Guide · Agent skill
How to use the Windows Prefetch Forensics agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the analyzing-windows-prefetch-with-python agent skill, which teaches an AI agent to read Windows Prefetch (.pf) files with the windowsprefetch Python library. It is written for incident responders, SOC analysts and digital forensics students who want the agent to report which programs ran, how often, and when. By the end you will know what the skill does, how to install it, how to phrase requests so the agent uses it, and what to check before trusting its output.
Windows Prefetch Forensicsmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 2Install Python library. Make sure Python 3.9 or newer is available, then run pip install windowsprefetch.
- 3Copy the Prefetch files. Copy the .pf files from a Windows system's C:\Windows\Prefetch\ folder that you are authorised to examine into a working folder.
- 4Ask for the analysis. Describe the goal in plain words, such as reviewing execution history for a specific period or checking a named program.
- 5Review the report. Check the JSON or summary the agent produces, and verify key findings against the file paths and other evidence.
What is an agent skill?
An agent skill is a folder containing a SKILL.md file and optional scripts and reference files. When it is installed, an AI agent can load the instructions in SKILL.md when a request matches the skill's description, and follow them using the bundled files.
This skill's folder contains SKILL.md, scripts/agent.py and references/api-reference.md.
What the skill makes the agent do
Windows Prefetch files are small .pf records that Windows keeps of programs it has run. The skill guides the agent to parse these files with the windowsprefetch library and reconstruct application execution history, run counts, and lists of accessed files and volumes.
The skill also gives guidance for comparing executable names with loaded resources to look for renamed or masquerading binaries, flagging known attack tools, and building a chronological timeline from all Prefetch files. The expected output is a JSON report covering execution history, suspicious executables, renamed binary indicators and the timeline.
- Read executable name, run count, last run time and up to 8 timestamps per file (where the file version stores them)
- List loaded DLLs, files and volume information
- Flag known attack tool names and possible renamed binaries
- Build a timeline across all .pf files in a folder
Install the skill
Download the ZIP of the skill from this page and unzip it. Then choose one of the following locations.
For a personal install, unzip the folder into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities and upload the skill under Skills.
The skill needs Python 3.9 or newer and the windowsprefetch library. Install the library with the command below.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills (upload)
pip install windowsprefetchGet the input files
The skill works on Windows Prefetch files from a Windows system, normally found in C:\Windows\Prefetch\. The source notes support for Prefetch versions 17 to 30. Copy the .pf files you are authorised to examine into a working folder before analysis, so the original evidence is left untouched.
Files are named EXECUTABLE-XXXXXXXX.pf, where the first part is the uppercase executable name and the second is a hash of the file path.
- Use only Prefetch files from systems you have authority to examine
- Work on a copy of the folder
Trigger the skill with natural requests
You do not need to name the skill. Describe the task in plain words that match its purpose: investigating a suspicious program, checking when something ran, or reviewing a folder of .pf files. The skill's description mentions renamed or masquerading binaries, execution timelines and suspicious execution patterns, so requests with those ideas are the most likely to load it.
- "Using the Prefetch files in /evidence/Windows/Prefetch, list every program that ran between 15 and 18 January and how many times each ran."
- "Check whether update_client.exe was renamed or masquerading, using the Prefetch data."
- "Build an execution timeline from these .pf files and output it as JSON."
Read the output carefully
The source example shows a report with an execution timeline table, a renamed binary section, an execution frequency section and a summary. Treat each finding as a lead to verify, not a conclusion. A flagged name on the suspicious list does not prove compromise, because names such as certutil or rundll32 are routinely used by legitimate software.
Cross-check the results against other evidence from the same system before drawing conclusions.
- Confirm the timestamps against other logs
- Check the file path shown, not only the name
- Treat the suspicious-name list as a prompt for review
What people use it for
- Checking when a suspicious program such as a downloaded spreadsheet macro helper last ran and how many times
- Looking for an executable whose name suggests a system tool but whose path points somewhere unusual
- Building a timeline of program runs across an incident window
- Reviewing which anti-forensics or credential tool names appear in the Prefetch data for a machine under investigation
Frequently asked questions
Is the Windows Prefetch Forensics agent skill free?
The skill is published under the Apache-2.0 licence, as stated on this page. Check the licence file in the downloaded ZIP for the full terms. The windowsprefetch library is a separate Python package that you install with pip.
What do I need to use this skill?
You need Python 3.9 or newer, the windowsprefetch library installed with pip install windowsprefetch, and Windows Prefetch .pf files from a Windows system, normally in C:\Windows\Prefetch\. The skill runs scripts but does not use the network.
How do I install the skill?
Unzip the downloaded ZIP into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
Can I use this skill to speed up Windows?
No. Prefetch is a performance cache, and this skill is built for forensic and incident-response analysis. It does not tune or change Prefetch behaviour.
Does a flagged program prove that a computer was compromised?
No. The suspicious-name list is a prompt for review. Names such as certutil or rundll32 are used by legitimate software, so each finding needs checking against other evidence.
What Windows versions are supported?
The source says the skill supports Prefetch file versions 17 to 30. Its reference table maps these to Windows XP/2003 through Windows 10/11.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits incident responders, SOC analysts and forensics students who need an agent to structure Windows Prefetch evidence into execution histories and timelines. It is not suitable for performance tuning, for analysing systems you have no authority to examine, or for treating its name-based flags as proof of compromise.
Download the skill