＋ Add to collection

Install (CLI)

npx skillmds add mukul975/analyzing-browser-forensics-with-hindsight

Or Copy and Paste in Your Agent chat

Please install the Agent Skill "mukul975/analyzing-browser-forensics-with-hindsight" for me from skillmd.com. A SkillMD skill is a SKILL.md file — plain markdown plus a few companion files — that you save into my skills directory. Use whichever fetch route fits your setup: (1) if you have a terminal, run npx -y skillmds add mukul975/analyzing-browser-forensics-with-hindsight; (2) otherwise fetch the file manifest at https://api.skillmd.com/api/skills/mukul975/analyzing-browser-forensics-with-hindsight/bundle?format=manifest and download each listed file from its "url" into analyzing-browser-forensics-with-hindsight/ in your skills directory; (3) if the SkillMD MCP tools are connected, call skillmd_download with slug "mukul975/analyzing-browser-forensics-with-hindsight" and save the returned files under analyzing-browser-forensics-with-hindsight/. Show me the SKILL.md before saving if you'd like me to review it. If your skills directory is read-only (e.g. the Claude desktop app), save the files to a working folder instead and tell me — I'll add them through my app's skills settings.

README badge

Show this skill's registry status in your repo:

[![SkillMD](https://skillmd.com/badge/mukul975/analyzing-browser-forensics-with-hindsight.svg)](https://skillmd.com/skills/mukul975/analyzing-browser-forensics-with-hindsight)

analyzing-browser-forensics-with-hindsight

Name: analyzing-browser-forensics-with-hindsight
Rating: 4.2 (5 reviews)
Author: mukul975

mukul975/analyzing-browser-forensics-with-hindsight · Agent Skill (multi-file)

by mukul975 · bundle

Published Jul 5, 2026 · Last updated Jul 6, 2026

Extract and analyze Chromium-based browser artifacts using Hindsight to reconstruct user web activity for forensic investigations.

SKILL.md

Analyzing Browser Forensics with Hindsight

Overview

Hindsight is an open-source browser forensics tool designed to parse artifacts from Google Chrome and other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi). It extracts and correlates data from multiple browser database files to create a unified timeline of web activity. Hindsight can parse URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, Local Storage (HTML5 cookies), login data, and session/tab information. The tool produces chronological timelines in multiple output formats (XLSX, JSON, SQLite) that enable investigators to reconstruct user web activity for incident response, insider threat investigations, and criminal cases.

When to Use

When investigating security incidents that require analyzing browser forensics with hindsight
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.8+ with Hindsight installed (pip install pyhindsight)
Access to browser profile directories from forensic image
Browser profile data (not encrypted with OS-level encryption)
Timeline Explorer or spreadsheet application for analysis

Browser Profile Locations

Browser	Windows Profile Path
Chrome	%LOCALAPPDATA%\Google\Chrome\User Data\Default\
Edge	%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\
Brave	%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\Default\
Opera	%APPDATA%\Opera Software\Opera Stable\
Vivaldi	%LOCALAPPDATA%\Vivaldi\User Data\Default\
Chrome (macOS)	~/Library/Application Support/Google/Chrome/Default/
Chrome (Linux)	~/.config/google-chrome/Default/

Key Artifact Files

File	Contents
History	URL visits, downloads, keyword searches
Cookies	HTTP cookies with domain, expiry, values
Web Data	Autofill entries, saved credit cards
Login Data	Saved usernames/passwords (encrypted)
Bookmarks	JSON bookmark tree
Preferences	Browser configuration and extensions
Local Storage/	HTML5 Local Storage per domain
Session Storage/	Session-specific storage per domain
Network Action Predictor	Previously typed URLs
Shortcuts	Omnibox shortcuts and predictions
Top Sites	Frequently visited sites

Running Hindsight

Command Line

# Basic analysis of a Chrome profile
hindsight.exe -i "C:\Evidence\Users\suspect\AppData\Local\Google\Chrome\User Data\Default" -o C:\Output\chrome_analysis

