Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add killvxk/cybersecurity-skills-zh --skill analyzing-browser-forensics-with-hindsightgit clone --depth 1 https://github.com/killvxk/cybersecurity-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-browser-forensics-with-hindsight)<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-browser-forensics-with-hindsight"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-browser-forensics-with-hindsight/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-browser-forensics-with-hindsight"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-browser-forensics-with-hindsight.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.02027 |
| Opus 5 | $0.00033 | $0.01014 |
| Sonnet 5 | $0.00013 | $0.00405 |
| Haiku 4.5 | $0.00007 | $0.00203 |
Grade A, and why
analyzing-browser-forensics-with-hindsight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.
使用 Hindsight 分析浏览器取证
概述
Hindsight 是一款开源浏览器取证（Browser Forensics）工具，专为解析 Google Chrome 和其他基于 Chromium 的浏览器（Microsoft Edge、Brave、Opera、Vivaldi）的痕迹而设计。它从多个浏览器数据库文件中提取和关联数据，创建统一的网络活动时间线。Hindsight 可以解析 URL、下载历史、缓存记录、书签、自动填充记录、已保存密码、浏览器偏好设置、浏览器扩展、HTTP Cookie、本地存储（HTML5 Cookie）、登录数据以及会话/标签信息。该工具以多种输出格式（XLSX、JSON、SQLite）生成按时间顺序排列的时间线，使调查人员能够重建用户网络活动，适用于事件响应（Incident Response）、内部威胁调查和刑事案件。
前置条件
- Python 3.8+ 并安装 Hindsight（
pip install pyhindsight） - 可访问取证镜像中的浏览器配置文件目录
- 浏览器配置文件数据（未使用操作系统级加密）
- 用于分析的 Timeline Explorer 或电子表格应用程序
浏览器配置文件位置
| 浏览器 | Windows 配置文件路径 |
|---|---|
| Chrome | %LOCALAPPDATA%\Google\Chrome\User Data\Default\ |
| Edge | %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\ |
| Brave | %LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\Default\ |
| Opera | %APPDATA%\Opera Software\Opera Stable\ |
| Vivaldi | %LOCALAPPDATA%\Vivaldi\User Data\Default\ |
| Chrome (macOS) | ~/Library/Application Support/Google/Chrome/Default/ |
| Chrome (Linux) | ~/.config/google-chrome/Default/ |
关键痕迹文件
| 文件 | 内容 |
|---|---|
| History | URL 访问记录、下载记录、关键词搜索 |
| Cookies | 带域名、过期时间和值的 HTTP Cookie |
| Web Data | 自动填充条目、已保存的信用卡 |
| Login Data | 已保存的用户名/密码（已加密） |
| Bookmarks | JSON 格式的书签树 |
| Preferences | 浏览器配置和扩展 |
| Local Storage/ | 每个域名的 HTML5 本地存储 |
| Session Storage/ | 每个域名的会话专属存储 |
| Network Action Predictor | 之前输入过的 URL |
| Shortcuts | 地址栏快捷方式和预测 |
| Top Sites | 常访问的网站 |
运行 Hindsight
命令行
# 基本的 Chrome 配置文件分析
hindsight.exe -i "C:\Evidence\Users\suspect\AppData\Local\Google\Chrome\User Data\Default" -o C:\Output\chrome_analysis
# 指定浏览器类型
hindsight.exe -i "/path/to/profile" -o /output/analysis -b Chrome
# JSON 输出格式
hindsight.exe -i "C:\Evidence\Chrome\Default" -o C:\Output\chrome --format jsonl
# 带缓存解析（较慢但更完整）
hindsight.exe -i "C:\Evidence\Chrome\Default" -o C:\Output\chrome --cache
Web 界面
# 启动 Hindsight Web 界面
hindsight_gui.exe
# 访问 http://localhost:8080
# 上传或指向浏览器配置文件目录
# 配置输出格式和分析选项
# 生成并下载报告
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 216 lines · 66 tokens per session scan A 7f8ae1855780
analyzing-browser-forensics-with-hindsight is a skill published in the GitHub repository killvxk/cybersecurity-skills-zh (44 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 66 tokens to every session and 2,027 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-browser-forensics-with-hindsight
Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response…
analyzing-browser-forensics-with-hindsight
Use when analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation. Use when analyzeing chromium-based browser artifacts using hindsight…
analyzing-browser-forensics-with-hindsight
Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
analyzing-browser-forensics-with-hindsight
Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
analyzing-browser-forensics-with-hindsight
Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
analyzing-browser-forensics-with-hindsight
Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.