ctf-forensics — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ctf-forensics (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details.
Dispatch on observed file types / byte signals, not challenge titles.
| Signal in provided material | Technique → file |
|---|---|
.pcap / .pcapng | network.md (then network-advanced.md for timing/covert channels) |
.sr / .srzip / .logicdata (logic analyser) with SCL/SDA channels | PulseView I²C decoder + datasheet → signals-and-hardware.md |
.sr / .logicdata with single data line, start/stop bits | Saleae UART decode → signals-and-hardware.md |
complex64/complex128 binary + sample-rate in prompt | IQ FFT masking / GQRX pipeline → signals-and-hardware.md |
| Audio with pager-like chirps, narrow FM channel | POCSAG → GQRX→sox→multimon-ng → signals-and-hardware.md |
| Schematic with stack of op-amps + resistor ladder on shared input | Flash ADC recovery → signals-and-hardware.md |
Power traces shape (positions, guesses, traces, samples) | DPA / CPA → signals-and-hardware.md |
.raw / .vmem / .dmp / .lime (memory dump) | Volatility → disk-and-memory.md |
.E01 / .dd / .img / VMDK | Disk carving / partitioning → disk-and-memory.md |
.evtx, SAM, NTUSER.DAT, SRUDB.dat | Windows forensics → windows.md |
| Audio WAV with sync spikes or steady tones | Spectrogram / DTMF / SSTV → stego-advanced.md |
| PNG/JPEG/BMP with suspicious size or LSB patterns | Image stego → steganography.md |
.git/ directory fragment / dangling blob | Git reflog / fsck / blob repair → linux-forensics.md |
Tarball from docker save + .git/objects/??/… files present but refs/HEAD damaged | Raw zlib_decode of every object → disk-and-memory-2.md |
| RAID disks with one missing, equal-size members | RAID5 XOR recovery → disk-and-memory.md |
| PCAP where only a specific User-Agent gets non-default responses + hex-looking paths | UA-gated C2 URL-path hex-XOR exfil → network-advanced.md |
Two trace-sets labelled fixed_vs_random / key_t vs key_r / NIST-TVLA README | Welch's t-test leakage check → signals-and-hardware.md#tvla |
| Constant-time code + traces of equal length but visibly different shape | Morphology-over-duration clustering → signals-and-hardware.md#morphology |
AES first-round target, 5k-10k traces with known plaintexts (.npy + plaintexts) | CPA on sbox(p ⊕ k) Hamming weight → signals-and-hardware.md#cpa |
Recognize artefacts and bytes, not names. If the file type matches, the section applies regardless of challenge title.
For inline code/cheatsheet quick references (grep patterns, one-liners, common payloads), see quickref.md. The Pattern Recognition Index above is the dispatch table — always consult it first; load quickref.md only if you need a concrete snippet after dispatch.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.