingSystemVersion 10
# PE MinorOperatingSystemVersion 0

# For Linux memory dumps
vol -f /cases/case-2024-001/memory/linux_mem.lime linux.info
Step 3: Enumerate Processes and Detect Anomalies
bash
# List all running processes
vol -f /cases/case-2024-001/memory/memory.raw windows.pslist | tee /cases/case-2024-001/analysis/pslist.txt

# Show process tree (parent-child relationships)
vol -f /cases/case-2024-001/memory/memory.raw windows.pstree | tee /cases/case-2024-001/analysis/pstree.txt

# Detect hidden processes using cross-view analysis
vol -f /cases/case-2024-001/memory/memory.raw windows.psscan | tee /cases/case-2024-001/analysis/psscan.txt

# Compare pslist vs psscan to find hidden processes
diff <(vol -f memory.raw windows.pslist | awk '{print $1}' | sort) \
     <(vol -f memory.raw windows.psscan | awk '{print $1}' | sort)

# List DLLs loaded by a suspicious process (PID 4532)
vol -f /cases/case-2024-001/memory/memory.raw windows.dlllist --pid 4532

# Check for process hollowing and injection
vol -f /cases/case-2024-001/memory/memory.raw windows.malfind | tee /cases/case-2024-001/analysis/malfind.txt

# Dump suspicious process memory for further analysis
vol -f /cases/case-2024-001/memory/memory.raw windows.memmap --pid 4532 --dump \
   -o /cases/case-2024-001/analysis/dumps/
Step 4: Analyze Network Connections and Registry
bash
# List active network connections
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | tee /cases/case-2024-001/analysis/netscan.txt

# Filter for established connections
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | grep ESTABLISHED

# Filter for listening ports
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | grep LISTENING

# Extract network connections with process mapping
vol -f /cases/case-2024-001/memory/memory.raw windows.netstat | tee /cases/case-2024-001/analysis/netstat.txt

# Dump registry hives from memory
vol -f /cases/case-2024-001/memory/memory.raw windows.registry.hivelist

# Extract specific registry keys
vol -f /cases/case-2024-001/memory/memory.raw windows.registry.printkey \
   --key "Software\Microsoft\Windows\CurrentVersion\Run"

# Check services
vol -f /cases/case-2024-001/memory/memory.raw windows.svcscan | tee /cases/case-2024-001/analysis/services.txt
Step 5: Extract Credentials and Sensitive Data
bash
# Dump cached credentials (hashdump)
vol -f /cases/case-2024-001/memory/memory.raw windows.hashdump | tee /cases/case-2024-001/analysis/hashes.txt

# Extract LSA secrets
vol -f /cases/case-2024-001/memory/memory.raw windows.lsadump

# Dump cached domain credentials
vol -f /cases/case-2024-001/memory/memory.raw windows.cachedump

# Search for plaintext strings in process memory
vol -f /cases/case-2024-001/memory/memory.raw windows.strings --pid 4532 \
   | grep -iE '(password|credential|token|api.key)'

# Extract command history from cmd.exe/powershell
vol -f /cases/case-2024-001/memory/memory.raw windows.cmdline | tee /cases/case-2024-001/analysis/cmdline.txt

# Extract environment variables
vol -f /cases/case-2024-001/memory/memory.raw windows.envars --pid 4532
Step 6: Scan for Malware with YARA Rules
bash
# Scan memory with YARA rules
vol -f /cases/case-2024-001/memory/memory.raw yarascan \
   --yara-file /opt/yara-rules/malware_index.yar | tee /cases/case-2024-001/analysis/yara_hits.txt

# Scan specific process memory
vol -f /cases/case-2024-001/memory/memory.raw yarascan \
   --yara-file /opt/yara-rules/apt_rules.yar --pid 4532

# Check loaded kernel modules for rootkits
vol -f /cases/case-2024-001/memory/memory.raw windows.modules | tee /cases/case-2024-001/analysis/modules.txt

# Detect unlinked/hidden modules
vol -f /cases/case-2024-001/memory/memory.raw windows.modscan | tee /cases/case-2024-001/analysis/modscan.txt

# Check for SSDT hooks (System Service Descriptor Table)
vol -f /cases/case-2024-001/memory/memory.raw windows.ssdt | grep -v "ntoskrnl\|win32k"

