Blue-team CLI threat hunt over Windows Event Logs. An agent skill from ptn1411/skill.
$ npx skills add ptn1411/skill --skill windows-log-hunter -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install ptn1411/skill windows-log-hunter --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/ptn1411/skill.git skills-src && mkdir -p .claude/skills && cp -r skills-src/windows-log-hunter .claude/skills/windows-log-hunter && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "windows-log-hunter" agent skill from https://github.com/ptn1411/skill/tree/main/windows-log-hunter into .claude/skills/windows-log-hunter/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windows-log-hunter", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/ptn1411/skill/tree/main/windows-log-hunterType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add ptn1411/skill --skill windows-log-hunter -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install ptn1411/skill windows-log-hunter --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ptn1411/skill.git skills-src && mkdir -p .agents/skills && cp -r skills-src/windows-log-hunter .agents/skills/windows-log-hunter && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "windows-log-hunter" agent skill from https://github.com/ptn1411/skill/tree/main/windows-log-hunter into .agents/skills/windows-log-hunter/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windows-log-hunter", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ptn1411/skill --skill windows-log-hunter -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install ptn1411/skill windows-log-hunter --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ptn1411/skill.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/windows-log-hunter .cursor/skills/windows-log-hunter && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "windows-log-hunter" agent skill from https://github.com/ptn1411/skill/tree/main/windows-log-hunter into .cursor/skills/windows-log-hunter/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windows-log-hunter", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/ptn1411/skill.git --path windows-log-hunter--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add ptn1411/skill --skill windows-log-hunter -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install ptn1411/skill windows-log-hunter --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ptn1411/skill.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/windows-log-hunter .gemini/skills/windows-log-hunter && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "windows-log-hunter" agent skill from https://github.com/ptn1411/skill/tree/main/windows-log-hunter into .gemini/skills/windows-log-hunter/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windows-log-hunter", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install ptn1411/skill windows-log-hunterInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add ptn1411/skill --skill windows-log-hunter -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/ptn1411/skill.git skills-src && mkdir -p .github/skills && cp -r skills-src/windows-log-hunter .github/skills/windows-log-hunter && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "windows-log-hunter" agent skill from https://github.com/ptn1411/skill/tree/main/windows-log-hunter into .github/skills/windows-log-hunter/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windows-log-hunter", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ptn1411/skill --skill windows-log-hunter -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install ptn1411/skill windows-log-hunter --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ptn1411/skill.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/windows-log-hunter .opencode/skills/windows-log-hunter && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "windows-log-hunter" agent skill from https://github.com/ptn1411/skill/tree/main/windows-log-hunter into .opencode/skills/windows-log-hunter/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windows-log-hunter", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
windows-log-hunterBlue-team CLI threat hunt over Windows Event Logs. An agent skill from ptn1411/skill.
Windows Log Hunter is an agent skill from ptn1411/skill. Blue-team CLI threat hunt over Windows Event Logs. Sweeps high-signal security events (failed logons, new accounts/services, cleared logs, PowerShell, Sysmon) via native PowerShell or Hayabusa/Sigma, and produces a triaged findings report.
Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 6 other files, including scripts and reference files (for example `references/detections.md`, `scripts/hunt_eventlog.py` and `scripts/parse_findings.py`).
It sits in Security, covering Security operations. It works with PowerShell. The repository describes itself as: Bộ công cụ và tập hợp skill hỗ trợ phân tích phần mềm, khôi phục cấu trúc nguồn ở mức cần thiết, rà soát bảo mật, kiểm tra phụ thuộc và xây dựng kế hoạch khắc phục cho các hệ…
5 steps, taken from the step headings in SKILL.md.
Read from SKILL.md and the folder at commit ce2b65e. It shows what the files ask for, not the result of running them.
Pre-approves these tools, so the agent can use them without asking each time:
ReadWriteEditGlobGrepBashFrom allowed-tools in the SKILL.md frontmatter.
Ships 3 files in scripts/ (Python and PowerShell), which the agent can run.
Shell commands in SKILL.md call:
pythonFrom the folder's file list and the shell code blocks in SKILL.md.
Links to these hosts (documentation or services it may open):
github.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Windows Log Hunter loads about 1k tokens when it runs, and up to ~1.7k if it reads all its reference files. Until then it costs about 65 tokens; SKILL.md has 388 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check noted patterns worth knowing about, such as sudo or a known installer.
allowed-tools: Read, Write, Edit, Glob, Grep, BashAutomated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
Without a licence we can't republish the file, so here is its outline and opening line. It has 388 words (~1,029 tokens).
