extracting-browser-history-artifacts

by mukul975

extracting-browser-history-artifacts is a Digital Forensics skill for extracting browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge. Use it to turn browser profile files into timeline-ready evidence with repeatable, case-focused workflow guidance.

Stars0

Favorites0

Comments0

AddedMay 11, 2026

CategoryDigital Forensics

Install Command

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-browser-history-artifacts

Curation Score

This skill scores 84/100, which means it is a solid directory listing candidate for users doing browser-forensics work. The repository gives enough real workflow substance, code-backed extraction logic, and artifact scope to help agents decide to install it, though it is still more specialized than broadly plug-and-play.

84/100

Strengths

Clearly scoped for browser-history forensics across Chrome, Firefox, and Edge, with use cases like insider threat, phishing, and timeline correlation.
Provides operational workflow content and prerequisites, plus a substantial SKILL.md body and a supporting Python script for extraction.
No placeholder/demo markers; frontmatter is valid and the repository includes concrete artifact handling logic and repository/file references.

Cautions

No install command and no bundled reference material, so users may need to assemble dependencies and environment setup themselves.
The skill is narrowly focused on forensic browser artifacts, so it is best suited to cybersecurity and digital-forensics workflows rather than general agent use.

Forensics Browser Forensics Chrome Firefox Edge Artifact Analysis Windows Artifacts History

Overview

Overview of extracting-browser-history-artifacts skill

What this skill does

extracting-browser-history-artifacts is a Digital Forensics skill for pulling browser activity evidence from Chrome, Firefox, and Edge. It focuses on the artifacts investigators actually use: history, cookies, cache, downloads, and bookmarks. If you need a fast way to turn browser profile files into timeline-ready evidence, this skill is aimed at that job.

Who should use it

This extracting-browser-history-artifacts skill fits forensic analysts, incident responders, and security teams working on phishing, insider threat, or policy violation cases. It is most useful when you already have a disk image, mounted evidence, or access to browser profile directories and want repeatable extraction rather than manual SQLite browsing.

Why it is worth installing

The main value of extracting-browser-history-artifacts is practical triage speed. It helps you identify which files matter, what browser locations to inspect, and how to structure the extraction workflow for evidentiary use. Compared with a generic prompt, it is more likely to keep you focused on browser-specific storage formats, OS path differences, and timeline correlation.

How to Use extracting-browser-history-artifacts skill

Install the skill

Use the repository install flow shown in the skill docs:

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-browser-history-artifacts

For best results, keep the skill installed in a workspace where you can inspect the underlying files and run extraction steps against your own case data.

Read these files first

Start with skills/extracting-browser-history-artifacts/SKILL.md to understand scope and workflow. Then inspect scripts/agent.py for the extraction logic, output shape, and browser-specific handling. LICENSE is also worth checking if you need reuse clarity. The repo has a light support footprint, so these two files matter more than in a larger project.

Give the skill case-ready input

The extracting-browser-history-artifacts usage works best when your prompt includes the browser, operating system, evidence source, and investigative goal. Strong input looks like this:

“Extract Chrome history and downloads from a mounted Windows profile to identify visits to a phishing domain.”
“Review Firefox artifacts from a Linux user directory and correlate bookmark changes with the incident timeline.”
“Compare Edge browsing history and cookies from two profile folders to detect possible exfiltration activity.”

Include file paths, date range, and whether you need CSV, JSON, or narrative findings. That reduces guesswork and improves the output’s forensic usefulness.

Use a workflow that matches the evidence

A practical extracting-browser-history-artifacts guide is: locate the browser profile, verify the database files are available, extract records, normalize timestamps, and then correlate the results with other artifacts. Read the browser-specific path notes in SKILL.md before running queries, especially if the case spans Windows, macOS, or Linux. If the data is from a forensic image, confirm you are using read-only access and working from the mounted copy, not the live system.

extracting-browser-history-artifacts skill FAQ

Is this only for digital forensics?

Yes, it is primarily for extracting-browser-history-artifacts for Digital Forensics. It is designed for evidence-oriented browser artifact extraction, not general web browsing analysis or marketing analytics.