# Dump a suspicious executable from memory
vol -f /cases/case-2024-001/memory/memory.raw windows.dumpfiles --pid 4532 \
   -o /cases/case-2024-001/analysis/extracted/
Step 7: Compile Findings into a Report
bash
# Generate comprehensive analysis summary
echo "=== MEMORY FORENSICS REPORT ===" > /cases/case-2024-001/analysis/memory_report.txt
echo "Image: memory.raw" >> /cases/case-2024-001/analysis/memory_report.txt
echo "OS: Windows 10 Build 19041" >> /cases/case-2024-001/analysis/memory_report.txt
echo "" >> /cases/case-2024-001/analysis/memory_report.txt

echo "--- Suspicious Processes ---" >> /cases/case-2024-001/analysis/memory_report.txt
cat /cases/case-2024-001/analysis/malfind.txt >> /cases/case-2024-001/analysis/memory_report.txt

echo "--- Network Connections ---" >> /cases/case-2024-001/analysis/memory_report.txt
cat /cases/case-2024-001/analysis/netscan.txt >> /cases/case-2024-001/analysis/memory_report.txt

echo "--- YARA Matches ---" >> /cases/case-2024-001/analysis/memory_report.txt
cat /cases/case-2024-001/analysis/yara_hits.txt >> /cases/case-2024-001/analysis/memory_report.txt

# Calculate hash of the memory dump for integrity
sha256sum /cases/case-2024-001/memory/memory.raw >> /cases/case-2024-001/analysis/memory_report.txt

Key Concepts

ConceptDescription
Volatile dataInformation that exists only in RAM and is lost when power is removed
Process hollowingTechnique where malware replaces legitimate process memory with malicious code
DLL injectionLoading unauthorized DLLs into a running process address space
EPROCESSWindows kernel structure representing a process; basis for process listing
Pool scanningSearching memory for kernel object signatures to find hidden artifacts
VAD (Virtual Address Descriptor)Memory management structure tracking process virtual memory regions
ISF (Intermediate Symbol Format)Volatility 3 symbol table format for OS-specific structure definitions
MalfindPlugin detecting injected code by examining VAD permissions and content
Show full SKILL.md (223 more words)Show less

Tools & Systems

ToolPurpose
Volatility 3Primary open-source memory forensics framework
LiMELinux Memory Extractor for acquiring Linux RAM dumps
WinPmemWindows physical memory acquisition driver
DumpItComae one-click Windows memory dump utility
YARAPattern matching engine for malware signature scanning
RekallAlternative memory forensics framework (Google)
MemProcFSMemory process file system for memory analysis
stringsExtract printable strings from binary memory dumps

Common Scenarios

Scenario 1: Active Malware Investigation Acquire memory with DumpIt, run pslist/pstree to identify suspicious processes, use malfind to detect injected code in svchost.exe, dump the injected memory segment, scan with YARA rules identifying Cobalt Strike beacon, extract C2 IP from netscan, correlate with network logs.

Scenario 2: Credential Theft After Breach Run hashdump and lsadump to extract cached credentials, identify mimikatz execution in cmdline output, check for lsass.exe memory dumps in filesystem artifacts, correlate with lateral movement evidence in network connections.

Scenario 3: Rootkit Detection Compare pslist (uses EPROCESS linked list) with psscan (pool scanning) to find unlinked processes, check modules vs modscan for hidden kernel drivers, examine SSDT for hooks redirecting system calls, dump suspicious modules for static analysis.

Scenario 4: Ransomware Incident Recovery Extract encryption keys from ransomware process memory before system shutdown, identify the ransomware variant using YARA, find the initial execution point through command line artifacts, map lateral movement via network connections.

Output Format

Memory Forensics Analysis:
  Image:            memory.raw (16 GB)
  OS Identified:    Windows 10 x64 Build 19041
  Capture Time:     2024-01-18 14:32:15 UTC

  Process Analysis:
    Total Processes:    87
    Hidden Processes:   2 (PIDs: 4532, 6128)
    Injected Processes: 3 (malfind detections)
    Suspicious:         svchost.exe (PID 4532) - injected code at 0x7FFE0000

  Network Connections:
    Total:        45
    Established:  12
    Suspicious:   3 (C2 connections to 185.xx.xx.xx:443)

  Credentials Found:
    NTLM Hashes:      4 accounts
    Cached Creds:      2 domain accounts

  YARA Matches:
    CobaltStrike_Beacon:  PID 4532 (3 hits)
    Mimikatz_Memory:      PID 6128 (1 hit)

