基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/jmagly/aiwg --skill forensics-status命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
WCAG accessibility analysis for color palettes including contrast ratios, compliance checking, and remediation suggestions. Use when user needs to verify colors meet accessibility standards.
Generate, analyze, compare, export, and suggest color palettes using color theory. Use when user asks about colors, palettes, color schemes, or needs help choosing colors for a project.
Research current color trends from Pantone, architecture, film, and design. Use when user asks about trending colors, popular palettes, or wants research-backed color inspiration.
| namespace | aiwg |
| name | forensics-status |
| platforms | ["all"] |
| description | Show investigation status dashboard |
| commandHint | {"argumentHint":"[--investigation id] [--detailed] [--all] [--format markdown|json]","category":"forensics-monitoring"} |
Display the current status of active or recent forensic investigations. Shows phase completion, finding counts by severity, artifact inventory, and pending work. Provides a quick situational awareness dashboard for ongoing incident response.
/forensics-status [options]
| Argument | Required | Description |
|---|---|---|
| --investigation | No | Specific investigation ID to show (e.g., INV-2026-02-27-web01) |
| --detailed | No | Show detailed breakdown of each phase and artifact |
| --all | No | Show all investigations, including completed ones |
| --pending-only | No | Show only investigations with incomplete stages |
| --format | No | Output format: markdown (default), json |
| --path | No | Investigation root path (default: .aiwg/forensics/) |
When invoked, this command:
Discover Investigations
.aiwg/forensics/ for investigation state filesinvestigation.yaml for each discovered investigationPhase Status Assessment
Finding Counts
Artifact Inventory
Pending Work
Timeline Status
Render Dashboard
/forensics-status
/forensics-status --detailed
/forensics-status --investigation INV-2026-02-27-web01
/forensics-status --all
/forensics-status --format json
Status is displayed to console. Optional JSON export to .aiwg/forensics/reports/status.json.
Investigation Status Dashboard
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Active Investigations: 1
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
INV-2026-02-27-web01 | ACTIVE | Confirmed Breach | web01.internal
────────────────────────────────────────────────────────────────
Phases:
Reconnaissance [COMPLETE] system-profile.md
Triage [COMPLETE] triage-summary.md Threat: 87/100 CRITICAL
Acquisition [COMPLETE] 14 artifacts (140.6 MB)
Analysis [COMPLETE] 16 findings
Timeline [COMPLETE] incident-timeline.md
IOC Extraction [COMPLETE] 12 IOCs
Report [PENDING] not started
Findings:
CRITICAL: 2 HIGH: 5 MEDIUM: 6 LOW: 3 INFO: 0
Total: 16 findings across 5 analysis domains
IOCs:
IP addresses: 2 (1 known malicious)
Domains: 1 (1 known C2)
File hashes: 1
File paths: 3
Accounts: 2
Evidence:
Artifacts collected: 14
Storage: 140.6 MB
Integrity: 14/14 verified
Investigation Window:
Start: 2026-02-26T22:14:33Z (first attacker activity)
End: 2026-02-27T02:15:00Z (last seen)
Dwell: 4h 0m 27s
Pending Work:
1. /forensics-report .aiwg/forensics/ --format full
Generate final investigation report
2. Validate: 3 IOCs pending enrichment
/forensics-ioc .aiwg/forensics/ --enrich
────────────────────────────────────────────────────────────────
Last updated: 2026-02-27T15:02:10Z
Investigation Status Dashboard (Detailed)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
INV-2026-02-27-web01
Target: 192.168.1.50 (web01.internal)
Started: 2026-02-27T14:30:00Z
Duration: 31m 44s (analysis), report pending
Investigator: analyst
Scope: full
Phase Detail:
─────────────────────────────────────────────────────────────────
Reconnaissance [COMPLETE, 14:31:42Z, 102s]
Artifacts:
system-profile.md (web01-2026-02-27) - 8.4 KB
system-profile.json - 12.1 KB
Triage [COMPLETE, 14:34:15Z, 153s]
Threat Score: 87/100 (CRITICAL)
Red Flags: 5 (2 CRITICAL, 2 HIGH, 1 MEDIUM)
Artifacts:
triage-summary.md - 14.2 KB
volatile/process-list - 42.1 KB
volatile/network-conn. - 8.3 KB
Acquisition [COMPLETE, 14:39:02Z, 287s]
Evidence collected: 14 artifacts
Total size: 140.6 MB
Integrity: 14/14 VERIFIED
Artifacts:
auth.log (4.2 MB) SHA256 VERIFIED
syslog (12.8 MB) SHA256 VERIFIED
journal (87.3 MB) SHA256 VERIFIED
[11 more artifacts...]
Analysis [COMPLETE, 14:55:09Z, 967s]
Log Analyst: 8 findings (1 CRITICAL, 3 HIGH, 3 MEDIUM, 1 LOW)
Persistence Hunter: 3 findings (1 CRITICAL, 2 HIGH)
Network Analyst: 5 findings (2 HIGH, 2 MEDIUM, 1 LOW)
Container Analyst: skipped (no containers detected)
Memory Analyst: skipped (no memory image)
Timeline [COMPLETE, 14:57:33Z, 144s]
Events: 312 significant (from 1,247 raw)
Attack phases: Initial Access -> Execution -> Persistence -> C2
Patient zero: account 'deploy'
Dwell time: 4h 0m 27s
IOC Extraction [COMPLETE, 14:59:01Z, 88s]
IOCs extracted: 12
Enriched: 4 (3 pending)
Actionable (block): 3 IPs, 1 domain
For scanning: 1 file hash
Report [PENDING]
Run: /forensics-report .aiwg/forensics/ --format full
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Recommended Next Action:
/forensics-report .aiwg/forensics/ --format full