thor-scan

Generate safe, reproducible THOR scan commands for hosts, images, or memory dumps.

12|2|Updated Jan 17, 2026
One-click install
npx skills add https://github.com/NextronSystems/thor-skill --skill thor-scan
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: thor-scan
Source: https://github.com/NextronSystems/thor-skill/tree/main/thor-scan
Command: npx skills add https://github.com/NextronSystems/thor-skill --skill thor-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

THOR users need a reliable way to generate safe, reproducible command lines for scanning hosts, images, or memory dumps across Windows, Linux, and macOS, instead of manually composing commands.

Core Features & Use Cases

  • Generates a single recommended THOR command for the target and environment.
  • Performs preflight environment checks (OS, THOR path, license presence, thor-util).
  • Distinguishes full THOR vs THOR Lite and suggests appropriate flags.
  • Use cases include on-demand host scans, mounted-image analysis, memory-dump investigations, and lab-style forensics.

Quick Start

Provide your target and THOR version preference to generate the exact command.

Frequently Asked Questions about thor-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a safe THOR command line for scanning memory dumps across different platforms?

To generate a safe THOR command line for scanning memory dumps, you can use a command generator that performs preflight checks and enforces environment detection across Windows, Linux, and macOS, ensuring reproducible forensic investigations without manual flag composition.

What is the best way to automate THOR scan commands for forensic lab workflows?

Automating THOR scan commands for lab workflows requires generating deterministic output with preflight checks that verify OS, THOR binary presence, and license validity for lab mode, ensuring a single reproducible command line for endpoint triage scenarios.

Does THOR Lite require different scan flags compared to the full THOR version?

Yes, THOR Lite requires different scan flags compared to the full THOR version. A proper command generator distinguishes between the two versions automatically and suggests appropriate flags, ensuring you avoid unsafe magic flags during host or mounted-image analysis.

Can I use THOR to scan mounted images on macOS and Linux?

Yes, you can use THOR to scan mounted images on macOS and Linux. The tool supports cross-platform forensic workflows by performing environment detection and generating a single recommended command line tailored to your specific operating system and target.

Why does my THOR scan fail preflight checks in lab mode?

Your THOR scan may fail preflight checks in lab mode if the environment detection process cannot verify the THOR binary presence, locate thor-util, or confirm the necessary license files, which are all required to generate a safe and deterministic command line.

What preflight environment checks are needed before running a THOR v10 scan?

Before running a THOR v10 scan, preflight environment checks must verify the operating system, validate the THOR binary path, confirm license presence for lab mode, and check for thor-util, ensuring the avoidance of magic flags and deterministic output.