Guide · Agent skill
How to use the LiME and Volatility Linux memory forensics skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This skill gives an AI agent a structured procedure for investigating a compromised Linux machine. It covers capturing live memory with the LiME kernel module and analyzing the image with Volatility 3 to find processes, network connections, bash history, loaded kernel modules and suspicious injected code. It is aimed at incident responders, security students and SOC analysts working in a lab or authorised setting, and after this guide you will know how to install it, how to ask for it in plain language and what safety conditions apply.
Linux Memory Forensics with LiME and Volatilitymukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 2Prepare the lab environment. Confirm you have authorisation, a Linux system with root access, Python 3.8+ and Volatility 3 available as vol3 on the PATH.
- 3Build the LiME module. Build LiME for the target kernel version, for example by running make in the LiME src directory as shown in the reference file.
- 4Acquire memory. Load the module with insmod and a path and format argument, such as format=lime, writing the image to your evidence folder.
- 5Analyze with Volatility 3. Run linux.pslist, linux.bash, linux.sockstat, linux.lsmod and linux.malfind against the image and ask the agent to organise the findings.
What does the skill make the agent do?
The skill tells the agent how to acquire a copy of a Linux system's live memory using LiME (Linux Memory Extractor), a kernel module, and then how to analyze that image with the Volatility 3 framework. The procedure covers listing processes, checking network connections, recovering bash command history, checking loaded kernel modules for rootkits and looking for injected code.
A bundled Python helper (scripts/agent.py) can run these steps and collect the output, so the agent can organise findings rather than only describing commands. The reference file (references/api-reference.md) lists the LiME build and acquisition commands and the Volatility 3 Linux plugins used.
- Acquire memory with LiME in lime or raw format
- List processes with linux.pslist and compare with linux.psscan
- Recover bash history with linux.bash
- List network connections with linux.sockstat
- Check kernel modules with linux.lsmod, injected code with linux.malfind
How do you install the skill?
Download the ZIP from this page and unzip it into one of two locations. For a personal install, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project. Alternatively, upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
After installing, the folder should contain SKILL.md, scripts/agent.py and references/api-reference.md.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
What do you need before you run it?
The skill assumes a Linux system with root privileges, because loading a kernel module with insmod requires root. You also need a LiME kernel module built for the target kernel version, Volatility 3 installed and available as vol3 on your PATH, and Python 3.8 or newer.
The skill's own prerequisites say you need familiarity with security operations concepts, a test or lab environment, and written authorisation for the activity.
- Linux system with root privileges
- LiME kernel module built for the target kernel version
- Volatility 3 available as vol3 on the PATH
- Python 3.8+
cd LiME/src && makeHow do you trigger the skill with natural requests?
You do not need to type the skill name. Describe the task in plain language that matches the skill's purpose, such as investigating a suspected compromised Linux server or analysing a memory image. The agent should pick up the skill from the description in SKILL.md.
Be specific about the evidence path and what you want to know. Name the artifact you care about, such as processes, network connections or bash history, so the agent knows which Volatility plugins to run.
- Walk me through capturing memory from this Linux server with LiME, then list its processes.
- Analyse /evidence/memory.lime and check for suspicious injected code and loaded kernel modules.
- Pull the bash history and open network connections from this memory image using Volatility 3.
What does an example workflow look like?
The skill's example shows a full workflow run against a memory image. Filtering out kernel threads from the process list keeps the output readable. The commands below are copied from the skill's source, so check them against your own Volatility and LiME versions before relying on them.
The skill's acquisition example loads LiME with a path and format argument. The lime format includes metadata, while raw does not.
- Filter kernel threads from the process list when reviewing output
- Compare pslist results with psscan results to spot hidden processes
- Review malfind and lsmod output together when looking for rootkit activity
insmod lime-$(uname -r).ko "path=/evidence/memory.lime format=lime"
vol3 -f memory.lime linux.pslist | grep -v "\[kthread\]"
vol3 -f memory.lime linux.bash
vol3 -f memory.lime linux.malfind
vol3 -f memory.lime linux.lsmodWhat safety points should you know?
Loading a kernel module with insmod changes the running system and can crash it or alter evidence. Only run acquisition on systems you are authorised to examine, and plan the capture before you start.
The skill runs scripts (scripts/agent.py). Review the script before running it. The skill's metadata states that it does not use the network. The reference file also shows a LiME option that acquires memory over a TCP connection, so decide in advance whether that option is appropriate for your case.
The skill covers Linux only. It is not suitable for Windows or macOS memory analysis. Its commands and file paths are a generic procedure and have not been validated against specific Volatility or LiME versions.
- Use only on systems you are authorised to examine
- Do not load kernel modules on production systems without a plan
- Read scripts/agent.py before running it
- Verify commands against your installed Volatility 3 and LiME versions
What people use it for
- Triaging a suspected compromised Linux server during incident response by listing processes and network connections from a memory image.
- Teaching memory forensics workflows to security students using LiME and Volatility 3 in a lab.
- Building a repeatable SOC checklist for Linux memory triage, including rootkit checks with linux.lsmod.
Frequently asked questions
Is the lime and volatility Linux memory forensics skill free?
The skill is licensed under Apache-2.0, as stated on this page. The source does not mention pricing, and you will still need your own Linux system, LiME and Volatility 3.
What do I need to install before using this skill?
You need a Linux system with root privileges, a LiME kernel module built for your kernel version, Volatility 3 available as vol3 on the PATH, and Python 3.8 or newer.
Where do I put the skill folder?
Unzip the downloaded ZIP into ~/.claude/skills/ for a personal install, or into a project's .claude/skills/ folder. You can also upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
Can this skill analyse Windows or macOS memory dumps?
No. The skill covers only Linux memory acquisition and analysis, so other operating systems are outside its scope.
Why does loading LiME with insmod need caution?
insmod changes the running system and can crash it or alter evidence. Use it only on systems you are authorised to examine, and plan the capture first.
How does this compare with running Volatility 3 commands myself?
The skill gives the agent a structured procedure and a helper script that runs the steps and collects output, so findings can be organised. If you already know the workflow, the same Volatility 3 plugins can be run directly from the command line.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits incident responders, students and SOC analysts who want a structured, repeatable Linux memory triage procedure in a lab or authorised setting. It is not suitable for production systems without a plan, for Windows or macOS analysis, or for anyone who needs a tool whose commands have been verified against specific versions.
Download the skill