How do I install the User Cohort Forensics skill?

Run npx skillmds@latest add amplitude/user-cohort-forensics in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is User Cohort Forensics safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with User Cohort Forensics?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is User Cohort Forensics free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published User Cohort Forensics?

amplitude (@amplitude) published this skill. Their other Agent Skills are listed on their SkillMD profile.

User Cohort Forensics by amplitude — Agent Skill

Name: User Cohort Forensics
Rating: 4.2 (5 reviews)
Author: amplitude

User Cohort Forensics

Investigates individual users and user populations in Amplitude — resolve users by email/ID, read profiles, batch-analyze event timelines, spot-check cohort membership. Use for "what did user X do", attribution audits, population sampling, and email-to-user-ID resolution.

amplitude 7288a57 2.2 KB Updated Sep 9, 2026

File contents

User & Cohort Forensics

The arcs

Single user deep-dive: get_amp_user_data include: 'id' (resolve the user: email, user ID, device ID, or amplitude ID) → include: 'profile' (lifecycle, acquisition, usage stats) → include: 'timeline' (session-aware event history). include: 'both' gets profile + timeline in one call when you know you'll need both. Summarize journeys; don't dump raw events.

Population analysis (batched): build the user set first (query_amplitude_data with a user-ID group_by to rank by volume, or use_amplitude_cohorts action: 'find' for a filtered set) → get_amp_user_data include: 'timeline' in parallel batches — up to 10 identifiers per call, 10–20 calls in flight is normal for population analysis; hundreds of calls total is fine. Keep each call narrow (event types, window) so responses stay small.

Cohort spot-check: prefer existing cohorts — use_amplitude_cohorts action: 'list' or action: 'get' before building ad hoc definitions. action: 'membership' verifies specific users. Check a member's timeline for the exact markers (purchase, typing, checkout events) rather than trusting the cohort definition blindly.

Email → ID resolution: get_amp_user_data include: 'id' per email; uploaded email lists are resolved in batches of ≤10 identifiers per call. For bulk exports, batch and note the retry pattern on individual failures.

Parameterization notes

include: 'timeline': always bound the window (last 30 days by default) and pass event-type filters when you know what you're looking for — unfiltered timelines are large and slow.
Rate-limit failures come back flagged retryable with retryAfterMs — back off instead of churning.
User identity: a user can match multiple IDs (device, user, email). Say which identity you resolved and flag ambiguous matches instead of picking one silently.

---name: user-cohort-forensicsdescription: Investigates individual users and user populations in Amplitude — resolve users by email/ID, read profiles, batch-analyze event timelines, spot-check cohort membership. Use for "what did user X do", attribution audits, population sampling, and email-to-user-ID resolution.--- # User & Cohort Forensics ## The arcs **Single user deep-dive:** `get_amp_user_data` `include: 'id'` (resolve the user: email, user ID, device ID, or amplitude ID) → `include: 'profile'` (lifecycle, acquisition, usage stats) → `include: 'timeline'` (session-aware event history). `include: 'both'` gets profile + timeline in one call when you know you'll need both. Summarize journeys; don't dump raw events. **Population analysis (batched):** build the user set first (`query_amplitude_data` with a user-ID group_by to rank by volume, or `use_amplitude_cohorts` `action: 'find'` for a filtered set) → `get_amp_user_data` `include: 'timeline'` in parallel batches — up to 10 identifiers per call, 10–20 calls in flight is normal for population analysis; hundreds of calls total is fine. Keep each call narrow (event types, window) so responses stay small. **Cohort spot-check:** prefer existing cohorts — `use_amplitude_cohorts` `action: 'list'` or `action: 'get'` before building ad hoc definitions. `action: 'membership'` verifies specific users. Check a member's timeline for the exact markers (purchase, typing, checkout events) rather than trusting the cohort definition blindly. **Email → ID resolution:** `get_amp_user_data` `include: 'id'` per email; uploaded email lists are resolved in batches of ≤10 identifiers per call. For bulk exports, batch and note the retry pattern on individual failures. ## Parameterization notes - `include: 'timeline'`: always bound the window (last 30 days by default) and pass event-type filters when you know what you're looking for — unfiltered timelines are large and slow. - Rate-limit failures come back flagged `retryable` with `retryAfterMs` — back off instead of churning. - User identity: a user can match multiple IDs (device, user, email). Say which identity you resolved and flag ambiguous matches instead of picking one silently.

Frequently asked questions