How to use the Volatile Evidence Collection from Compromised Hosts agent skill

What the skill makes the agent do

The skill follows the order of volatility, starting with the most fragile data and moving to more stable sources. The workflow covers seven steps: preparing a collection environment, capturing system memory, capturing network state, capturing running processes, capturing logged-in users and sessions, capturing system configuration state, and then hashing all evidence and documenting chain of custody.

Each item is recorded with timestamps and hashes so that a documented chain of custody is kept. The skill also includes a report template and Python scripts that automate parts of the collection.

• Memory, live network connections, running processes, logged-in sessions and system configuration are collected first.
• Evidence is written to a dedicated output directory with a SHA256 manifest.
• A chain of custody record is generated with case ID, collector, system and transfer fields to complete.

Install the skill

Download the ZIP file from this page. Unzip it into ~/.claude/skills/ to make it available for your user account, or into a project's .claude/skills/ folder to limit it to that project.

You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ inside the project folder
• Claude apps: Settings → Capabilities → Skills, then upload

What you need before you run it

The skill does not bring its forensic tools with it. You must prepare them in advance on a trusted USB toolkit or network share, and you must have authorization to collect evidence. The skill's own prerequisites list the external tools it expects.

Python 3 is needed for the scripts scripts/agent.py and scripts/process.py. The process.py script needs the psutil package, installed with pip.

• Python 3 (for scripts/agent.py and scripts/process.py)
• psutil Python package: pip install psutil (needed by process.py)
• Memory tools: WinPmem or osxpmem on Windows/macOS; LiME or avml on Linux
• Sysinternals tools handle and listdlls on Windows
• A trusted forensic USB toolkit and evidence storage
• Written authorization to collect (legal or HR approval for insider cases)

Trigger the skill with natural requests

You do not need to type the skill name. Describe the situation and the goal in plain language. The skill's description says it is meant for use before isolating, shutting down or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.

State the host, the reason you suspect compromise and whether you are collecting for legal, HR or root cause purposes. Mention that the machine has not been shut down yet.

• "We suspect fileless malware on the finance workstation. Guide me through collecting volatile evidence before we isolate it."
• "Before we reimage this server, collect memory, connections and running processes with chain of custody, the evidence may go to legal."
• "Help me run live forensic collection on this Linux host and build the SHA256 manifest."

Examples of what you can ask for

The skill fits cases where time matters. Ask for the collection plan first, then have the agent work through each category and record status in the report template.

• Capture ARP cache, routing table and DNS cache from a host showing unusual outbound traffic.
• Gather loaded modules and open file handles from a process you suspect is injected.
• Build a chain of custody record and evidence manifest for an insider-threat case.

Safety notes: scripts and network

The skill runs scripts, so review them before use and run them only from a trusted toolkit. Memory capture and process inspection expose private data and may breach policy or law if run without authorization. The skill's own guidance says not to install tools on the compromised system.

According to the skill's metadata, it does not use the network.

• Runs scripts: yes. Read scripts/agent.py and scripts/process.py before running.
• Uses network: no.
• Do not run it on a production machine without authorization.
• The skill says not to install tools on the compromised system; mount the trusted toolkit instead.

Tips for a clean collection

Verify the toolkit before use. The SKILL.md workflow hashes the tools and compares them against a known-good list. Note that the chain of custody template has fields marked TO BE COMPLETED for transfer and storage, so fill those in during the case.

Commands in the workflow are examples for each platform. Use only those that match the host's operating system and the tools you have approved.

• Create the evidence directory with a UTC timestamp and hostname in its name.
• Hash memory dumps immediately after capture.
• Fill in the case ID and storage location; they are left as placeholders in the template.
• Keep a written log of every action taken on the host.