Skip to content
Get packs

Guide · Agent skill

How to use the Browser Forensics with Hindsight agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains the analyzing-browser-forensics-with-hindsight agent skill, a set of instructions and small Python scripts that teach an AI agent how to read Chromium-based browser profiles with the open-source Hindsight tool. It is written for incident responders and forensic analysts who work on copied browser profiles. By the end you will know what the skill does, how to install it, how to ask for it in plain language, and what to check before you trust the output.

Browser Forensics with Hindsightmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings, Capabilities, Skills in the Claude apps.
  2. 2Install Python dependencies. Make sure Python 3.8 or later is available and install the pyhindsight package with pip.
  3. 3Copy the profile directory. Copy the browser profile folder from your forensic image so the original evidence stays untouched.
  4. 4Ask the agent for the analysis. Describe the goal, the copied profile path, the browser and the output folder in plain language.
  5. 5Review the timeline. Open the XLSX or JSON output and look at visits, downloads, cookies and extensions in chronological order.
  6. 6Verify key findings. Spot-check timestamps and suspicious entries against the source artifacts before you report them.

What the skill makes the agent do

Chrome, Edge, Brave, Opera and Vivaldi store their activity in database files inside a profile folder. The skill tells the agent where those files usually live on Windows, macOS and Linux, which artifact files matter, and how to run Hindsight against a profile directory. Hindsight then combines the artifacts into one chronological timeline.

The timeline covers visited URLs, downloads, cookies, cached content, autofill entries, extensions and related records. The output can be XLSX, JSON or SQLite. The skill also includes its own Python scripts that query the History and downloads data and write a JSON report.

  • Locates browser profile folders and artifact files such as History, Cookies, Web Data and Login Data
  • Runs Hindsight and reviews its timeline output
  • Queries the SQLite History and downloads tables with a Python script
  • Writes results to a JSON report named browser_forensics.json

Install the skill (ZIP download or Claude upload)

Option 1: download the ZIP from this page and unzip it into your user skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder. The skill folder should contain SKILL.md along with the scripts and reference files.

Option 2: in the Claude apps, open Settings, go to Capabilities, then Skills, and upload the skill there.

The skill is licensed under Apache-2.0.

  • Files included: SKILL.md, scripts/agent.py, scripts/process.py, references/api-reference.md, references/standards.md, references/workflows.md, assets/template.md
~/.claude/skills/analyzing-browser-forensics-with-hindsight/

Set up the requirements before you start

You need Python 3.8 or later and the pyhindsight package, which the skill uses for the Hindsight workflow. You also need copied browser profile directories from a forensic image. Working on copies keeps the original evidence untouched.

Timeline Explorer or a spreadsheet application is optional but useful for reviewing XLSX output. The profile data must not be protected by OS-level encryption for the parsing to work, as the skill's prerequisites note.

  • Python 3.8+
  • pyhindsight (used by the Hindsight workflow)
  • Copied browser profile directories from a forensic image
  • Optional: Timeline Explorer or a spreadsheet application
pip install pyhindsight

Ask for the analysis in plain language

Once the skill is installed, you do not need to name its scripts. Describe the task and point the agent at the copied profile folder and the output folder. Name the browser if you know it, since the skill covers Chrome, Edge, Brave, Opera and Vivaldi.

Good requests state the goal, the input and the output. For example, you might ask the agent to build a timeline of downloads and visits from a copied Chrome profile for an insider-threat case, and to save results as JSON. The skill's descriptions match requests about incident response, insider-threat investigations and criminal cases that need a user's web activity reconstructed from a browser profile.

  • Example: Using the Chromium profile copy in /evidence/case42/Default, build a timeline of visits and downloads and write it as JSON to /output/case42.
  • Example: Explain which artifact files I should review for cookies and autofill in this Edge profile copy.
  • Example: Summarize the downloads in this Brave profile and list their source URLs.

Run Hindsight from the command line or web UI

The skill's reference files show Hindsight run against a profile path with an output folder and a browser type. The examples in the skill's main file and its reference file use different flag syntax, so check the options your installed version accepts before running a full analysis.

The skill also describes a web interface you can start and open in a browser at localhost:8080, where you point it at a profile directory, choose the output format and generate a report.

  • Browser types named in the reference: Chrome, Edge, Brave, Opera
  • Output formats named in the skill: XLSX, JSON, SQLite
  • Optional cache parsing is described as slower but more complete
hindsight.exe -i "C:\Evidence\Chrome\Default" -o C:\Output\chrome -b Chrome

Read timestamps and the history data correctly

Chrome and other Chromium browsers store times as microseconds since 1601-01-01. The skill's script converts these values to readable dates. Wrong conversions produce misleading timelines, so spot-check a few entries against the browser's own display or another tool.

The skill's script opens the History database in read-only mode. Its SQL queries pull visits, downloads and keyword searches, and it writes a JSON report with counts and the extracted records.

  • Chrome/WebKit time: microseconds since 1601-01-01 UTC
  • Visit times come from the visits table joined to urls
  • Downloads come from the downloads table with source URL and byte counts
datetime((visit_time/1000000)-11644473600, 'unixepoch')

Safety, evidence handling and what the skill does not do

The skill is built for forensic evidence handling, and it assumes you work on copied profile directories. The skill's notes say that saved passwords and some other fields are encrypted and that it does not provide a way around OS-level encryption. Do not expect decrypted passwords from this skill.

The included scripts run locally and the skill does not declare network use. The profiles can contain sensitive personal data, so store outputs securely and limit who can see them. Do not run it against a live, unlocked production machine without proper evidence procedures.

  • Runs scripts: yes. Uses network: no.
  • Work on copies of profile directories, not originals.
  • Saved passwords are encrypted; the skill does not decrypt OS-protected data.
  • Keep outputs and copies under your case's evidence controls.

What people use it for

  • Reconstructing which sites a user visited and when during a security incident on a forensic image.
  • Listing downloads with their source URLs and byte counts in an insider-threat investigation.
  • Reviewing cookies and extensions in a copied Edge or Brave profile as part of a criminal case.
  • Starting a template for a team's own Chromium profile parsing scripts.

Frequently asked questions

How do I install the browser forensics with Hindsight agent skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings, Capabilities, Skills. Install pyhindsight with pip for the Hindsight workflow.

What do I need to use this skill?

You need Python 3.8 or later, the pyhindsight package, and copied browser profile directories from a forensic image. Timeline Explorer or a spreadsheet application is optional for reviewing output.

Is the skill free to use?

The skill is published under the Apache-2.0 licence, as listed on this page. The skill's source does not mention any cost or paid tier, so check the licence text in the download for the terms.

Can this skill recover saved passwords?

No. The skill notes that saved passwords and some fields are encrypted and does not provide a way around OS-level encryption. It can identify where those fields sit in the profile.

Which browsers does it support?

The skill covers Chrome, Edge, Brave, Opera and Vivaldi, which are Chromium-based. Its reference lists Chrome, Edge, Brave and Opera as browser type options for Hindsight.

What are alternatives or companion tools?

The skill's standards reference names DB Browser for SQLite for inspecting Chrome databases and ChromeCacheView from NirSoft for cache analysis. Hindsight itself is the main tool the skill is built around.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you are an incident responder, insider-threat investigator or forensic analyst who works on copied Chromium browser profiles and wants an agent to guide Hindsight and build a timeline. Pick something else if you only want to recover your own browsing history, need to work on live production machines, or need to decrypt saved passwords.

Download the skill