  Extracted Artifacts:   15 files dumped to /analysis/extracted/

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (scripts, references) in skills/performing-memory-forensics-with-volatility3 of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • SKILL.es.md
  • references/api-reference.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Performing Memory Forensics With Volatility3 next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Performing Memory Forensics With Volatility3 compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Performing Memory Forensics With Volatility3 this skillmukul975/Anthropic-Cybersecurity-Skills34k—~3kAutomated safety check: NotesApache-2.0
Incident Responsehypnguyen1209/offensive-claude388—~2.5kAutomated safety check: PassMIT
Forensics OsqueryAgentSecOps/SecOpsAgentKit2201 repos~4.9kAutomated safety check: NotesCustom licence
Ir VelociraptorAgentSecOps/SecOpsAgentKit2201 repos~3.1kAutomated safety check: PassCustom licence
Incident Response NetworkLeoYeAI/openclaw-master-skills2.2k—~5kAutomated safety check: PassApache-2.0
Digital Forensicssickn33/agentic-awesome-skills47k1 repos~495Automated safety check: PassMIT

Similar skills

  • Incident Response

    hypnguyen1209/offensive-claude

    A skill your agent uses when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining…

    388 GitHub stars~2.5k tokensUpdated 11 days ago
    SecurityAuto-check passed

  • Forensics Osquery

    AgentSecOps/SecOpsAgentKit

    SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.

    220 GitHub starsUsed in 1 repo~4.9k tokens
    SecurityAuto-check: notes

  • Ir Velociraptor

    AgentSecOps/SecOpsAgentKit

    Endpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale.

    220 GitHub starsUsed in 1 repo~3.1k tokens
    SecurityAuto-check passed

  • Incident Response Network

    LeoYeAI/openclaw-master-skills

    Network forensics evidence collection and analysis during security incidents.

    2.2k GitHub stars~5k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Digital Forensics

    sickn33/agentic-awesome-skills

    Authorized digital forensics: memory dumps, disk timelines, PCAP investigation, artifact triage, and incident-response evidence preservation.

    47k GitHub starsUsed in 1 repo~495 tokens
    SecurityAuto-check passed

  • Incident Response

    alirezarezvani/claude-skills

    A skill your agent uses when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection.

    28k GitHub stars~3.8k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Performing Memory Forensics With Volatility3

What does Performing Memory Forensics With Volatility3 do?

Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process…. Performing Memory Forensics With Volatility3 is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process hollowing, DLL injection, or hidden processes/rootkits.

When should I use Performing Memory Forensics With Volatility3?

Performing Memory Forensics With Volatility3 fits situations like: tasks that involve Digital forensics; tasks that involve Incident response.

How do I install Performing Memory Forensics With Volatility3 in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-memory-forensics-with-volatility3 -a claude-code`. Or copy the skill folder (skills/performing-memory-forensics-with-volatility3 in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/performing-memory-forensics-with-volatility3 in your project. Claude Code loads it when a task matches its description.

How do I install Performing Memory Forensics With Volatility3 in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-memory-forensics-with-volatility3 -a codex`. Or copy the skill folder (skills/performing-memory-forensics-with-volatility3 in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/performing-memory-forensics-with-volatility3 in your project. Codex loads it when a task matches its description.

Can I use Performing Memory Forensics With Volatility3 in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-memory-forensics-with-volatility3 -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/performing-memory-forensics-with-volatility3, .gemini/skills/performing-memory-forensics-with-volatility3, .github/skills/performing-memory-forensics-with-volatility3 and .opencode/skills/performing-memory-forensics-with-volatility3 in your project.

What does Performing Memory Forensics With Volatility3 need to run?

Going by SKILL.md and its folder, Performing Memory Forensics With Volatility3 needs Python for the scripts in its folder and the command-line tools its instructions call (pip, wget and git). Our summary lists: Python 3.

Does Performing Memory Forensics With Volatility3 access the network?

SKILL.md names 2 domains. In commands or code: downloads.volatilityfoundation.org and github.com; the agent is likely to contact these when it follows the instructions. This is read from the text; nothing was executed.

Is Performing Memory Forensics With Volatility3 safe to install?

Our automated static check of SKILL.md found notes only (runs commands with sudo), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Performing Memory Forensics With Volatility3 use?

Performing Memory Forensics With Volatility3 is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Performing Memory Forensics With Volatility3 use?

About 3k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 467 tokens, read only when the agent opens those files.

What are the alternatives to Performing Memory Forensics With Volatility3?

Skills that share tags, products or a category with Performing Memory Forensics With Volatility3: Incident Response (hypnguyen1209/offensive-claude, 388 stars), Forensics Osquery (AgentSecOps/SecOpsAgentKit, 220 stars), Ir Velociraptor (AgentSecOps/SecOpsAgentKit, 220 stars) and Incident Response Network (LeoYeAI/openclaw-master-skills, 2.2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Performing Memory Forensics With Volatility3?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,993 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.