thor-skills
An entry point and router for AI agents to manage various THOR-related cybersecurity tasks, including running scans, analyzing logs, troubleshooting, and maintenance.
About this skill
This skill serves as the primary interface for AI agents to handle requests related to THOR, a powerful forensic analysis and threat hunting tool. It acts as an intelligent router, directing user inquiries to the appropriate sub-skill (e.g., `thor-scan`, `thor-log-analysis`, `thor-troubleshooting`, `thor-maintenance`, `thor-lens`) based on the user's intent. Beyond routing, it enforces crucial global rules, ensuring that interactions are safe, reproducible, and adhere to best practices for forensic workflows, preventing the AI from guessing or making unsafe recommendations. Users can leverage this skill for a wide range of THOR operations, from initiating scans and interpreting their results to diagnosing issues, maintaining THOR installations, and utilizing advanced features like THOR Lens for timeline analysis. It helps the AI agent understand the nuances of different THOR versions (v10 vs v11, full vs Lite) and their capabilities, ensuring context-aware and accurate assistance. This central routing mechanism streamlines complex cybersecurity tasks, making THOR more accessible and manageable through an AI agent.
Best use case
The primary use case is to provide a structured and safe way for security professionals, incident responders, or analysts to interact with THOR via an AI agent. It allows users to offload the complexity of remembering specific commands or workflows to the AI, which then uses this skill to correctly interpret requests, apply best practices, and delegate to specialized sub-skills for execution or guidance. This benefits anyone needing quick, reliable, and guided assistance with THOR operations, especially in forensic analysis or lab environments.
An entry point and router for AI agents to manage various THOR-related cybersecurity tasks, including running scans, analyzing logs, troubleshooting, and maintenance.
The user should expect the AI agent to accurately understand their THOR-related request, apply relevant global rules and context, and either provide direct guidance or route the request to a more specialized THOR sub-skill for detailed assistance.
Practical example
Example input
I need to analyze a THOR log file. What does this finding mean: `[DETECT] Suspicious Process: powershell.exe`?
Example output
I will use the `thor-log-analysis` skill to help you understand this finding. The `[DETECT] Suspicious Process: powershell.exe` indicates that THOR identified a PowerShell process as potentially malicious or anomalous during its scan. To provide a more detailed analysis, could you please share the full log entry or context around this finding, including any associated rule IDs or severity levels?
When to use this skill
- When you need to run a THOR scan or inquire about scan commands.
- When analyzing THOR log outputs or understanding specific findings.
- When troubleshooting THOR hangs, errors, or unexpected behavior.
- When performing maintenance tasks like updates, upgrades, or report generation.
When not to use this skill
- When the task is not related to THOR or its specific functionalities.
- When attempting to invent or guess THOR flags or undocumented behaviors.
- When performing actions that could modify the target system without explicit user consent.
- When seeking features specific to THOR v11 or full THOR while only having THOR Lite or v10.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/thor-skill/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How thor-skills Compares
| Feature / Agent | thor-skills | Standard Approach |
|---|---|---|
| Platform Support | Claude | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | easy | N/A |
Frequently Asked Questions
What does this skill do?
An entry point and router for AI agents to manage various THOR-related cybersecurity tasks, including running scans, analyzing logs, troubleshooting, and maintenance.
Which AI agents support this skill?
This skill is designed for Claude.
How difficult is it to install?
The installation complexity is rated as easy. You can find the installation instructions above.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
Related Guides
AI Agents for Coding
Browse AI agent skills for coding, debugging, testing, refactoring, code review, and developer workflows across Claude, Cursor, and Codex.
Best AI Skills for Claude
Explore the best AI skills for Claude and Claude Code across coding, research, workflow automation, documentation, and agent operations.
ChatGPT vs Claude for Agent Skills
Compare ChatGPT and Claude for AI agent skills across coding, writing, research, and reusable workflow execution.