# Specify browser type
hindsight.exe -i "/path/to/profile" -o /output/analysis -b Chrome

# JSON output format
hindsight.exe -i "C:\Evidence\Chrome\Default" -o C:\Output\chrome --format jsonl

# With cache parsing (slower but more complete)
hindsight.exe -i "C:\Evidence\Chrome\Default" -o C:\Output\chrome --cache

Web UI

# Start Hindsight web interface
hindsight_gui.exe
# Navigate to http://localhost:8080
# Upload or point to browser profile directory
# Configure output format and analysis options
# Generate and download report

Artifact Analysis Details

URL History and Visits

-- Chrome History database schema (key tables)
-- urls table: id, url, title, visit_count, typed_count, last_visit_time
-- visits table: id, url, visit_time, from_visit, transition, segment_id

-- Timestamps are Chrome/WebKit format: microseconds since 1601-01-01
-- Convert: datetime((visit_time/1000000)-11644473600, 'unixepoch')

Download History

-- downloads table: id, current_path, target_path, start_time, end_time,
--   received_bytes, total_bytes, state, danger_type, interrupt_reason,
--   url, referrer, tab_url, mime_type, original_mime_type

Cookie Analysis

-- cookies table: creation_utc, host_key, name, value, encrypted_value,
--   path, expires_utc, is_secure, is_httponly, last_access_utc,
--   has_expires, is_persistent, priority, samesite

Python Analysis Script

import sqlite3
import os
import json
import sys
from datetime import datetime, timedelta


CHROME_EPOCH = datetime(1601, 1, 1)


def chrome_time_to_datetime(chrome_ts: int):
    """Convert Chrome timestamp to datetime."""
    if chrome_ts == 0:
        return None
    try:
        return CHROME_EPOCH + timedelta(microseconds=chrome_ts)
    except (OverflowError, OSError):
        return None


def analyze_chrome_history(profile_path: str, output_dir: str) -> dict:
    """Analyze Chrome History database for forensic evidence."""
    history_db = os.path.join(profile_path, "History")
    if not os.path.exists(history_db):
        return {"error": "History database not found"}

    os.makedirs(output_dir, exist_ok=True)
    conn = sqlite3.connect(f"file:{history_db}?mode=ro", uri=True)

    # URL visits with timestamps
    cursor = conn.cursor()
    cursor.execute("""
        SELECT u.url, u.title, v.visit_time, u.visit_count,
               v.transition & 0xFF as transition_type
        FROM visits v JOIN urls u ON v.url = u.id
        ORDER BY v.visit_time DESC LIMIT 5000
    """)
    visits = [{
        "url": r[0], "title": r[1],
        "visit_time": str(chrome_time_to_datetime(r[2])),
        "total_visits": r[3], "transition": r[4]
    } for r in cursor.fetchall()]

    # Downloads
    cursor.execute("""
        SELECT target_path, tab_url, start_time, end_time,
               received_bytes, total_bytes, mime_type, state
        FROM downloads ORDER BY start_time DESC LIMIT 1000
    """)
    downloads = [{
        "path": r[0], "source_url": r[1],
        "start_time": str(chrome_time_to_datetime(r[2])),
        "end_time": str(chrome_time_to_datetime(r[3])),
        "received_bytes": r[4], "total_bytes": r[5],
        "mime_type": r[6], "state": r[7]
    } for r in cursor.fetchall()]

    # Keyword searches
    cursor.execute("""
        SELECT k.term, u.url, k.url_id
        FROM keyword_search_terms k JOIN urls u ON k.url_id = u.id
        ORDER BY u.last_visit_time DESC LIMIT 1000
    """)
    searches = [{"term": r[0], "url": r[1]} for r in cursor.fetchall()]

    conn.close()

    report = {
        "analysis_timestamp": datetime.now().isoformat(),
        "profile_path": profile_path,
        "total_visits": len(visits),
        "total_downloads": len(downloads),
        "total_searches": len(searches),
        "visits": visits,
        "downloads": downloads,
        "searches": searches
    }

    report_path = os.path.join(output_dir, "browser_forensics.json")
    with open(report_path, "w") as f:
        json.dump(report, f, indent=2)

    return report


def main():
    if len(sys.argv) < 3:
        print("Usage: python process.py <chrome_profile_path> <output_dir>")
        sys.exit(1)
    analyze_chrome_history(sys.argv[1], sys.argv[2])


if __name__ == "__main__":
    main()

