Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-volatile-evidence-from-compromised-hostnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-volatile-evidence-from-compromised-host -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-volatile-evidence-from-compromised-host -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/collecting-volatile-evidence-from-compromised-hostgh skill install mukul975/Anthropic-Cybersecurity-Skills collecting-volatile-evidence-from-compromised-hostgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/collecting-volatile-evidence-from-compromised-host ~/.claude/skills/collecting-volatile-evidence-from-compromised-host # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/collecting-volatile-evidence-from-compromised-host ~/.agents/skills/collecting-volatile-evidence-from-compromised-host # Codex, Cursor, Gemini CLI, Copilot, OpenCode