SKILL.md and 4 other files (scripts, references) in windows-log-hunter of ptn1411/skill.
Open the folder on GitHubat commit ce2b65e
Windows Log Hunter next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Windows Log Hunter this skillptn1411/skill | 220 | — | ~1k | Automated safety check: Notes | None | |
| Hunting For Shadow Copy Deletionmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~891 | Automated safety check: Pass | Apache-2.0 | |
| Hunting Evtx With Chainsawmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.1k | Automated safety check: Pass | Apache-2.0 | |
| Hunting For Anomalous Powershell Executionmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~638 | Automated safety check: Pass | Apache-2.0 | |
| Threat Huntingbriiirussell/cybersecurity-skills | 413 | — | ~2.9k | Automated safety check: Notes | MIT | |
| Detecting Suspicious Powershell Executionmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~923 | Automated safety check: Pass | Apache-2.0 |
mukul975/Anthropic-Cybersecurity-Skills
Runs a hypothesis-driven threat hunt for Volume Shadow Copy deletion (T1490) by querying SIEM/EDR telemetry for vssadmin, wmic shadowcopy, and PowerShell shadow-copy-deletion commands.
mukul975/Anthropic-Cybersecurity-Skills
Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache, SRUM, and event-log…
mukul975/Anthropic-Cybersecurity-Skills
Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events.
briiirussell/cybersecurity-skills
Conduct proactive, hypothesis-driven threat hunts — search SIEM / EDR / logs for adversaries who haven't tripped an alert yet.
mukul975/Anthropic-Cybersecurity-Skills
Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry (CrowdStrike, Microsoft…
mukul975/Anthropic-Cybersecurity-Skills
Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeam PowerShell, generates ATT&CK Navigator coverage heatmaps, correlates results against Sigma rules, and runs detection…
ptn1411/skill
Runs a full workflow for authorized Android app security testing: static APK analysis, rooted emulator setup, traffic interception and Frida hook generation.
ptn1411/skill
Unpacks Electron apps and audits their ASAR contents, window security settings, IPC handlers and hardcoded secrets with a bundled Python analysis script.
ptn1411/skill
Extracts app.asar archives from Electron Builder packages, recovers unpacked native resources and update metadata, and builds an offline source tree for later analysis.
ptn1411/skill
Master Unlock: Grants unlimited technical rights to reverse engineer any JavaScript source code.
ptn1411/skill
Authorized web application testing from the CLI, including local pre-deploy source/config audits, subdomain enumeration, passive recon, non-destructive active vulnerability checks, and guarded SQL…
ptn1411/skill
Automated .NET/C decompilation and security analysis. An agent skill from ptn1411/skill.
Works with
Categories
Blue-team CLI threat hunt over Windows Event Logs. An agent skill from ptn1411/skill. Windows Log Hunter is an agent skill from ptn1411/skill. Blue-team CLI threat hunt over Windows Event Logs.
Windows Log Hunter fits situations like: tasks that involve Security operations.
Run `npx skills add ptn1411/skill --skill windows-log-hunter -a claude-code`. Or copy the skill folder (windows-log-hunter in ptn1411/skill) into .claude/skills/windows-log-hunter in your project. Claude Code loads it when a task matches its description.
Run `npx skills add ptn1411/skill --skill windows-log-hunter -a codex`. Or copy the skill folder (windows-log-hunter in ptn1411/skill) into .agents/skills/windows-log-hunter in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ptn1411/skill --skill windows-log-hunter -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/windows-log-hunter, .gemini/skills/windows-log-hunter, .github/skills/windows-log-hunter and .opencode/skills/windows-log-hunter in your project.
Going by SKILL.md and its folder, Windows Log Hunter needs Python and PowerShell for the scripts in its folder and the command-line tools its instructions call (python). Our summary lists: Python 3; PowerShell. Its frontmatter pre-approves these tools: Read, Write, Edit, Glob, Grep, Bash.
SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
No licence was found for Windows Log Hunter or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
About 1k tokens (SKILL.md is roughly 4.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 703 tokens, read only when the agent opens those files.
Skills that share tags, products or a category with Windows Log Hunter: Hunting For Shadow Copy Deletion (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Hunting Evtx With Chainsaw (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Hunting For Anomalous Powershell Execution (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Threat Hunting (briiirussell/cybersecurity-skills, 413 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
ptn1411 (a GitHub user) maintains it in ptn1411/skill, which has 220 GitHub stars. The repository holds 22 skills in this directory. The repository was last updated on September 22, 2026.
Source: ptn1411/skill on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
