Guide · Agent skill
How to use the Memory Forensics agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The memory-forensics skill is a reference playbook that gives an AI agent a structured method for investigating memory (RAM) captures from Windows, Linux and macOS machines. Once installed, the agent knows which acquisition tools to suggest and which Volatility 3 commands to run for processes, network connections, injected code and persistence. This guide covers what the skill does, how to install it, how to trigger it, what it needs, and the safety points to check before use.
Memory Forensicswshobson/agents · MIT Download the skill Quick start
- 1Download the ZIP. Download the memory-forensics ZIP from this page.
- 2Unzip the skill. Unzip the archive so the folder contains SKILL.md and references/details.md.
- 3Place the folder. Move it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder.
- 4Or upload it in the Claude apps. Go to Settings → Capabilities → Skills and upload the skill there instead.
- 5Install Volatility 3. Install Volatility 3 with pip install volatility3 so the vol command is available.
- 6Ask a natural question. Describe your memory capture and what you want to find, and the agent will apply the skill's workflows.
What is an agent skill, and what does this one do?
An agent skill is a folder containing a SKILL.md file with instructions that an AI agent can load when a request matches the skill's description. This skill is a memory forensics reference. Its description says it covers memory acquisition, process analysis and artifact extraction using Volatility and related tools.
In practice, the skill covers live memory acquisition (for example WinPmem, DumpIt, LiME and osxpmem), virtual machine memory files, Volatility 3 malware and incident response workflows, YARA rules for scanning memory, and string extraction with strings and FLOSS.
- Suggests acquisition tools for Windows, Linux and macOS
- Lists Volatility 3 commands for process, network, injection and persistence checks
- Shows how to write and run YARA rules against memory
- Covers string extraction and pattern matching
How do you install the Memory Forensics skill?
Download the ZIP for this skill from this page and unzip it. The skill folder should contain SKILL.md and references/details.md. Then place the folder in one of these locations:
For a personal install, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills (upload)
How do you trigger the skill with natural requests?
You do not need to name the skill. The agent loads it when your request matches the skill's description, which mentions memory dumps, incident investigation and malware analysis from RAM captures. Describe what you have and what you want to find.
Requests that tend to match the description include analyzing a memory dump you already have, asking how to capture RAM from a live machine before shutdown, or asking which Volatility 3 plugins to run against a suspected infection.
- "I have a memory.raw from a Windows host. Which Volatility 3 plugins should I run to find injected code?"
- "How do I acquire live memory from a Linux server with LiME?"
- "Help me check this RAM capture for hidden processes and suspicious network connections."
- "Write a YARA rule to scan this memory image for a shellcode pattern."
What does a typical analysis look like?
The skill's malware workflow starts broad and narrows down. It begins with a process survey, then network connections, then injection detection, then closer looks at suspicious PIDs, and finally YARA scanning. The incident response workflow adds a timeline, command lines, persistence keys, services and scheduled tasks.
The commands below are taken from the skill. Replace memory.raw with your capture and <PID> with a process ID from your own output.
vol -f memory.raw windows.pslist > pslist.txt
vol -f memory.raw windows.netscan > network.txt
vol -f memory.raw windows.malfind > malfind.txtWhat do you need before you start?
The skill assumes a working forensics setup. It lists Volatility 3 (the vol command), a memory acquisition tool suited to your platform, YARA for rule scanning, standard command-line utilities such as strings and grep, and Administrator or root privileges for live acquisition.
The skill's reference file gives Volatility 3 install guidance using pip install volatility3 and notes that Windows symbol tables are downloaded separately from the Volatility Foundation site. Check that reference before running the commands.
- Volatility 3 with the vol command
- Acquisition tool: WinPmem, DumpIt, LiME or osxpmem, depending on platform
- YARA
- strings and grep
- Administrator or root privileges for live acquisition
pip install volatility3What safety points should you know?
The skill does not run scripts and does not use the network, according to its listing. However, the commands it contains do things on your system. Live acquisition needs elevated privileges and loads kernel modules on Linux (LiME uses insmod). Only run acquisition on machines you own or are authorized to examine.
The skill also includes credential extraction commands such as windows.hashdump, windows.lsadump and windows.cachedump. Use these only on systems you own or have authorization to examine. Hash your memory dump right after capture and record the time and tool used, as the skill's best practices recommend.
- Use only on systems you own or are authorized to examine
- Live acquisition needs Administrator or root and may alter memory
- Credential extraction commands are included; use them only with authorization
- Hash the dump immediately and document the tool, time and chain of custody
What tips help you get better results?
Start broad with process and network views, then go deeper only where the output is suspicious. Cross-check findings with more than one plugin, because a single plugin can miss things. Correlate memory findings with disk and network evidence.
Treat the agent's output as a starting point. The skill cannot verify results on its own, so confirm important findings yourself with the Volatility output and your own judgment.
- Compare pslist with psscan to spot hidden processes
- Cross-reference findings across multiple plugins
- Correlate memory results with disk and network logs
- Verify every finding yourself before acting on it
What people use it for
- Triaging a suspected compromised Windows host by listing processes, network connections and injected code
- Checking a Linux memory capture for hidden processes by comparing pslist and psscan output
- Building a timeline and reviewing command lines and persistence keys during incident response
- Writing and running YARA rules against process memory to look for known shellcode patterns
- Extracting strings from a process dump to look for URLs or IP addresses
Frequently asked questions
Is the Memory Forensics skill free?
The skill is licensed under MIT, according to this listing. The skill's own commands rely on tools such as Volatility 3 and YARA, which you install separately.
What do I need installed to use it?
You need Volatility 3 with the vol command, a memory acquisition tool for your platform such as WinPmem, DumpIt, LiME or osxpmem, YARA, and standard utilities such as strings and grep. Live acquisition needs Administrator or root privileges.
Where do I put the skill folder?
Unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
Does the skill run scripts or use the network?
According to its listing, the skill runs no scripts and uses no network. The commands it describes still act on your system, so run them only on machines you are authorized to examine.
Can I use this skill to check my computer for viruses?
This is not designed for casual virus checks. It is an expert forensics workflow for incident responders and malware analysts, and the agent cannot verify results on its own.
How does it compare with a commercial forensics suite?
This source does not compare the skill with other products. The skill is a reference playbook for Volatility 3 and related command-line tools, so it suits people who already work with those tools. It does not cover legally admissible evidence handling, which needs a trained examiner.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are an incident responder, malware analyst or student learning the standard Volatility 3 workflow, and you already have, or can install, the tools it names. Pick something else if you only want a casual virus check or need legally admissible evidence, since the skill does not cover chain of custody or tool validation.
Download the skill