Agent skill

competition-forensic-timeline

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DFIR chronology, cross-artifact correlation, persistence chains, and incident timeline reconstruction. Use when the user asks to build a forensic timeline, correlate EVTX, PCAP, registry, disk, memory, mailbox, or browser artifacts, explain the order of attacker actions, or pinpoint the stage where the decisive artifact appears. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

★ 33,705 stars MIT zhaoxuya520/reverse-skill

Install this skill

This command installs the skill into the portable ~/.agents/skills directory. The homepage installer can generate the native path for your specific agent.

mkdir -p $HOME/.agents/skills/'competition-forensic-timeline' && curl -fsSL 'https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/HEAD/CTF-Sandbox-Orchestrator/competition-forensic-timeline/SKILL.md' -o $HOME/.agents/skills/'competition-forensic-timeline'/SKILL.md

View raw SKILL.md View repository

Skill details

Repository: zhaoxuya520/reverse-skill
SKILL.md path: CTF-Sandbox-Orchestrator/competition-forensic-timeline/SKILL.md
Author: zhaoxuya520
Tags: agent-skill