analyzing-browser-forensics-with-hindsight

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-browser-forensics-with-hindsight/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is genuinely actionable with excellent code and command examples, but it is held back by duplicated inline content that already lives in unlinked bundle files, a padded fabricated output sample, and a forensic workflow missing explicit validation checkpoints.

Suggestions

Replace the inline CLI reference, profile-path/SQL tables, and the full Python script with short overviews plus clearly signaled links to references/api-reference.md and scripts/process.py, removing the duplication.

Add an explicit validation step to the analysis workflow (e.g., verify the History database opens read-only and row counts are plausible before interpreting the timeline), creating a validate->fix->retry loop.

Trim or remove the fabricated 'Example Output' block; it is illustrative filler rather than executable guidance and competes with the context window.

Dimension	Reasoning	Score
Conciseness	Content is mostly efficient and actionable, but the ~50-line fabricated 'Example Output' block, the duplicate timestamp-conversion explanation, and profile-path/SQL tables that reappear in references dilute the token budget with material Claude could derive.	2 / 3
Actionability	Highly concrete: copy-paste Hindsight CLI commands with real flags, ready-to-run SQL against the actual table schemas, and a complete executable Python analyzer script using read-only SQLite URIs.	3 / 3
Workflow Clarity	Steps are present (locate profile -> run Hindsight -> review timeline), but the analysis workflow lacks explicit validation checkpoints or feedback loops for a batch/forensic operation, and there is no verify-then-proceed structure, capping this at 2 per the rubric's destructive/batch note.	2 / 3
Progressive Disclosure	Real bundle files exist (references/api-reference.md, standards.md, workflows.md; scripts/process.py) but none are linked or signaled from the body — the body keeps everything inline while the bundles duplicate it, so structure is present but navigation is not one-level-deep and clearly signaled.	2 / 3
	Total	9 / 12 Passed

Description

90%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, capability-rich description with explicit what-and-when guidance and good natural trigger coverage. The only blemish is second-person voice, which the rubric penalizes on specificity.

Suggestions

Rephrase 'when you need to reconstruct' to third person ('when an investigator needs to reconstruct...') to fully satisfy the voice guideline and recover the specificity point.

Lead with the most common trigger phrasing (e.g., 'Use when reconstructing a user's web activity...') so the 'when' clause reads as a natural utterance.

Dimension	Reasoning	Score
Specificity	The description names many concrete actions ('extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions') and target browsers, but the second-person phrasing 'when you need to reconstruct' triggers a one-level specificity reduction per the rubric guidelines.	2 / 3
Completeness	It states what the skill does and gives an explicit when-clause ('Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile'), satisfying both halves.	3 / 3
Trigger Term Quality	Strong coverage of natural terms an investigator would say — 'browsing history', 'cookies', 'downloads', 'browser profile', 'incident response', 'insider-threat investigations' — spanning both artifact and scenario language.	3 / 3
Distinctiveness Conflict Risk	The Chromium-browser-forensics niche with Hindsight and named output formats (XLSX/JSON/SQLite) is a clear, distinct trigger space unlikely to collide with other skills.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-browser-forensics-with-hindsight/SKILL.md
Commit: e612f49

Reviewed: about 10 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.