How to use the Competition Forensic Timeline agent skill

What is an agent skill, and what does this one make the agent do?

An agent skill is a folder containing a SKILL.md file and optional reference files. When a request matches the skill's description, the agent loads those instructions and follows them for that task.

This skill is for the hard part of forensics: not finding one artifact, but turning many artifacts into one replayable chronology. It tells the agent to pick the smallest reliable starting point, normalise timestamps, time zones, hostnames, users, process IDs and file paths, and link shared identifiers across sources. It then builds a minimal chain from foothold to persistence, execution, access or exfiltration, separates confirmed event order from inferred gaps, and reproduces the decisive segment that supports the conclusion.

• Picks an anchor such as first execution, first logon, first network session, first file write or first mailbox action.
• Records clock source, time zone, drift or truncation that could reorder events.
• Matches identifiers such as PID, logon ID, GUID, message ID, hostname, username, IP or hash.
• Keeps raw artifacts and parsed summaries side by side so every step can be traced back.
• Lists missing validation steps separately from the confirmed chronology.

Install the parent skill and this skill

This skill requires the parent skill ctf-sandbox-orchestrator to be installed and active first. The source names that parent but does not describe how to install it, so check where you obtained it before continuing.

To install this skill, download the ZIP from our page and unzip it into one of two places: your personal skills folder ~/.claude/skills/, or a project's .claude/skills/ folder if you want it limited to one project. The unzipped folder should contain SKILL.md, references/forensic-timeline.md and agents/openai.yaml.

Alternatively, upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with a natural request?

You do not need a special command. The skill's description lists the kinds of requests it matches: building a forensic timeline, correlating EVTX, PCAP, registry, disk, memory, mailbox or browser artifacts, explaining the order of attacker actions, or pinpointing the stage where the decisive artifact appears.

Start the conversation with the parent skill so its sandbox assumptions are set, then describe the artifacts you have and the question you want answered. Name the parent skill in your request if the agent does not route to it on its own.

• Build a forensic timeline from these EVTX and registry exports.
• Correlate this PCAP with the Sysmon log and tell me the order of events.
• Explain the order of attacker actions in this sandbox incident.
• Which stage of the attack does the decisive artifact first appear in?

What do you need before you start?

The skill needs the parent skill installed and active, plus access to the artifact files you provide. The source lists artifact types such as EVTX, PCAP, registry, disk, memory, mailbox and browser data, but does not name specific parsing tools, so the skill does not depend on any particular one.

Know the clock source and time zone of each artifact before you begin. The skill asks the agent to record drift, missing zones, daylight-saving ambiguity and truncation before merging sources, because these can reorder events.

• The parent skill ctf-sandbox-orchestrator, installed and already active
• The artifact files you want analysed
• Notes on time zones or clock sources, if you know them

Example workflow

Suppose you have a sandbox incident with a Windows event log export and a packet capture. You ask the agent to build a timeline. The agent first chooses an anchor, such as the first network connect or first process creation, and writes down each artifact's time source. It then matches events on shared identifiers, such as a process ID that appears in both the log and a session, rather than on timestamps alone.

The agent then reduces the result to the shortest sequence that supports the conclusion. The final answer keeps source file paths, event IDs, PIDs, hashes and timestamps with time zones, and shows the decisive segment as a compact ordered list. Gaps the agent could not confirm are listed separately.

Safety notes: scripts, network and scope

According to the source, this skill runs no scripts and uses no network access. It works on the artifact files you provide.

The skill is meant for sandbox and lab work. It assumes a sandbox, and its guidance is not a substitute for a qualified incident response process, so do not use it as the sole basis for decisions on live production systems.

For packet reassembly, protocol framing or transferred-object extraction, the skill points to the more specialised skill $competition-pcap-protocol. For malware config extraction or Windows pivot work, it says to switch to a tighter specialised skill.

• Runs scripts: no
• Uses network: no
• Not for live production incidents
• Packet reassembly is routed to $competition-pcap-protocol

Tips for better results

Give the agent complete artifact sets rather than one file at a time, since the value is in correlation across sources.

Tell the agent which question matters most, such as initial access or the decisive artifact, so it compresses the timeline to that story.

The skill asks for replies in Simplified Chinese unless you explicitly request English, so state your language preference if you want English output.

• Provide all relevant artifacts together.
• State the specific question you need answered.
• Request English explicitly if you need it.