🔍
DataPython

CTF Forensics

by ljagiello

CTF Forensics is a Data skill for Claude Code, published by ljagiello in ctf-skills.

3K stars353 forkson ljagiello/ctf-skillsAdded 2026/08/17+1% in starsRepository updated 2026/07/31
View source on GitHubDownload repo ZIP
agent-skillsclaude-codeclaude-code-skillscodexcodex-clictfctf-challengesctf-toolsgeminigemini-cliopencodesecurity
Install in seconds
Install CTF Forensics
Copy CTF Forensics into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.
terminal
npx degit https://github.com/ljagiello/ctf-skills/tree/main/ctf-forensics ~/.claude/skills/ctf-forensics

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/ljagiello/ctf-skills.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file
ctf-forensics/SKILL.md in ljagiello/ctf-skills
Installs to
~/.claude/skills/ctf-forensics
Collection
One of 11 skills cataloged from this repository
Category
Data — 668 skills

What CTF Forensics does

CTF Forensics provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, network captures, steganography, and more.

CTF Forensics is cataloged under Data on DirSkills. CTF Forensics comes from a repository tagged agent-skills, claude-code, claude-code-skills, codex and codex-cli.

Documentation

README

CTF Forensics & Blockchain

Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details.

Prerequisites

Python packages (all platforms):

pip install volatility3 Pillow numpy matplotlib

Linux (apt):

apt install binwalk foremost libimage-exiftool-perl tshark sleuthkit \
  ffmpeg steghide testdisk john pcapfix

macOS (Homebrew):

brew install binwalk exiftool wireshark sleuthkit ffmpeg \
  testdisk john-jumbo

Ruby gems (all platforms):

gem install zsteg

Additional Resources

This is the opening of the README. Read the full README on GitHub.

Commands CTF Forensics provides

Slash commands named in this skill’s SKILL.md, listed in the order they first appear.

  • /ctf-crypto
  • /ctf-malware
  • /ctf-web
  • /ctf-misc
  • /ctf-osint
  • /ctf-reverse

Frequently asked about CTF Forensics

  • What else does ljagiello publish alongside CTF Forensics?

    CTF Forensics is one of 11 skills that DirSkills catalogs from ljagiello/ctf-skills, the repository it ships in. Its siblings there include CTF AI/ML, CTF Binary Exploitation and CTF Challenge Solver. Each one is a separate skill with its own page in this directory, installs the same way CTF Forensics does, and is maintained by ljagiello in that same repository. The rest of the collection is listed on the ljagiello/ctf-skills page.

  • How does CTF Forensics compare to other Data skills?

    CTF Forensics ranks #244 by stars among the 668 Data skills in this catalog. The most-starred ones next to it are Benchmark Methodology, Jupyter Notebook and Solana. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of CTF Forensics against them. Open each page to compare what they document and how they install.

More from ljagiello/ctf-skills

CTF Forensics is one of 11 skills cataloged on DirSkills from ljagiello/ctf-skills.

See all 11 skills →
🧠
2w ago

CTF AI/ML

CTF AI/ML provides techniques for attacking machine learning models and LLMs in capture-the-flag challenges, including adversarial examples, model extraction, prompt injection, and jailbreaking.
AI Engineering
3K353
🔓
2w ago

CTF Binary Exploitation

CTF Binary Exploitation provides binary exploitation techniques for CTF challenges, covering buffer overflows, ROP, heap attacks, format strings, kernel exploitation, and seccomp bypass. Use when you have a vulnerable native target and need to turn memory corruption into code execution.
AI Engineering
3K353
🚩
2w ago

CTF Challenge Solver

CTF Challenge Solver performs first-pass triage on CTF challenge bundles, files, or services to identify the dominant category and route execution to the right specialized ctf-* skill. Use it when starting a challenge with an unclear category or when you need to determine where to begin.
AI Engineering
3K353
🔐
2w ago

CTF Cryptography

CTF Cryptography provides cryptography attack techniques for CTF challenges. Use it for attacking encryption, hashing, signatures, ZKP, PRNG, and mathematical crypto problems involving RSA, AES, ECC, lattices, LWE, and more.
Automation
3K353
🦠
2w ago

CTF Malware Analysis

CTF Malware Analysis provides techniques for analyzing malware and network traffic in CTF challenges, including obfuscated scripts, PE/.NET binaries, C2 protocols, and anti-analysis tricks.
Quality
3K353
🧩
2w ago

CTF Miscellaneous

CTF Miscellaneous covers miscellaneous CTF techniques for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esolangs, QR/audio puzzles, constraint solving, game theory, and hybrid logic puzzles. Use it as a fallback when no specific web, pwn, reverse, forensics, malware, OSINT, or crypto skill applies.
Automation
3K353

More Data skills

CTF Forensics is one of 668 Data skills cataloged on DirSkills, ranked #244 by stars among them.

Browse all Data skills →
📊
3w ago

Benchmark Methodology

Benchmark Methodology scores competitors across nine weighted dimensions using explicit 1–5 rubrics and a tension plot. Use it after competitive-platform-analysis to produce comparable, evidence-anchored profile cards for a competitive report.
Data
239.8K36.4K
📓
3w ago

Jupyter Notebook

Jupyter Notebook provides a stateful Python REPL via a live Jupyter kernel (hamelnb) so variables persist across executions. Use it for iterative data exploration, API inspection, and complex code development.
Data
229.7K45.3K
🪙
3w ago

Solana

Solana queries wallets, token holdings, transactions, NFTs, whale transfers, and network stats on the Solana blockchain with USD pricing via CoinGecko. Use it when you need to inspect an address, verify a transaction, check token metadata or prices, or monitor network health.
Data
229.7K45.3K