菜单
Use the OpenCROW forensics stack for memory dumps, metadata extraction, and carved-file workflows. Use when Codex needs `volatility3`, `exiftool`, `foremost`, or when a full install tracks manual Autopsy setup.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | opencrow-forensics-toolbox |
| description | Use the OpenCROW forensics stack for memory dumps, metadata extraction, and carved-file workflows. Use when Codex needs `volatility3`, `exiftool`, `foremost`, or when a full install tracks manual Autopsy setup. |
Use this skill for challenge artifacts that look like disk, memory, firmware, or metadata problems. It covers RAM analysis with volatility3, metadata extraction with exiftool, and file carving with foremost.
Start the MCP server from the installed CLI:
opencrow-forensics-mcp
Verify the mapped stack:
python ~/.codex/skills/opencrow-forensics-toolbox/scripts/verify_toolkit.py
exiftool when the artifact is an image, document, archive, or file bundle that may hide metadata clues.foremost when the challenge is about recovering deleted or embedded files from a blob or disk image.volatility3 when the artifact is a memory dump or live-memory-style capture.toolbox_info, toolbox_verify, toolbox_capabilities, forensics_metadata, forensics_carve, and forensics_memory_inspect.opencrow-forensics-mcp: stdio MCP server for typed metadata, carving, and memory workflows.scripts/verify_toolkit.py: confirm that the mapped forensics tools are installed.references/tooling.md: quick guidance for choosing between memory, metadata, and carving tools.Use the Anaconda `ctf` environment and installed reverse-engineering tooling for binary analysis, symbolic execution, disassembly, emulation, and binary patching. Use when Codex needs `angr`, `claripy`, `capstone`, `unicorn`, `ghidra-headless`, `radare2`, `objdump`, `strace`, `ltrace`, `binwalk`, or related tools.
Manage a preinstalled local Minecraft Java client asynchronously for CTF and automation workflows. Use when Codex needs to launch Minecraft in offline mode with alternate usernames, inspect Minecraft logs, focus or type into the X11 game window, send chat or slash commands quickly, or join a multiplayer server by launching the installed client directly instead of relying on the official launcher.
Maintain bidirectional netcat-style TCP communications with persistent asynchronous input/output. Use when Codex must keep a connection open across multiple commands, send messages while receiving background output, inspect connection logs, or safely start/stop reusable sessions for protocol testing, CTF services, debugging sockets, or interactive line-based services.
Maintain persistent asynchronous SSH sessions with bidirectional input/output across multiple commands. Use when Codex must keep an SSH shell open, send commands incrementally, inspect prompts or streamed output, reuse one authenticated connection for a task, or safely start/stop a long-lived remote session for debugging, administration, deployment, log inspection, or interactive line-based workflows on remote hosts.
Use the Anaconda `ctf` environment and installed network tooling for packet- and protocol-level CTF tasks. Use when Codex needs `scapy`, `tshark`, `tcpdump`, `nmap`, `nc`, or `socat` for packet work, capture analysis, or service triage.
Use the OpenCROW utility stack for shell-heavy CTF workflows. Use when Codex needs `jq`, `yq`, `xxd`, `tmux`, `screen`, `rg`, or `fzf` to glue a larger workflow together.