SKILL.md Source
# THOR Skills This is the root skill. It routes requests to the right sub-skill and enforces a few global rules. Global rules - Don't invent THOR flags or behavior. If something is unclear, ask for the missing detail instead of guessing. - Prefer reproducible commands: explicit paths, explicit output directory, explicit mode. - Keep changes safe: don't recommend deleting evidence or modifying the target system unless the user explicitly asks. - Default focus is forensic / lab workflows. If it's live endpoint scanning, call that out and keep it conservative. - THOR versions: v10 is stable; v11 is TechPreview. Some features are v11-only. In particular, THOR Lens relies on the audit trail output, which requires THOR v11 and is not available in THOR v10. - THOR Lite vs full THOR: Lite is a free scanner with reduced features (~5 modules, ~4k open source signatures, no Sigma, no lab mode, no audit trail). Identify which version the user has before troubleshooting missing features. ## Routing rules - If the user wants to run a scan or asks "what command should I run" - use thor-scan (also covers THOR Lite scanning with appropriate flag adjustments). - If the user pasted results or asks "what does this finding mean" - use thor-log-analysis. - If the user reports hangs, slowness, crashes, missing output, license/update weirdness - use thor-troubleshooting. - If the user asks about update/upgrade/report generation/yara-forge/offline packs - use thor-maintenance. - If the user asks about THOR Lens, forensic timeline viewing, importing audit trails, or MCP integration for timeline analysis - use thor-lens (note: requires full THOR v11, not compatible with THOR Lite). - If the user asks about thor10.db/thor11.db, scan timing, performance tuning, slow rules, or resume state - use thor-db. - If the user asks why a feature is missing, expects full THOR behavior from Lite, or asks about Lite limitations - use thor-lite. - If the user wants to write a plugin, extend THOR functionality, parse custom formats, or asks about the plugin API - use thor-plugins (requires THOR v11+). - If the user wants to create custom IOCs, YARA rules, Sigma rules, STIX indicators, or asks about the custom-signatures folder - use custom-signatures. ## Minimum inputs to collect (only what's needed) - OS (Windows/Linux/macOS) - THOR version (v10 or v11) and install path - License situation if relevant (lab vs standard vs unknown) - Target type: live path vs mounted image vs memory dump vs log-only analysis - Where outputs/logs should go ## Available Skills - [thor-scan/](thor-scan/) - Run THOR scans and produce the exact command line for the target scenario - [thor-log-analysis/](thor-log-analysis/) - Triage and interpret THOR logs and findings - [thor-troubleshooting/](thor-troubleshooting/) - Diagnose stuck/slow/failed THOR runs and recommend next actions - [thor-maintenance/](thor-maintenance/) - Update/upgrade THOR, manage signature packs, generate reports - [thor-lens/](thor-lens/) - THOR Lens forensic timeline viewer; import audit trails, web UI, MCP integration (requires THOR v11) - [thor-db/](thor-db/) - Analyze ThorDB (thor10.db/thor11.db) for performance tuning and diagnostics - [thor-lite/](thor-lite/) - THOR Lite limitations, workarounds, and guidance for the free scanner - [thor-plugins/](thor-plugins/) - Write custom THOR plugins to extend scanner functionality (requires THOR v11+) - [custom-signatures/](custom-signatures/) - Create custom IOCs, YARA rules, Sigma rules, and STIX indicators
Related Skills
perl-security
全面的Perl安全指南，涵盖污染模式、输入验证、安全进程执行、DBI参数化查询、Web安全（XSS/SQLi/CSRF）以及perlcritic安全策略。
security-scan
AgentShield を使用して、Claude Code の設定（.claude/ ディレクトリ）のセキュリティ脆弱性、設定ミス、インジェクションリスクをスキャンします。CLAUDE.md、settings.json、MCP サーバー、フック、エージェント定義をチェックします。
security-review
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
mtls-configuration
Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.
mobile-security-coder
Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns.
malware-analyst
Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification.
linux-privilege-escalation
Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root-level control.
laravel-security-audit
Security auditor for Laravel applications. Analyzes code for vulnerabilities, misconfigurations, and insecure practices using OWASP standards and Laravel security best practices.
frontend-security-coder
Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns.
frontend-mobile-security-xss-scan
You are a frontend security specialist focusing on Cross-Site Scripting (XSS) vulnerability detection and prevention. Analyze React, Vue, Angular, and vanilla JavaScript code to identify injection poi
differential-review
Security-focused code review for PRs, commits, and diffs.
dependency-management-deps-audit
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.