Do I need special tools beyond the skill?

Usually yes. The skill assumes access to browser databases and basic forensic tooling such as SQLite, browser artifact viewers, or a Python environment. If you do not have the profile files or database access, the skill cannot do meaningful work.

How is this different from a normal prompt?

A normal prompt might say “analyze browser history,” but extracting-browser-history-artifacts gives you a browser-forensics workflow with artifact targets, expected file locations, and extraction context. That matters when you need defensible results, not just a summary of web activity.

Is it beginner-friendly?

It is usable by beginners with forensic data access, but the output quality depends on knowing what source you have. If you are unsure whether you have a profile folder, a mounted image, or a live machine, resolve that first; otherwise you may ask for the wrong extraction path.

How to Improve extracting-browser-history-artifacts skill

Provide the artifact scope up front

The biggest improvement comes from naming the exact artifacts you want. Say “history and downloads only” if that is the case, instead of asking for everything. Narrow scope helps the skill avoid noise and focus on evidence that answers the case question.

Specify browser, OS, and evidence source

Results improve when you include browser family, operating system, and acquisition method. For example, “Firefox profile from Ubuntu home directory” is much more actionable than “browser files.” This reduces path confusion and helps the skill interpret timestamp formats and storage conventions correctly.

Ask for correlation, not just extraction

The best extracting-browser-history-artifacts skill outputs connect artifacts to an investigation. Ask it to correlate visits with downloads, bookmarks, or known incident timestamps. That turns raw records into leads you can validate against firewall logs, endpoint telemetry, or email evidence.

Check the first output against your case

After the first pass, verify whether the skill found the right profile, timestamp range, and browser version assumptions. If the output is incomplete, refine the prompt with exact file paths, a narrower date window, or a target domain list. The fastest way to improve extracting-browser-history-artifacts install value is to iterate with better evidence context, not broader instructions.

Ratings & Reviews

No ratings yet

Share your review

0/10000

Latest reviews

Saving...

more skill

conducting-malware-incident-response

by mukul975

conducting-malware-incident-response helps IR teams triage suspected malware, confirm infections, scope spread, contain endpoints, and support eradication and recovery. It is designed for conducting-malware-incident-response for Incident Response workflows with evidence-backed steps, telemetry-driven decisions, and practical containment guidance.

Incident Response

Favorites 0GitHub 0

analyzing-usb-device-connection-history

by mukul975

analyzing-usb-device-connection-history helps investigate USB device connection history on Windows using registry hives, event logs, and setupapi.dev.log for Digital Forensics, insider threat work, and incident response. It supports timeline reconstruction, device correlation, and removable-media evidence analysis.

Digital Forensics

Favorites 0GitHub 6.2k

analyzing-bootkit-and-rootkit-samples

by mukul975

analyzing-bootkit-and-rootkit-samples is a malware analysis skill for MBR, VBR, UEFI, and rootkit investigations. Use it to inspect boot sectors, firmware modules, and anti-rootkit indicators when compromise persists below the OS layer. It is suited for analysts who need a practical guide, clear workflow, and evidence-based triage for Malware Analysis.

Malware Analysis

Favorites 0GitHub 6.2k

analyzing-network-traffic-for-incidents

by mukul975

analyzing-network-traffic-for-incidents helps incident responders analyze PCAPs, flow logs, and packet captures to confirm C2, lateral movement, exfiltration, and exploitation attempts. Built for analyzing-network-traffic-for-incidents for Incident Response with Wireshark, Zeek, and NetFlow-style investigation.

Incident Response

Favorites 0GitHub 0

deobfuscating-javascript-malware

by mukul975

deobfuscating-javascript-malware helps analysts turn heavily obfuscated malicious JavaScript into readable code for malware analysis, phishing pages, web skimmers, droppers, and browser-delivered payloads. Use this deobfuscating-javascript-malware skill for structured deobfuscation, decode tracing, and controlled review when simple minification is not the issue.

Malware Analysis

Favorites 0GitHub 0

detecting-process-injection-techniques

by mukul975

detecting-process-injection-techniques helps analyze suspicious in-memory activity, validate EDR alerts, and identify process hollowing, APC injection, thread hijacking, reflective loading, and classic DLL injection for Security Audit and malware triage.

