How It Works

Every skill is a self-contained SKILL.md — instructions, commands and caveats an agent can follow during an investigation. OpenCode fetches them on demand; you add one line of config.

1. Point OpenCode at the catalog

Add the catalog URL to your opencode.json. The skills key takes an object with a urls array.

{
  "skills": {
    "urls": ["https://dfirskills.com/index.json"]
  }
}

2. What gets loaded

OpenCode reads the catalog, downloads each skill’s SKILL.md, and makes it available by name. Every entry carries a SHA-256 so a cached copy can be checked against the source.

• The free catalog

  /index.json holds the open sample — a spread across imaging, memory, timeline, network and detection work. No account, no token.

• The full catalog

  Access-token holders get their own catalog URL at /u/<token>/index.json, covering every published skill. The same OpenCode config line, a different URL.

3. Use it

Ask the agent for a skill by name — “use volatility3-windows-plugins-basics on this memory image” — and it reads the procedure and follows it. Browse what is available under Skills or by tool.

What makes a skill

Everything published here is an operational procedure: something a practitioner could follow at a console during an investigation. Reference material, product overviews and announcements do not qualify, however well written they are. Each skill cites the source it was built from, so the original is always one click away.

Threat intel is a separate feed — what happened, who is affected, indicators, and what defenders should do — cross-linked to the skills that share a tool, actor or CVE.