Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file access, program execution, and user activity that persists even after the target file is deleted.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-lnk-file-and-jump-list-artifactsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-lnk-file-and-jump-list-artifacts -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-lnk-file-and-jump-list-artifacts -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/analyzing-lnk-file-and-jump-list-artifactsgh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-lnk-file-and-jump-list-artifactsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-lnk-file-and-jump-list-artifacts ~/.claude/skills/analyzing-lnk-file-and-jump-list-artifacts # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-lnk-file-and-jump-list-artifacts ~/.agents/skills/analyzing-lnk-file-and-jump-list-artifacts # Codex, Cursor, Gemini CLI, Copilot, OpenCode