← 返回 Skills 市场
Memory Forensics
作者
Solomon Neas
· GitHub ↗
· v1.0.1
· MIT-0
293
总下载
1
收藏
1
当前安装
2
版本数
在 OpenClaw 中安装
/install memory-forensics
功能描述
Memory forensics with Volatility and related tools. Acquire RAM dumps, extract processes and DLLs, investigate rootkits and fileless malware, recover credent...
安全使用建议
This is a coherent, domain-appropriate memory-forensics playbook, but it performs high-impact, privileged actions. Before using it: ensure you have legal/organizational authorization to acquire and analyze RAM; run commands on controlled evidence or isolates (not production systems) because dd/insmod and memory acquisition can crash systems; verify sources before running installs (pip install volatility3) and symbol downloads; be aware that memory images contain sensitive secrets (passwords, tokens) — handle and store them securely. Note the referenced resources/implementation-playbook.md is missing from the skill bundle; if you expect implementation artifacts, ask the author for the missing file.
功能分析
Type: OpenClaw Skill
Name: memory-forensics
Version: 1.0.1
The memory-forensics skill bundle is a legitimate and well-structured guide for performing memory analysis using Volatility 3 and various acquisition tools like WinPmem, LiME, and DumpIt. It provides standard forensic workflows, command references for process and network analysis, and methods for detecting memory injection or extracting credentials in an incident response context. No evidence of malicious intent, data exfiltration, or prompt injection was found; all content aligns with the stated professional forensic purpose.
能力评估
Purpose & Capability
Name/description match the provided SKILL.md: guidance and commands for acquiring memory, using Volatility plugins, and forensic workflows. No unrelated credentials, binaries, or capabilities are requested.
Instruction Scope
Instructions stay within memory-forensics tasks (acquisition, analysis, dumping processes, YARA scanning). They include privileged operations (sudo dd, insmod for LiME, kernel-level actions and credential extraction) which are expected for this domain but are high-impact; the SKILL.md refers to resources/implementation-playbook.md which is not present in the manifest.
Install Mechanism
No install spec in the skill bundle (instruction-only). The document suggests common installs (pip install volatility3, downloading symbol tables from the Volatility Foundation) which are standard for this toolset and are proportional to the stated purpose.
Credentials
The skill declares no required environment variables, credentials, or config paths. The instructions do describe extracting credentials from memory (a normal forensic capability) but do not request external secrets or unrelated system credentials.
Persistence & Privilege
always is false and the skill is user-invocable. It does not request persistent or elevated platform privileges beyond normal agent invocation, and it does not attempt to modify other skills or system-wide agent settings.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install memory-forensics - 安装完成后，直接呼叫该 Skill 的名称或使用
/memory-forensics触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
Natural description rewrite
v1.0.0
Initial release of the memory-forensics skill.
- Provides comprehensive guidance for acquiring and analyzing RAM dumps across Windows, Linux, macOS, and virtual machines.
- Documents the use of Volatility 2 and 3 plugins for process, network, registry, and file system artifact extraction.
- Outlines workflows for malware analysis and incident response using memory forensics.
- Includes acquisition tool instructions (LiME, WinPmem, DumpIt), timeline reconstruction, and artifact extraction.
- Lists relevant Windows data structures and process injection detection techniques.
- Clearly defines scope: memory forensics only; excludes file, network, and disk forensics.
元数据
常见问题
Memory Forensics 是什么？
Memory forensics with Volatility and related tools. Acquire RAM dumps, extract processes and DLLs, investigate rootkits and fileless malware, recover credent... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 293 次。
如何安装 Memory Forensics？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install memory-forensics」即可一键安装，无需额外配置。
Memory Forensics 是免费的吗？
是的，Memory Forensics 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Memory Forensics 支持哪些平台？
Memory Forensics 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Memory Forensics？
由 Solomon Neas（@solomonneas）开发并维护，当前版本 v1.0.1。
推荐 Skills