Security Audit

Favorites 0GitHub 0

analyzing-macro-malware-in-office-documents

by mukul975

analyzing-macro-malware-in-office-documents helps malware analysts inspect malicious VBA in Word, Excel, and PowerPoint files, decode obfuscation, and extract IOCs, execution paths, and payload staging logic for phishing triage, incident response, and document malware analysis.

Malware Analysis

Favorites 0GitHub 0

collecting-indicators-of-compromise

by mukul975

collecting-indicators-of-compromise skill for extracting, enriching, scoring, and exporting IOCs from incident evidence. Use it for Security Audit workflows, threat intel sharing, and STIX 2.1 output when you need a practical collecting-indicators-of-compromise guide instead of a generic incident-response prompt.

Security Audit

Favorites 0GitHub 0

analyzing-golang-malware-with-ghidra

by mukul975

analyzing-golang-malware-with-ghidra helps analysts reverse engineer Go-compiled malware in Ghidra with workflows for function recovery, string extraction, build metadata, and dependency mapping. The analyzing-golang-malware-with-ghidra skill is useful for malware triage, incident response, and Security Audit tasks that need practical, Go-specific analysis steps.

Security Audit

Favorites 0GitHub 0

building-incident-timeline-with-timesketch

by mukul975

building-incident-timeline-with-timesketch helps DFIR teams build collaborative incident timelines in Timesketch by ingesting Plaso, CSV, or JSONL evidence, normalizing timestamps, correlating events, and documenting attack chains for incident triage and reporting.

Incident Triage

Favorites 0GitHub 6.1k

analyzing-linux-kernel-rootkits

by mukul975

analyzing-linux-kernel-rootkits helps DFIR and threat-hunting workflows detect Linux kernel rootkits with Volatility3 cross-view checks, rkhunter scans, and /proc vs /sys analysis for hidden modules, hooked syscalls, and tampered kernel structures. It is a practical analyzing-linux-kernel-rootkits guide for forensic triage.

Digital Forensics

Favorites 0GitHub 0

detecting-mimikatz-execution-patterns

by mukul975

detecting-mimikatz-execution-patterns helps analysts detect Mimikatz execution using command-line patterns, LSASS access signals, binary indicators, and memory artifacts. Use this detecting-mimikatz-execution-patterns skill install for Security Audit, hunting, and incident response with templates, references, and workflow guidance.

Security Audit

Favorites 0GitHub 0

detecting-rootkit-activity

by mukul975

detecting-rootkit-activity is a Malware Analysis skill for finding rootkit indicators such as hidden processes, hooked system calls, altered kernel structures, hidden modules, and covert network artifacts. It uses cross-view comparison and integrity checks to help validate suspicious hosts when standard tools disagree.

Malware Analysis

Favorites 0GitHub 6.2k

analyzing-browser-forensics-with-hindsight

by mukul975

analyzing-browser-forensics-with-hindsight helps Digital Forensics teams analyze Chromium browser artifacts with Hindsight, including history, downloads, cookies, autofill, bookmarks, saved credentials metadata, cache, and extensions. Use it to reconstruct web activity, review timelines, and investigate Chrome, Edge, Brave, and Opera profiles.

Digital Forensics

Favorites 0GitHub 6.2k

hunting-advanced-persistent-threats

by mukul975

hunting-advanced-persistent-threats is a threat-hunting skill for detecting APT-style activity across endpoint, network, and memory telemetry. It helps analysts build hypothesis-driven hunts, map findings to MITRE ATT&CK, and turn threat intel into practical queries and investigation steps instead of ad hoc searches.

Threat Hunting

Favorites 0GitHub 0

extracting-windows-event-logs-artifacts

by mukul975

extracting-windows-event-logs-artifacts helps you extract, parse, and analyze Windows Event Logs (EVTX) for digital forensics, incident response, and threat hunting. It supports structured review of logons, process creation, service installs, scheduled tasks, privilege changes, and log clearing with Chainsaw, Hayabusa, and EvtxECmd.

Digital Forensics

Favorites 0GitHub 0