Process forensics data collector operations. Auto-activating skill for Security Advanced.
SkillScore80Maintained
Automatic
◆Security & AppSec pack
Last verified 8/29/2026
What it changes
Passed 19 of 24 test cases with the skill, and 17 of 24 without it.
Without skill72%
With skill80%
Checks it passed that the model alone missed
Specifies collecting the full var log directory including archived files
Explains that direct proc kcore copying can corrupt physical memory pages
Identifies lack of administrative privileges as the root cause of permission denied errors
3 fixed17 passed either way4 still failing1 broke
Pass-rate lift
+8 pp
Tokens
+34%
Agent turns
0%
Response time
+18%
Model gemini-3.6-flashMeasured 8/29/2026v120 of 25 cases passed with skill · 24 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
I need to collect full volatile physical RAM from a running Linux kernel 5.x server for forensic analysis. Should I copy `/proc/kcore` or use specialized kernel drivers?
What was checked, without and with the skill
Checked
Without skill
With skill
Advises using specialized kernel memory acquisition tools like LiME or avml
Passed
Passed
Explains that direct proc kcore copying can corrupt physical memory pages
Missed
Passed
case-02 · gemini-3.6-flash · 8/29/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md60 linessingle file
Forensics Data Collector
Overview
This skill provides automated assistance for forensics data collector tasks within the Security Advanced domain.
When to Use
This skill activates automatically when you:
Mention "forensics data collector" in your request
Ask about forensics data collector patterns or best practices
Need help with advanced security skills covering penetration testing, compliance frameworks, threat modeling, and enterprise security.
Instructions
Provides step-by-step guidance for forensics data collector
Follows industry best practices and patterns
Generates production-ready code and configurations
Validates outputs against common standards
Examples
Example: Basic Usage
Request: "Help me with forensics data collector"
Result: Provides step-by-step guidance and generates appropriate configurations