Skills memory-forensics
📦

memory-forensics

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Analyze Memory Dumps with Forensic Workflows

Memory investigations require careful acquisition, repeatable triage, and strong evidence handling. This skill guides authorized RAM capture analysis with Volatility, YARA, strings, and forensic checklists.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "memory-forensics" from https://skillstore.io/skills/sickn33-memory-forensics.md and its manifest at https://skillstore.io/api/skills/sickn33-memory-forensics/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-memory-forensics.md Signed manifest GET /api/skills/sickn33-memory-forensics/manifest Signed lockfile GET /api/skills/sickn33-memory-forensics/lockfile

Test it

Using "memory-forensics". I have a Windows memory image and suspect hidden malware.

Expected outcome:

  • Begin with process listings and process tree comparison.
  • Review hidden process indicators, suspicious memory protections, and network artifacts.
  • Document each finding with plugin output, timestamps, hashes, and validation notes.

Using "memory-forensics". I need to scan a process dump for suspicious strings.

Expected outcome:

  • Create a working copy of the process dump before analysis.
  • Extract ASCII and Unicode strings, then separate URLs, IP addresses, paths, and commands.
  • Correlate suspicious strings with process metadata and related memory regions.

Using "memory-forensics". I want a report outline for memory forensics findings.

Expected outcome:

  • Summarize scope, acquisition method, image hashes, and tool versions.
  • Group findings by process, network, persistence, credential exposure, and malware indicators.
  • State confidence, validation steps, impact, and recommended containment actions.

Security Audit

High Risk
v5 • 7/9/2026 Open versioned report

Most code fence, PowerShell, Cobalt Strike, rootkit, and reconnaissance alerts are false positives because the skill is Markdown guidance for offline memory analysis. Confirmed risks remain for privileged live memory acquisition, direct /dev/mem and /proc/kcore access, temporary storage of RAM images, process-memory dumping, and credential extraction guidance.

1
Files scanned
492
Lines analyzed
11
Review items
0
False positives ignored

Confirmed security concerns (1)

High
SKILL.md:375-388
Credential Extraction Guidance
The skill includes a credential extraction section with hashdump, LSA secrets, cached domain credentials, and Mimikatz-style extraction from memory. This can expose reusable secrets if used outside authorized forensic investigations.
The section explicitly covers credential material extraction from memory dumps. The overall forensic context suggests legitimate use, but the data exposure risk is direct.
Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
SKILL.md:49
sudo privilege escalation
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
The command loads a kernel memory acquisition module with sudo and writes a full RAM image. This requires elevated privileges and can expose secrets from the live host.
High
SKILL.md:52
sudo privilege escalation
sudo dd if=/dev/mem of=memory.raw bs=1M
The command uses sudo to read /dev/mem into a raw memory image. Direct physical memory access is highly sensitive and can bypass normal data boundaries.
High
SKILL.md:55
sudo privilege escalation
sudo cp /proc/kcore memory.elf
The command copies /proc/kcore with sudo, which can expose kernel and process memory. This is a legitimate forensic action only under strict authorization.
High
SKILL.md:61
sudo privilege escalation
sudo ./osxpmem -o memory.raw
The command runs a macOS memory acquisition tool with sudo. It can capture sensitive system memory and should be limited to authorized evidence collection.
High
SKILL.md:54
Linux /proc filesystem access
# /proc/kcore (ELF format)
The line introduces /proc/kcore as a memory acquisition source, and the following line shows copying it. /proc/kcore can expose live kernel and process memory.
High
SKILL.md:55
Linux /proc filesystem access
sudo cp /proc/kcore memory.elf
The command copies /proc/kcore into an evidence file. That file can contain highly sensitive live memory, including credentials and process data.
High
SKILL.md:51
Non-standard device file access
# /dev/mem (limited, requires permissions)
The line introduces /dev/mem as an acquisition source, and the following line shows direct copying. /dev/mem access can expose raw physical memory.
High
SKILL.md:52
Non-standard device file access
sudo dd if=/dev/mem of=memory.raw bs=1M
The command reads /dev/mem into a raw dump. Direct device memory access is sensitive and can collect secrets outside normal file permissions.
High
SKILL.md:49
Temp directory access
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
The command writes a full memory image to /tmp. Shared temporary paths can expose highly sensitive RAM captures to other local users or cleanup races.
High
SKILL.md:114
Memory-mapped file access
vol -f memory.raw windows.memmap --pid <PID> --dump
The command dumps a selected process memory map from a forensic image. This is legitimate for incident response but can expose credentials, keys, or executable payloads.
High
SKILL.md:451
Memory-mapped file access
vol -f memory.raw windows.memmap --pid 1234 --dump
The command dumps process memory before string extraction. This can reveal sensitive user data and secrets from the captured process address space.