References

Hindsight GitHub: https://github.com/obsidianforensics/hindsight
Chrome Forensics Guide: https://allenace.medium.com/hindsight-chrome-forensics-made-simple-425db99fa5ed
Browser Forensics Tools: https://www.cyberforensicacademy.com/blog/browser-forensics-tools-how-to-extract-user-activity
Chromium Source (History): https://source.chromium.org/chromium/chromium/src/+/main:components/history/

Example Output

$ python hindsight.py -i /evidence/chrome-profile -o /analysis/hindsight_output

Hindsight v2024.01 - Chrome/Chromium Browser Forensic Analysis
================================================================

Profile: /evidence/chrome-profile (Chrome 120.0.6099.130)
OS: Windows 10

[+] Parsing History database...
    URL records:          12,456
    Download records:     234
    Search terms:         567

[+] Parsing Cookies database...
    Cookie records:       8,923
    Encrypted cookies:    6,712

[+] Parsing Web Data (Autofill)...
    Autofill entries:     1,234
    Credit card entries:  2 (encrypted)

[+] Parsing Login Data...
    Saved credentials:    45 (encrypted)

[+] Parsing Bookmarks...
    Bookmark entries:     189

--- Browsing History (Last 10 Entries) ---
Timestamp (UTC)          | URL                                          | Title                        | Visit Count
2024-01-15 14:32:05.123  | https://mail.corporate.com/inbox             | Corporate Mail                | 45
2024-01-15 14:33:12.456  | https://drive.google.com/file/d/1aBcDe...    | Q4_Financial_Report.xlsx     | 1
2024-01-15 14:35:44.789  | https://mega.nz/folder/xYz123               | MEGA - Secure Cloud          | 3
2024-01-15 14:36:01.234  | https://mega.nz/folder/xYz123#upload        | MEGA - Upload                | 8
2024-01-15 14:42:15.567  | https://pastebin.com/raw/kL9mN2pQ           | Pastebin (raw)               | 1
2024-01-15 15:01:33.890  | https://192.168.1.50:8443/admin              | Admin Panel                  | 12
2024-01-15 15:15:22.111  | https://transfer.sh/upload                  | transfer.sh                  | 2
2024-01-15 15:30:45.222  | https://vpn-gateway.corporate.com            | VPN Login                    | 5
2024-01-15 16:00:00.333  | https://whatismyipaddress.com                 | What Is My IP                | 1
2024-01-15 16:05:12.444  | https://protonmail.com/inbox                 | ProtonMail                   | 3

--- Downloads (Suspicious) ---
Timestamp (UTC)          | Filename                    | URL Source                               | Size
2024-01-15 14:33:15.000  | Q4_Financial_Report.xlsm   | https://phish-domain.com/docs/report     | 245 KB
2024-01-15 14:34:02.000  | update_client.exe          | https://cdn.evil-updates.com/client.exe  | 1.2 MB

--- Cookies (Session Tokens) ---
Domain                   | Name              | Expires            | Secure | HttpOnly
.corporate.com           | SESSION_ID        | 2024-01-16 14:32   | Yes    | Yes
.mega.nz                 | session           | Session            | Yes    | Yes
.protonmail.com          | AUTH-TOKEN        | 2024-02-15 00:00   | Yes    | Yes

Report saved to: /analysis/hindsight_output/Hindsight_Report.xlsx

---
name: analyzing-browser-forensics-with-hindsight
description: Extract and analyze Chromium-based browser artifacts using Hindsight to reconstruct user web activity for forensic investigations.
license: Apache-2.0
---

# Analyzing Browser Forensics with Hindsight

## Overview

Hindsight is an open-source browser forensics tool designed to parse artifacts from Google Chrome and other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi). It extracts and correlates data from multiple browser database files to create a unified timeline of web activity. Hindsight can parse URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, Local Storage (HTML5 cookies), login data, and session/tab information. The tool produces chronological timelines in multiple output formats (XLSX, JSON, SQLite) that enable investigators to reconstruct user web activity for incident response, insider threat investigations, and criminal cases.


