[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71KBF45BXVR3XQ60693TC0K":3,"skill-same:01M71KBF45BXVR3XQ60693TC0K":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":49,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":66},"01M71KBF45BXVR3XQ60693TC0K","digital-forensics",null,"Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.","coco-research\u002Fcoco","coco-research","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F68911604?v=4","01M71JRE9C4NM4NSZM4JD0BJTB","Coco Research","01M71JREA0ZMR0PMH3CKA99SN1",630,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Fdigital-forensics\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37],"forensics","digital forensics","memory","triage","pcap","investigation","disk","use","evidence preservation","evidence","artifact","preservation","true","for","2026-11-10 10:12:30",false,"---\nname: digital-forensics\ndescription: Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.\nuser-invocable: true\n---\n\n# Digital Forensics & IR Artifacts\n\n## 适用场景\n\n- 内存转储分析（Volatility 2\u002F3）\n- 磁盘\u002F E01 \u002F 落地文件时间线\n- PCAP 溯源与协议还原（可联合 `protocol-reverse\u002F`）\n- 主机伪影：Prefetch、Shimcache、Event Log、浏览器历史\n- 应急响应 IOC 提炼（联合 `malware-analysis\u002F` \u002F `threat-hunting\u002F`）\n\n## 工作流\n\n### 1. 保全\n\n```text\n□ 计算 SHA256；记录时区与采集命令\n□ 工作在副本上；原始只读\n□ chain of custody 备注写入 timeline\n```\n\n### 2. 内存\n\n```bash\nvol -f mem.dmp windows.info\nvol -f mem.dmp windows.pslist\nvol -f mem.dmp windows.netscan\nvol -f mem.dmp windows.cmdline\n```\n\n### 3. 主机伪影\n\n```text\n□ 事件日志：Security \u002F PowerShell \u002F Sysmon\n□ 持久化：Run 键、服务、计划任务、WMI\n□ 执行痕迹：Amcache、Prefetch、BAM\n```\n\n### 4. 网络\n\n```text\n□ tshark 统计会话与 DNS\n□ 导出可疑流 → protocol-reverse 或 malware C2 分析\n```\n\n## 工具链\n\n| 工具 | 用途 |\n|------|------|\n| Volatility 3 | 内存 |\n| Timeline Explorer \u002F Plaso | 超级时间线 |\n| tshark | PCAP |\n| Eric Zimmerman 工具集 | Windows 伪影 |\n| Autopsy \u002F FTK Imager | 磁盘 |\n\n## 参考\n\n- `references\u002Fforensics-triage.md`\n- `..\u002Fmalware-analysis\u002F` `..\u002Fthreat-hunting\u002F` `..\u002Fprotocol-reverse\u002F`\n","# Digital Forensics & IR Artifacts\n\n## 适用场景\n\n- 内存转储分析（Volatility 2\u002F3）\n- 磁盘\u002F E01 \u002F 落地文件时间线\n- PCAP 溯源与协议还原（可联合 `protocol-reverse\u002F`）\n- 主机伪影：Prefetch、Shimcache、Event Log、浏览器历史\n- 应急响应 IOC 提炼（联合 `malware-analysis\u002F` \u002F `threat-hunting\u002F`）\n\n## 工作流\n\n### 1. 保全\n\n```text\n□ 计算 SHA256；记录时区与采集命令\n□ 工作在副本上；原始只读\n□ chain of custody 备注写入 timeline\n```\n\n### 2. 内存\n\n```bash\nvol -f mem.dmp windows.info\nvol -f mem.dmp windows.pslist\nvol -f mem.dmp windows.netscan\nvol -f mem.dmp windows.cmdline\n```\n\n### 3. 主机伪影\n\n```text\n□ 事件日志：Security \u002F PowerShell \u002F Sysmon\n□ 持久化：Run 键、服务、计划任务、WMI\n□ 执行痕迹：Amcache、Prefetch、BAM\n```\n\n### 4. 网络\n\n```text\n□ tshark 统计会话与 DNS\n□ 导出可疑流 → protocol-reverse 或 malware C2 分析\n```\n\n## 工具链\n\n| 工具 | 用途 |\n|------|------|\n| Volatility 3 | 内存 |\n| Timeline Explorer \u002F Plaso | 超级时间线 |\n| tshark | PCAP |\n| Eric Zimmerman 工具集 | Windows 伪影 |\n| Autopsy \u002F FTK Imager | 磁盘 |\n\n## 参考\n\n- `references\u002Fforensics-triage.md`\n- `..\u002Fmalware-analysis\u002F` `..\u002Fthreat-hunting\u002F` `..\u002Fprotocol-reverse\u002F`\n",{"name":5,"description":7,"user-invocable":43},true,"main","cd89f013b617f7eea982a9bbc60e992974fda2aa","systems\u002Freverse-skill\u002Fskills\u002Fdigital-forensics",15,"https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco","https:\u002F\u002Fcocoresearch.org\u002Fcoco\u002F","https:\u002F\u002Fgithub.com\u002Fcoco-research","https:\u002F\u002Fcocoresearch.org","Local-first, open-source tools for people who work with AI agents: governed memory, agents that check their own work, and data that stays on your machine.","2026-11-10 10:38:36",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":43},[56,59,62],{"tool":57,"command":58},"npx","npx skills add coco-research\u002Fcoco --skill digital-forensics",{"tool":60,"command":61},"bunx","bunx skills add coco-research\u002Fcoco --skill digital-forensics",{"tool":63,"command":64},"pnpm","pnpm dlx skills add coco-research\u002Fcoco --skill