skills.rest
afel6
afel6COMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Investigates GitHub repositories for supply-chain compromise and recovers deleted commits.

Updated Mar 25, 2026
Search Tags:#github#supply-chain#bigquery#forensics#commit-recovery#evidence-collection#wayback
One-click install
npx skills add https://github.com/afel6/scal-ai-pipeline --skill oss-forensics-afel6
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/afel6/scal-ai-pipeline/tree/main/hermes_skills_library/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/afel6/scal-ai-pipeline --skill oss-forensics-afel6

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Provides a structured, evidence-first workflow to investigate GitHub repositories for supply-chain compromise, recover deleted commits and artifacts, and produce a verifiable forensic report suitable for defensive disclosure and remediation.

Core Features & Use Cases

  • 7-phase investigation framework: prompt parsing and IOC extraction, parallel evidence collection, consolidation, hypothesis formation, validation, and final reporting.
  • Multi-source evidence collection: local git analysis, GitHub REST API, GH Archive (BigQuery), Wayback Machine snapshots, and IOC enrichment.
  • Built-in integrity tooling: JSON evidence store with SHA-256 integrity checks, templated forensic reports, and explicit chain-of-custody recording.
  • Anti-hallucination guardrails & ethics: evidence-first citation rules, strict role boundaries for sub-agents, secret redaction, and responsible disclosure guidance.
  • Use Case: recover a force-pushed malicious commit, validate its provenance via GH Archive and API cross-checks, and produce a pinned, verifiable remediation report.

Quick Start

Run a full supply-chain investigation for owner/repo and generate an evidence-backed forensic report.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover deleted commits from a GitHub repository after a force push?▼

Recover deleted commits by orchestrating parallel evidence collection from local git, the GitHub REST API, and the Wayback Machine to reconstruct force-pushed history. It cross-references multiple sources to validate commit provenance and outputs findings to a SHA-256 integrity-verified JSON evidence store.

What is the best way to investigate a GitHub repository for supply chain compromise?▼

Investigating GitHub supply chain compromise requires a structured 7-phase framework: prompt parsing, parallel evidence collection, consolidation, hypothesis formation, validation, and final reporting. This approach ensures multi-source verification across local git, APIs, and web archives to produce a verifiable forensic report.

Can I use BigQuery and the GH Archive to trace malicious commit provenance?▼

Yes, you can trace malicious commit provenance using BigQuery and the GH Archive. The Skill extracts IOCs and queries these sources alongside the GitHub REST API to cross-check event timelines and validate evidence, ensuring strict anti-hallucination guardrails and responsible disclosure guidance.

Do I need API access to investigate private repositories for deleted artifacts?▼

You need authorized API access to GitHub to investigate private repositories for deleted artifacts. The Skill supports both public and authorized private repositories, orchestrating evidence collection from the GitHub REST API, local git, and passive IOC enrichment to generate a pinned remediation report.

How does Wayback Machine snapshot retrieval work for GitHub forensic evidence collection?▼

Wayback Machine snapshot retrieval for GitHub forensic evidence collection works by querying historical web archives to capture deleted repository states and artifacts. The Skill integrates this passive collection method with active API queries and local git analysis, enforcing explicit chain-of-custody recording and SHA-256 integrity checks.

Related Skills

Explore More Software Engineering Skills→
DaddyElonMusk69DaddyElonMusk69

oss-forensics

Investigate GitHub repositories for supply-chain compromise and recover deleted commits.

Community
Advanced
diShine-digital-agencydiShine-digital-agency
1

shine-tag-audit

Validate GTM container JSON exports with 14 governance, consent, and security checks.

Community
Intermediate
dandyedandye
120

enrich-ioc

Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.

Community
Advanced
RicherTunesRicherTunes
2

security-compliance

Implement CodeQL workflows, Dependabot configurations, and security policy documentation for repositories.

Community
Advanced