## When to Use

- When investigating security incidents that require analyzing browser forensics with hindsight
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques

## Prerequisites

- Python 3.8+ with Hindsight installed (`pip install pyhindsight`)
- Access to browser profile directories from forensic image
- Browser profile data (not encrypted with OS-level encryption)
- Timeline Explorer or spreadsheet application for analysis

## Browser Profile Locations

| Browser | Windows Profile Path |
|---------|---------------------|
| Chrome | %LOCALAPPDATA%\Google\Chrome\User Data\Default\ |
| Edge | %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\ |
| Brave | %LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\Default\ |
| Opera | %APPDATA%\Opera Software\Opera Stable\ |
| Vivaldi | %LOCALAPPDATA%\Vivaldi\User Data\Default\ |
| Chrome (macOS) | ~/Library/Application Support/Google/Chrome/Default/ |
| Chrome (Linux) | ~/.config/google-chrome/Default/ |

## Key Artifact Files

| File | Contents |
|------|----------|
| History | URL visits, downloads, keyword searches |
| Cookies | HTTP cookies with domain, expiry, values |
| Web Data | Autofill entries, saved credit cards |
| Login Data | Saved usernames/passwords (encrypted) |
| Bookmarks | JSON bookmark tree |
| Preferences | Browser configuration and extensions |
| Local Storage/ | HTML5 Local Storage per domain |
| Session Storage/ | Session-specific storage per domain |
| Network Action Predictor | Previously typed URLs |
| Shortcuts | Omnibox shortcuts and predictions |
| Top Sites | Frequently visited sites |

## Running Hindsight

### Command Line

```bash
# Basic analysis of a Chrome profile
hindsight.exe -i "C:\Evidence\Users\suspect\AppData\Local\Google\Chrome\User Data\Default" -o C:\Output\chrome_analysis

# Specify browser type
hindsight.exe -i "/path/to/profile" -o /output/analysis -b Chrome

# JSON output format
hindsight.exe -i "C:\Evidence\Chrome\Default" -o C:\Output\chrome --format jsonl

# With cache parsing (slower but more complete)
hindsight.exe -i "C:\Evidence\Chrome\Default" -o C:\Output\chrome --cache
```

### Web UI

```bash
# Start Hindsight web interface
hindsight_gui.exe
# Navigate to http://localhost:8080
# Upload or point to browser profile directory
# Configure output format and analysis options
# Generate and download report
```

## Artifact Analysis Details

### URL History and Visits

```sql
-- Chrome History database schema (key tables)
-- urls table: id, url, title, visit_count, typed_count, last_visit_time
-- visits table: id, url, visit_time, from_visit, transition, segment_id

-- Timestamps are Chrome/WebKit format: microseconds since 1601-01-01
-- Convert: datetime((visit_time/1000000)-11644473600, 'unixepoch')
```

### Download History

```sql
-- downloads table: id, current_path, target_path, start_time, end_time,
--   received_bytes, total_bytes, state, danger_type, interrupt_reason,
--   url, referrer, tab_url, mime_type, original_mime_type
```

### Cookie Analysis

```sql
-- cookies table: creation_utc, host_key, name, value, encrypted_value,
--   path, expires_utc, is_secure, is_httponly, last_access_utc,
--   has_expires, is_persistent, priority, samesite
```

