Skill

performing-timeline-reconstruction-with-plaso

skill:mukul975/anthropic-cybersecurity-skills#performing-timeline-reconstruction-with-plaso

Builds comprehensive forensic super-timelines using Plaso (log2timeline and psort) to correlate events across file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. Use during complex forensic investigations that need cross-source event correlation, or when standard log analysis is insufficient to establish the sequence of activities for reporting findings.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:29 UTC at 54a7988

findings

medium

highest severity

threat classes

4,532

files scanned

90/90

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/performing-timeline-reconstruction-with-plaso:skills/performing-timeline-reconstruction-with-plaso/SKILL.md:170:SUPPLY

Security findings 1

Supply chain

mediumContextual risklow confidence

Residue R3 (unexplained, not concealed): the skill's Step 4 instructs the agent to clone the unpinned github.com/google/timesketch.git repository at mutable HEAD and launch it with docker compose, a network fetch-and-execute of remote code that the declared Plaso timeline-building purpose does not strictly require, though it is openly documented as a declared workflow step and prerequisite.

skills/performing-timeline-reconstruction-with-plaso/SKILL.md:170-172

git clone https://github.com/google/timesketch.git

vector:instruction

Counter-argument considered

Strongest case against: this is the official google/timesketch repo and an openly documented step; but the carve-outs cover only pinned installs, and this clone is at mutable HEAD (no tag, commit, or digest) with docker compose executing whatever the clone contains, so no carve-out or mitigation neutralizes it. Strongest case for: the skill body gives a concrete agent instruction (clone then compose up) forming a source-to-sink chain, and the declared description names only Plaso (log2timeline and psort) with no declared claim covering the github.com fetch, so the residue is real; openness does not clear it. The finding survives as a low-confidence contextual supply-chain risk.

Open questions 1

What the analysis could not settle from the code alone.

SKILL.md lines 33-52, lines 256-295, and content after line 335 are not included in this batch; any commands or instructions in those unshown ranges are unjudged in this pass. Also note the PY-CLAIM-RESIDUE leads DET:fcd451e2009697f0/DET:383f663d952807de (env 'U'/'J' at line 100) were verified against line 100 ('/$UsnJrnl:$J') and refuted as NTFS artifact paths inside a quoted heredoc, not environment-variable access.