oss-forensics

Name: oss-forensics
Availability: InStock
Author: hermesagents

Coordinate multi-source evidence collection and forensic reporting for OSS supply chain investigations.

Updated Aug 27, 2026

Search Tags:#investigation #reporting #evidence #supply-chain #forensics #oss

Ready to run

npx skills add https://github.com/Hermesagents/hermes-agents --skill oss-forensics

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/Hermesagents/hermes-agents/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/Hermesagents/hermes-agents --skill oss-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

OSS-forensics provides a structured, defensible framework to investigate open-source supply chain incidents. It coordinates multi-source evidence collection, hypothesis formation, validation, and final reporting to determine whether a repository has been compromised and to guide remediation.

Core Features & Use Cases

Multi-source evidence collection across local git data, GitHub REST API, Wayback Machine, and GH Archive.
Parallel investigator sub-agents with phase-structured workflows and evidence cross-linking.
Forensic reporting with executive summary, timeline, validated hypotheses, IOC registry, and remediation guidance.

Quick Start

Initialize Phase 0 and immediately delegate Phase 2 tasks to specialized sub-agents within your defined investigation window.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate a compromised open-source supply chain repository?▼

To investigate an open-source supply chain compromise, you need structured multi-source evidence collection and forensic reporting. This process coordinates hypothesis formation and cross-source validation to determine repository compromise and guide remediation.

Can I recover evidence from force-pushed commits and deleted GitHub issues?▼

Yes, evidence from force-pushed commits and deleted GitHub issues can be recovered by querying the GitHub REST API, GH Archive, and Wayback Machine. Cross-linking these sources validates the timeline of repository modifications.

What is the best way to enrich Indicators of Compromise (IOCs) during a security investigation?▼

The best way to enrich Indicators of Compromise (IOCs) during a security investigation is using parallel sub-agents for multi-source data collection. This validates IOCs across local git data, archives, and logs into a defensible registry.

Does supply chain forensics work with local git data and GitHub REST API logs?▼

Supply chain forensics works directly with local git data and GitHub REST API logs to validate hypotheses. It cross-references local repository states with remote APIs and archives to ensure evidence integrity across all sources.

How do I structure a forensic report for open-source supply chain disclosure?▼

Structure a forensic report for supply chain disclosure by including an executive summary, validated timeline, IOC registry, and remediation guidance. This evidence-backed format ensures findings are defensible and actionable for stakeholders.

When should I not use an automated forensic framework for supply chain security?▼

You should not use an automated forensic framework when you lack access to necessary multi-source logs or archives. Without local git data, GitHub APIs, or historical snapshots, evidence validation and accurate hypothesis formation become impossible.