## Python Analysis Script

```python
import sqlite3
import os
import json
import sys
from datetime import datetime, timedelta


CHROME_EPOCH = datetime(1601, 1, 1)


def chrome_time_to_datetime(chrome_ts: int):
    """Convert Chrome timestamp to datetime."""
    if chrome_ts == 0:
        return None
    try:
        return CHROME_EPOCH + timedelta(microseconds=chrome_ts)
    except (OverflowError, OSError):
        return None


def analyze_chrome_history(profile_path: str, output_dir: str) -> dict:
    """Analyze Chrome History database for forensic evidence."""
    history_db = os.path.join(profile_path, "History")
    if not os.path.exists(history_db):
        return {"error": "History database not found"}

    os.makedirs(output_dir, exist_ok=True)
    conn = sqlite3.connect(f"file:{history_db}?mode=ro", uri=True)

    # URL visits with timestamps
    cursor = conn.cursor()
    cursor.execute("""
        SELECT u.url, u.title, v.visit_time, u.visit_count,
               v.transition & 0xFF as transition_type
        FROM visits v JOIN urls u ON v.url = u.id
        ORDER BY v.visit_time DESC LIMIT 5000
    """)
    visits = [{
        "url": r[0], "title": r[1],
        "visit_time": str(chrome_time_to_datetime(r[2])),
        "total_visits": r[3], "transition": r[4]
    } for r in cursor.fetchall()]

    # Downloads
    cursor.execute("""
        SELECT target_path, tab_url, start_time, end_time,
               received_bytes, total_bytes, mime_type, state
        FROM downloads ORDER BY start_time DESC LIMIT 1000
    """)
    downloads = [{
        "path": r[0], "source_url": r[1],
        "start_time": str(chrome_time_to_datetime(r[2])),
        "end_time": str(chrome_time_to_datetime(r[3])),
        "received_bytes": r[4], "total_bytes": r[5],
        "mime_type": r[6], "state": r[7]
    } for r in cursor.fetchall()]

    # Keyword searches
    cursor.execute("""
        SELECT k.term, u.url, k.url_id
        FROM keyword_search_terms k JOIN urls u ON k.url_id = u.id
        ORDER BY u.last_visit_time DESC LIMIT 1000
    """)
    searches = [{"term": r[0], "url": r[1]} for r in cursor.fetchall()]

    conn.close()

    report = {
        "analysis_timestamp": datetime.now().isoformat(),
        "profile_path": profile_path,
        "total_visits": len(visits),
        "total_downloads": len(downloads),
        "total_searches": len(searches),
        "visits": visits,
        "downloads": downloads,
        "searches": searches
    }

    report_path = os.path.join(output_dir, "browser_forensics.json")
    with open(report_path, "w") as f:
        json.dump(report, f, indent=2)

    return report


def main():
    if len(sys.argv) < 3:
        print("Usage: python process.py <chrome_profile_path> <output_dir>")
        sys.exit(1)
    analyze_chrome_history(sys.argv[1], sys.argv[2])


if __name__ == "__main__":
    main()
```

## References

- Hindsight GitHub: https://github.com/obsidianforensics/hindsight
- Chrome Forensics Guide: https://allenace.medium.com/hindsight-chrome-forensics-made-simple-425db99fa5ed
- Browser Forensics Tools: https://www.cyberforensicacademy.com/blog/browser-forensics-tools-how-to-extract-user-activity
- Chromium Source (History): https://source.chromium.org/chromium/chromium/src/+/main:components/history/

