Skip to content
Get packs

Guide · Agent skill

How to use the Windows LNK Forensic Analyzer agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install the Windows LNK Forensic Analyzer agent skill, ask your AI agent to use it, and check the results. The skill is for digital forensics and incident response work on Windows shortcut files, which Windows creates when a user opens a document or program. After reading, you will know what the skill covers, what you need installed, and how to get a CSV of shortcut artifacts ready for a timeline.

Windows LNK Forensic Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.
  2. 2Install Python 3 and LnkParse3. Make sure Python 3 is installed, then run pip install LnkParse3.
  3. 3Collect LNK files. Copy the .lnk files from the Recent, Desktop or Startup folders of a forensic image or collected system into a working folder.
  4. 4Ask the agent for an analysis. Describe the investigation in plain language, such as tracing files opened from removable media, and point the agent at your folder.
  5. 5Review the CSV output. Open the CSV written by scripts/agent.py and check the target paths, timestamps, volume serial numbers and machine IDs.
  6. 6Validate key findings. Confirm important results with a second tool such as LECmd or JLECmd before using them in a report.

What the skill makes the agent do

The skill teaches an AI agent how to read Windows shortcut files (.lnk). Windows creates these automatically when a user opens a document or program, and they also appear in the Recent and Desktop folders.

From these files the agent can pull out the path of the file that was opened, timestamps, details about the USB drive or network share it lived on, and the name of the computer it was on. It then organizes these into a timeline for a forensic investigation.

  • Target path of the opened file
  • MAC timestamps (modified, accessed and created times)
  • Volume serial number and drive type, including removable and network paths
  • Machine identifier (NetBIOS name) from tracker data
  • A CSV output produced by the bundled script scripts/agent.py

How do you install the skill?

Download the ZIP of the skill from this page. Unzip it into your user skills folder ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only to that project.

If you use the Claude apps instead, you can upload the skill there under Settings → Capabilities → Skills.

The skill folder contains SKILL.md (the instructions the agent reads), scripts/agent.py, and references/api-reference.md (LnkParse3 usage notes).

  • Personal install: ~/.claude/skills/
  • Project install: .claude/skills/ inside your project
  • Claude apps: Settings → Capabilities → Skills, then upload

What do you need before you start?

You need Python 3 and the LnkParse3 Python library. The source lists the library install as pip install LnkParse3.

The skill also needs LNK files from a forensic image or a collected system. Eric Zimmerman's LECmd or JLECmd for Windows are optional. The SKILL.md also names python-lnk and LnkParser as alternatives for analysis.

  • Python 3
  • LnkParse3 (pip install LnkParse3)
  • LNK files from a forensic image or collected system
  • Optional: LECmd or JLECmd from Eric Zimmerman's tools for Windows
pip install LnkParse3

How do you trigger the skill with a natural request?

You do not need a special command. Describe the investigation in plain language and mention the artifact type. The skill's description says it applies when you are investigating recently accessed files, tracking removable media or network paths referenced by shortcuts, or building a DFIR timeline from LNK artifacts.

Give the agent the folder that holds your LNK files and say where you want the output saved. Name the drive or share you care about if you have one.

  • Which LNK files in this folder point to files on removable media, and when were they last modified?
  • Parse the .lnk files in this recent folder and write the results to a CSV.
  • Build a timeline of files opened from network shares, using the LNK files in this case folder.
  • Did this user open any documents from a USB drive? Show me the target paths and volume serial numbers.

What does a typical analysis look like?

The bundled script scripts/agent.py parses a folder of LNK files and writes the results to a CSV file. Ask the agent to run it on your collected folder and review the output rows against your timeline.

The source workflow also covers collecting LNK files from a mounted image, hashing them with SHA-256 before analysis, and reviewing results for removable media and network paths. If a file fails to parse, the workflow prints the error for that file and continues with the rest.

  • Collect LNK files (Recent, Desktop, Startup) from the image
  • Hash the collected files
  • Run scripts/agent.py on the folder to create the CSV
  • Filter rows by drive type or volume serial, then add them to your timeline

What are the safety notes for scripts and network use?

This skill runs scripts, so read the bundled scripts/agent.py before you run it on sensitive evidence. The skill does not use the network, according to the source.

Only examine data you are authorized to examine. LNK files reveal user activity and may contain personal information. Do not use the skill on live production systems.

  • Runs scripts: yes (scripts/agent.py)
  • Uses network: no
  • Use only on authorized data, not live production systems
  • Treat the output as personal data and store it accordingly

What are the limits for court or formal evidence?

The skill relies on third-party parsers, and its documentation does not describe chain-of-custody steps or verification of its own output. Its output should not be treated as court-admissible evidence without independent validation.

Cross-check key findings with a second tool, such as LECmd or JLECmd, before you rely on them in a report.

  • Validate results against a second parser before relying on them
  • Document your own chain of custody; the skill does not cover it

What people use it for

  • Showing whether a user opened documents stored on a USB drive, using drive type and volume serial numbers.
  • Tracing files opened from network shares to support an incident timeline.
  • Listing recently accessed files from the Recent folder in a disk image to reconstruct user activity.
  • Teaching students how Windows artifacts record user activity, using a folder of sample LNK files.

Frequently asked questions

What is the Windows LNK Forensic Analyzer agent skill?

It is an agent skill, a folder with instructions (SKILL.md), a script (scripts/agent.py) and reference notes, that teaches an AI agent to parse Windows shortcut (.lnk) files. It extracts target paths, timestamps, volume and machine details for forensic timelines.

How do I install the LNK analyzer skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project. In the Claude apps you can upload it under Settings → Capabilities → Skills.

What do I need to run it?

You need Python 3 and the LnkParse3 library, installed with pip install LnkParse3. You also need LNK files from a forensic image or collected system. LECmd or JLECmd are optional.

Is the skill free to use?

The skill is licensed under Apache-2.0. Read the license in the skill's files for the terms. The source does not mention pricing.

What are alternatives to this skill?

The SKILL.md names LECmd from Eric Zimmerman's tools, plus python-lnk and LnkParser, as analysis options. LECmd runs on Windows and can process a directory of LNK files to CSV.

Why did a shortcut file fail to parse?

The example workflow catches errors per file, prints the file name and error, and keeps going with the rest. Check the failing file for corruption or an incomplete copy, then cross-check it with LECmd.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you are a DFIR analyst, security team member or student working with Windows LNK files from authorized images and want an agent to help parse them into a timeline. Pick a different tool, or a validated forensic suite, if you need court-admissible output or are working on a live production system.

Download the skill