Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-endpoint-forensics-investigationnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-endpoint-forensics-investigation -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-endpoint-forensics-investigation -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/performing-endpoint-forensics-investigationgh skill install mukul975/Anthropic-Cybersecurity-Skills performing-endpoint-forensics-investigationgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-endpoint-forensics-investigation ~/.claude/skills/performing-endpoint-forensics-investigation # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-endpoint-forensics-investigation ~/.agents/skills/performing-endpoint-forensics-investigation # Codex, Cursor, Gemini CLI, Copilot, OpenCode