analyzing-browser-forensics-with-hindsight

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-browser-forensics-with-hindsight/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is actionable with real commands and code and is well sectioned, but it inlines large chunks of material that duplicate the provided bundle files and never links to them. A forensic batch workflow also lacks explicit validation checkpoints.

Suggestions

Replace the inlined SQL schemas, timestamp-conversion notes, and Python script with brief pointers to references/api-reference.md, references/workflows.md, and scripts/process.py (or scripts/agent.py), keeping only a minimal quick-start example inline.

Add an explicit numbered workflow with validation checkpoints: confirm the profile path exists, open the DB read-only, verify record counts against expected artifact tables, and confirm the output file was written before trusting results.

Reference assets/template.md for report output and link to the bundle references/api-reference.md and references/standards.md so the one-level-deep structure is actually navigable.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and avoids explaining basic concepts, but the inline SQL schemas, timestamp conversion, and ~95-line Python script duplicate content already in references/ and scripts/, adding avoidable tokens.	3 / 5
Actionability	Provides concrete executable CLI commands, real SQL queries, and a complete runnable Python script with read-only DB handling; only the Web UI section is comment-only pseudo-steps rather than commands.	4 / 5
Workflow Clarity	The forensic/batch workflow is only loosely implied (locate profile → run Hindsight → review timeline) with no explicit validation checkpoints, which caps clarity at 3 for a destructive/batch forensic operation per the rubric.	3 / 5
Progressive Disclosure	A bundle exists (references/, scripts/, assets/) but the body never links to it; instead the API reference, SQL schemas, and Python code are inlined — the anchor-3 pattern of content that should be separate remaining inline without clear navigation.	3 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states capabilities, names the tool and supported browsers, and gives concrete 'use when' trigger guidance. It is distinguishable from adjacent forensics skills and free of vague fluff.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (extract and correlate browsing history, downloads, cookies, cached content, autofill, saved passwords, extensions) into a unified timeline, naming the tool, browsers, and output formats — comprehensive coverage.	5 / 5
Completeness	Explicitly answers both 'what' (parse databases, extract/correlate artifacts, unified timeline, XLSX/JSON/SQLite output) and 'when' ('Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity').	5 / 5
Trigger Term Quality	Strong natural keyword coverage ('browser history', 'downloads', 'cookies', 'incident response', 'insider-threat investigations', 'reconstruct a user's web activity') plus browser names, though a couple of common variations are absent.	4 / 5
Distinctiveness Conflict Risk	Tool-specific (Hindsight), browser-specific (Chrome/Edge/Brave/Opera/Vivaldi), and use-case-specific niche gives it a clear trigger profile with minimal overlap risk.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-browser-forensics-with-hindsight/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.