## Example Output

```text
$ python hindsight.py -i /evidence/chrome-profile -o /analysis/hindsight_output

Hindsight v2024.01 - Chrome/Chromium Browser Forensic Analysis
================================================================

Profile: /evidence/chrome-profile (Chrome 120.0.6099.130)
OS: Windows 10

[+] Parsing History database...
    URL records:          12,456
    Download records:     234
    Search terms:         567

[+] Parsing Cookies database...
    Cookie records:       8,923
    Encrypted cookies:    6,712

[+] Parsing Web Data (Autofill)...
    Autofill entries:     1,234
    Credit card entries:  2 (encrypted)

[+] Parsing Login Data...
    Saved credentials:    45 (encrypted)

[+] Parsing Bookmarks...
    Bookmark entries:     189

--- Browsing History (Last 10 Entries) ---
Timestamp (UTC)          | URL                                          | Title                        | Visit Count
2024-01-15 14:32:05.123  | https://mail.corporate.com/inbox             | Corporate Mail                | 45
2024-01-15 14:33:12.456  | https://drive.google.com/file/d/1aBcDe...    | Q4_Financial_Report.xlsx     | 1
2024-01-15 14:35:44.789  | https://mega.nz/folder/xYz123               | MEGA - Secure Cloud          | 3
2024-01-15 14:36:01.234  | https://mega.nz/folder/xYz123#upload        | MEGA - Upload                | 8
2024-01-15 14:42:15.567  | https://pastebin.com/raw/kL9mN2pQ           | Pastebin (raw)               | 1
2024-01-15 15:01:33.890  | https://192.168.1.50:8443/admin              | Admin Panel                  | 12
2024-01-15 15:15:22.111  | https://transfer.sh/upload                  | transfer.sh                  | 2
2024-01-15 15:30:45.222  | https://vpn-gateway.corporate.com            | VPN Login                    | 5
2024-01-15 16:00:00.333  | https://whatismyipaddress.com                 | What Is My IP                | 1
2024-01-15 16:05:12.444  | https://protonmail.com/inbox                 | ProtonMail                   | 3

--- Downloads (Suspicious) ---
Timestamp (UTC)          | Filename                    | URL Source                               | Size
2024-01-15 14:33:15.000  | Q4_Financial_Report.xlsm   | https://phish-domain.com/docs/report     | 245 KB
2024-01-15 14:34:02.000  | update_client.exe          | https://cdn.evil-updates.com/client.exe  | 1.2 MB

--- Cookies (Session Tokens) ---
Domain                   | Name              | Expires            | Secure | HttpOnly
.corporate.com           | SESSION_ID        | 2024-01-16 14:32   | Yes    | Yes
.mega.nz                 | session           | Session            | Yes    | Yes
.protonmail.com          | AUTH-TOKEN        | 2024-02-15 00:00   | Yes    | Yes

Report saved to: /analysis/hindsight_output/Hindsight_Report.xlsx
```

Files

This skill is a package of 8 files. Install with the command above, or download the folder.

📄SKILL.md entry
📁assets
📄template.md 437 B
📁references
📄api-reference.md 2.7 KB
📄standards.md 593 B
📄workflows.md 443 B
📁scripts
⚙️agent.py 9.7 KB
⚙️process.py 1.6 KB
📄LICENSE 11.0 KB

mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-browser-forensics-with-hindsight commit · 673da1f3b0

▌
extracting-browser-history-artifacts · mukul975 bundle
Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.

24.6k
repo stars
▌
performing-sqlite-database-forensics · mukul975 bundle
Recover deleted records, analyze freelist pages, WAL files, and unallocated space in SQLite databases for digital forensics and incident response.

24.6k
repo stars
▌
extracting-windows-event-logs-artifacts · mukul975 bundle
Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

24.6k
repo stars
▌
performing-network-forensics-with-wireshark · mukul975 bundle
Capture and analyze network traffic using Wireshark and tshark to reconstruct network events, extract artifacts, and identify malicious communications.

24.6k
repo stars
▌
performing-timeline-reconstruction-with-plaso · mukul975 bundle
Build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across file systems, logs, and artifacts into a unified chronological view.

24.6k
repo stars
▌
analyzing-linux-system-artifacts · mukul975 bundle
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.

24.6k
repo stars

Frequently asked questions

How do I install the analyzing-browser-forensics-with-hindsight skill?

Run npx skillmds add mukul975/analyzing-browser-forensics-with-hindsight in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the analyzing-browser-forensics-with-hindsight skill do?

Extract and analyze Chromium-based browser artifacts using Hindsight to reconstruct user web activity for forensic investigations. It is listed under Security, Coding & Dev Tools, Data & Analytics, Data Analysis, Incident Response on SkillMD.

Is analyzing-browser-forensics-with-hindsight safe to use?

SkillMD's automated safety review verdict for this skill is CAUTION. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. Capability flags: executes scripts, makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with analyzing-browser-forensics-with-hindsight?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is analyzing-browser-forensics-with-hindsight free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published analyzing-browser-forensics-with-hindsight?

mukul975 (@mukul975) published this skill. Their other Agent Skills are listed on their SkillMD profile.