Risk Factors

⚙️ External commands (50)
SKILL.md:25 SKILL.md:32-44 SKILL.md:44-47 SKILL.md:47-56 SKILL.md:56-59 SKILL.md:59-64 SKILL.md:64-68 SKILL.md:68-80 SKILL.md:80-86 SKILL.md:86-98 SKILL.md:98-103 SKILL.md:103-121 SKILL.md:121-124 SKILL.md:124-130 SKILL.md:130-133 SKILL.md:133-145 SKILL.md:145-148 SKILL.md:148-157 SKILL.md:157-160 SKILL.md:160-169 SKILL.md:169-172 SKILL.md:172-181 SKILL.md:181-185 SKILL.md:185-206 SKILL.md:206-210 SKILL.md:210-222 SKILL.md:222-228 SKILL.md:228-251 SKILL.md:251-255 SKILL.md:255-275 SKILL.md:275-281 SKILL.md:281-307 SKILL.md:307-311 SKILL.md:311-330 SKILL.md:330-336 SKILL.md:336-354 SKILL.md:354-358 SKILL.md:358-373 SKILL.md:373-377 SKILL.md:377-389 SKILL.md:389-395 SKILL.md:395-424 SKILL.md:424-428 SKILL.md:428-437 SKILL.md:437-443 SKILL.md:443-456 SKILL.md:456-460 SKILL.md:460-466 SKILL.md:32 SKILL.md:49
🌐 Network access (1)
SKILL.md:91
📁 Filesystem access (7)
SKILL.md:54 SKILL.md:55 SKILL.md:51 SKILL.md:52 SKILL.md:49 SKILL.md:114 SKILL.md:451
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-memory-forensics/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-memory-forensics/security.svg)](https://skillstore.io/skills/sickn33-memory-forensics?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-memory-forensics?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-memory-forensics/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-memory-forensics.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). memory-forensics security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-memory-forensics/audits/5

BibTeX citation

@techreport{sickn33-sickn33-memory-forensics-2026, author = {sickn33}, title = {memory-forensics security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-memory-forensics/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "memory-forensics security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-09" url: "https://skillstore.io/skills/sickn33-memory-forensics/audits/5" identifiers: - type: other value: "skillstore:sickn33-memory-forensics:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Triage a Compromised Endpoint

Plan a focused memory analysis workflow for suspicious processes, network artifacts, persistence, and timeline clues.

Investigate Malware in RAM

Use process, VAD, YARA, string, and injection indicators to locate suspicious memory regions.

Build a Forensics Lab Exercise

Teach memory acquisition, Volatility plugin selection, artifact review, and evidence documentation.

Try These Prompts

Plan a Basic Workflow 
Help me plan a safe memory forensics workflow for a Windows host. Ask for missing details before suggesting tools.
Choose Volatility Plugins 
Review this memory dump scenario and choose Volatility 3 plugins for process, network, registry, and file artifact triage: [scenario].
Investigate Injection 
Build an investigation checklist for suspected process injection in a Windows memory image, including validation steps and evidence notes.
Design Malware Analysis Plan 
Design a multi-stage malware memory analysis plan using Volatility 3, YARA scanning, strings extraction, and reporting checkpoints.

Best Practices

  • Work on verified copies of memory images and preserve original hashes.
  • Run high-risk acquisition steps only with explicit authorization and documented scope.
  • Correlate memory findings with disk, endpoint, and network evidence before conclusions.

Avoid

  • Running live acquisition commands on systems outside your approved scope.
  • Saving full memory images in shared temporary directories or unencrypted storage.
  • Treating one plugin result as proof without cross-checking related artifacts.

Frequently Asked Questions

Does this skill run forensic tools automatically?
No. It provides guidance and example workflows. Users choose and run tools in their own environment.
Which tools does it focus on?
It focuses on Volatility 3, memory acquisition tools, YARA, strings, and FLOSS.
Can it help with malware analysis?
Yes. It covers injected memory, suspicious processes, hidden modules, YARA scans, and string triage.
Is administrator access required?
Some acquisition examples require administrator or root privileges. Use them only with explicit authorization.
Does it handle chain of custody?
It includes practical guidance for hashing, documentation, and evidence handling during memory analysis.
Can memory analysis expose sensitive data?
Yes. Memory images can contain credentials, keys, personal data, and confidential files.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/memory-forensics

Ref

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

Maintenance freshness

7/18/2026

Usage

7 downloads · 164 views

File structure

📄 SKILL.md

More from sickn33

View all

Related Skills

View all