oss-forensics

Investigate OSS supply chain compromises using Git history, GitHub API, and archives.

Updated Mar 24, 2026

Search Tags:#investigation #github #evidence #supply-chain #forensics #oss-security

Ready to run

npx skills add https://github.com/1thirteeng3/greenmoire --skill oss-forensics-1thirteeng3

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/1thirteeng3/greenmoire/tree/main/integrations/hermes-agent/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/1thirteeng3/greenmoire --skill oss-forensics-1thirteeng3

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

## What problem does it solve? Open-source software supply chains are prone to stealthy compromises and incomplete visibility across repositories. This skill provides a structured, multi-source approach to investigate, recover deleted content when possible, and generate forensic reports that are evidence-driven.

## Core Features & Use Cases

Multi-source evidence collection: local Git history, GitHub API data, Wayback Machine archives, and GitHub Archive events.
Hypothesis-driven analysis with strict evidence citation and redaction to produce defensible conclusions.
End-to-end forensic reporting pipeline: timeline reconstruction, IOC management, and final report generation.

### Quick Start Initiate a new OSS forensics investigation by configuring the investigation workspace and running the skill's initialization workflow.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate a GitHub repository for an OSS supply chain compromise?▼

To investigate an OSS supply chain compromise, you analyze local Git history, GitHub API data, Wayback Machine archives, and GH Archive events to identify and document potential security breaches. This approach validates hypotheses using multi-source evidence collection.

What is the best way to recover deleted evidence from a GitHub repository?▼

Recovering deleted evidence from a GitHub repository involves coordinating multi-source investigations across local Git history and Wayback Machine archives. This structured approach reconstructs timelines and validates security hypotheses to produce defensible forensic reports.

Can I generate a defensible forensic report for an open-source security incident?▼

Yes, you can generate a defensible forensic report for an open-source security incident by enforcing rigorous guardrails and evidence provenance. The reporting pipeline manages IOCs and reconstructs timelines to produce structured, evidence-driven conclusions.

Does OSS supply chain forensics work with GitHub Archive event data?▼

Yes, OSS supply chain forensics works with GitHub Archive event data. It coordinates multi-source investigations across GH Archive events, local Git history, GitHub API data, and Wayback Machine archives to validate or disprove security hypotheses.

How do I validate security hypotheses during an open-source software investigation?▼

You validate security hypotheses during an open-source software investigation by enforcing strict evidence citation and redaction across multi-source data. This hypothesis-driven analysis ensures conclusions remain defensible and structurally reported.