Skip to content
Get packs

Competition Forensic Timeline

Builds one ordered incident timeline by correlating logs, registry, network and disk artifacts in CTF sandbox work

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This skill teaches an AI agent how to turn many separate digital forensic traces (Windows event logs, network captures, registry entries, disk and memory evidence, mail and browser records) into a single ordered story of what an attacker did and when. It tells the agent to pick a reliable starting point, normalise timestamps and identifiers, separate confirmed event order from guesses, and present the key segment with its source references. It is an internal downstream skill: it is meant to run only after a parent skill, ctf-sandbox-orchestrator, has set up the sandbox assumptions, and it defers to other specialised skills for packet or malware work.

Great for

  • Students practising DFIR or CTF forensic challenges who need help ordering many artifacts
  • Security analysts reconstructing a timeline from a lab or sandbox incident
  • People who already use the parent ctf-sandbox-orchestrator skill and want its chronology stage

Skip it if

  • Real production incidents on live systems: the skill assumes a sandbox and its guidance is not a substitute for a qualified incident response process
  • Users who have not installed or set up ctf-sandbox-orchestrator: the skill tells the agent to route back to that parent first, so it may not work standalone
  • Packet reassembly or malware config extraction: the skill explicitly sends these to other, more specialised skills

Try asking

  • “Build a forensic timeline from these EVTX and Sysmon exports and tell me the order of the attacker's actions”
  • “Correlate this PCAP, registry hive and mailbox export and find the stage where the decisive artifact appears”
  • “Explain the persistence chain in this sandbox image with timestamps and source file paths”
Step-by-step guide: how to use Competition Forensic TimelineInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-forensic-timeline.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-forensic-timeline.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-forensic-timeline.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Provide the artifacts together with the clock source and timezone, since the skill requires timestamps to be normalised before correlation
  • Ask for the decisive segment only if you want a compact result; the skill asks the agent to label inferred gaps separately
  • Expect replies in Simplified Chinese by default; request English explicitly if needed

What's inside

  • agents/openai.yaml
  • references/forensic-timeline.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.