Osquery Forensics is a Quality skill for Claude Code, published by AgentSecOps in SecOpsAgentKit.
Osquery Forensics uses SQL queries to inspect processes, network connections, files, users, and persistence on Linux, macOS, and Windows. Use it for incident response, threat hunting, and collecting forensic evidence from endpoints.
Osquery Forensics is cataloged under Quality on DirSkills. Osquery Forensics comes from a repository tagged agents, ai-agents, anthropic, appsec and claude-code.
Documentation
osquery transforms operating systems into queryable relational databases, enabling security analysts to investigate compromises using SQL rather than traditional CLI tools. This skill provides forensic investigation workflows, common detection queries, and incident response patterns for rapid evidence collection across Linux, macOS, and Windows endpoints.
This is the opening of the README. Read the full README on GitHub.
Osquery Forensics is one of 25 skills that DirSkills catalogs from AgentSecOps/SecOpsAgentKit, the repository it ships in. Its siblings there include Api Spectral, Bandit Python SAST and Black Duck SCA. Each one is a separate skill with its own page in this directory, installs the same way Osquery Forensics does, and is maintained by AgentSecOps in that same repository. The rest of the collection is listed on the AgentSecOps/SecOpsAgentKit page.
Osquery Forensics ranks #1491 by stars among the 1662 Quality skills in this catalog. The most-starred ones next to it are Benchmark, Benchmark Optimization Loop and API Design Patterns. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of Osquery Forensics against them. Open each page to compare what they document and how they install.
Osquery Forensics is one of 25 skills cataloged on DirSkills from AgentSecOps/SecOpsAgentKit.
Osquery Forensics is one of 1662 Quality skills cataloged on DirSkills, ranked #1491 by stars among them.