digital-forensics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Fdigital-forensics\u002FSKILL.md",[67],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"references\u002Fforensics-triage.md","REFERENCE","参考文档",274,"https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Fdigital-forensics\u002Freferences\u002Fforensics-triage.md",[74,99,109,127,162,181],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":81,"publishedAt":38},"01M71KEJXF9KMT0BWCMRSRFA4M","trading-super-intelligence","Trading Super Intelligence Team. Named real-world personas across 8 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Ftrading\u002FSKILL.md",[80],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98],"super","trading super intelligence","intelligence","trading","validator","personas","local","composites","studio","team","across","world","first","gated","2026","lm studio","local-first",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":106,"publishedAt":38},"01M71KEFWS3CMAP7DF1P0FWTDE","strategy-super-intelligence","Strategy Super Intelligence Team. Named real-world personas across 7 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fstrategy\u002FSKILL.md",[105],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[107,82,108,84,86,87,88,89,90,91,92,93,94,95,96,97,98],"strategy","strategy super intelligence",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":121,"publishedAt":38},"01M71KED56ZEPK2QE84QSQPMT0","risk-compliance-super-intelligence","Risk & Compliance (GRC) Super Intelligence Team. Named real-world personas across 7 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Frisk-compliance\u002FSKILL.md",[115,116],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":117,"categoryName":118,"taxonomyType":119,"taxonomyTypeDesc":120},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[122,82,123,124,125,84,86,87,88,89,126,90,91,92,93,94,95,96,97,98],"risk","risk compliance super intelligence","compliance","risk compliance","grc",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":146,"publishedAt":38},"01M71KE9A2FWSC74VA96W1EZSN","product-design-super-intelligence","Your product + design brain trust and decision partner. Named personas across 8 cells spanning product strategy, discovery\u002Fresearch, growth\u002Fmetrics, design foundations\u002Fusability, design leadership\u002Fcraft, UX\u002Fcontent, design systems, and a…","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fproduct-design\u002FSKILL.md",[133,136,139,140,143],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":141,"categoryName":142,"taxonomyType":119,"taxonomyTypeDesc":120},"01JBSEEDCAT000000000000031","产品经理",{"categoryNo":144,"categoryName":145,"taxonomyType":119,"taxonomyTypeDesc":120},"01JBSEEDCAT000000000000032","设计师",[147,148,84,149,82,150,151,152,153,154,155,91,92,156,157,96,158,159,160,161],"design","product","product design","product design super intelligence","foundations","product-design","decision","design systems","usability","leadership","ux","brain","craft","metrics","trust",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":170,"publishedAt":38},"01M71KE6H9FPSD9TECYFBPXZ8Y","legal-ip-super-intelligence","Your legal, IP, and regulatory brain trust. 31 named personas across 7 cells covering patent strategy, tech licensing, regulatory litigation, AI governance, open-source compliance, privacy law, and antitrust.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Flegal-ip\u002FSKILL.md",[168,169],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":117,"categoryName":118,"taxonomyType":119,"taxonomyTypeDesc":120},[171,82,172,84,173,174,161,175,87,176,177,178,107,91,92,179,124,180,96,158],"ip","legal ip super intelligence","legal","sep","tech","litigation","ai governance","open","open-source","governance",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":188,"publishedAt":38},"01M71KE36QRY610V6YVB9JWRND","healthcare-life-sciences-super-intelligence","Your healthcare and life sciences brain trust. 25 named personas across 7 cells covering drug discovery, medtech, biotech strategy, health policy, genomics, clinical trials, and healthcare economics.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fhealthcare-life-sciences\u002FSKILL.md",[187],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[189,82,190,191,84,174,161,192,193,87,194,195,107,91,92,196,197,198,199,96],"healthcare","healthcare life sciences super intelligence","life","economics","discovery","policy","clinical","clinical trials","health","trials","genomics"]