DFTK Skill

中文说明 · Runtime · Main Skill · Specialist catalog

DFTK-skill teaches an investigation Agent how to choose evidence, interpret Observations, corroborate claims and preserve coverage gaps. DFTK provides the executable perception/actions and Case memory; the host Agent owns reasoning and scheduling. This repository contains instructions, references, examples and templates, not a separate forensic engine or autonomous runtime.

Bundle 3.7.0 pairs with DFTK 3.7.0: 136 runtime capabilities across 29 domains, eight MCP entry points and 31 specialist Skills. Other runtime versions fetch their own exact v<version> companion tag. Specialist methodology may use tools outside the registry; its presence does not imply a DFTK parser exists.

Install through DFTK

Give the Agent the primary DFTK repository and the authorised evidence/workspace locations. With the runtime installed:

python -m pip install --upgrade "dftk[mcp]"
dftk agent setup --root /evidence/acquisition --workspace /cases/investigation --install-skill --config-out /cases/investigation/dftk-agent-config.json

Setup installs the full version-matched bundle into one detected host (portable agents fallback), then emits MCP configuration fragments. It does not edit global host configuration; import/enable the fragment and refresh the session. Use --target <host> to select a known host or --dry-run to inspect destinations. Keep sources read-only and the workspace outside them. Installation

For an already configured host:

dftk skill --install --target agents
# Or install into an explicit custom skills directory:
dftk skill --install --dir /opt/agent-skills

Replace the portable target with your actual host when appropriate. Installation preserves the complete main tree and 31 standalone specialist copies, rebasing their shared-resource links. Copying only SKILL.md or a specialist folder can break those references. External binaries, Python extras and OCR weights are not installed by copying the Skill.

What the guidance covers

Area	Reference
Evidence requirements and tool choice	Claim patterns, selection
Images, video, GPU OCR and encrypted branches	Perception
Cases, unread evidence and recovery	Coverage/recovery, MCP
Interpretation and provenance	Evidence, correlation, verification
Reporting	Reports, optional answer slots
Domain procedures	Specialist catalog, router

The Agent may browse, read text, inspect media or call a specialist directly. Intake, recipes and next-action hints are optional aids. Visual model disclosure needs scoped consent and image support; CPU OCR needs its own affirmative consent. Do not repeatedly guess passwords or block an entire case on one inaccessible file.

Repository layout

SKILL.md              main evidence/decision contract
references/           common topics and generated runtime/specialist catalogs
skills/<name>/        31 specialist Skills and their supporting resources
examples/             concise investigation examples
templates/            report/finding cards and optional question workspace
scripts/              deterministic catalog and documentation checks

The capability catalog is generated from the matching runtime manifest. It lists contracts, not guaranteed installed readiness. DFTK audit logs record registry calls; external shell/instrumentation needs separate command/output logging. Media pixels are not replayed from Case files.

For contribution and validation use CONTRIBUTING.md. See release notes and history for version changes. Maintainer: DyNooob, DigiForensics. Apache-2.0.