OSS Forensics

Collect multi-source evidence and generate audit-ready forensic reports for open-source supply-chain incidents.

577|62|Updated May 15, 2026

Search Tags:#investigation #reporting #evidence #forensics #oss #security-ops #ioc-enrichment

Ready to run

npx skills add https://github.com/agentic-in/elephant-agent --skill oss-forensics-agentic-in

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: OSS Forensics
Source: https://github.com/agentic-in/elephant-agent/tree/main/packages/skills/builtin_packages/security/oss-forensics
Command: npx skills add https://github.com/agentic-in/elephant-agent --skill oss-forensics-agentic-in

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Provides a structured, auditable way to investigate and document open-source supply-chain incidents by collecting evidence from multiple sources and forming defensible conclusions.

Core Features & Use Cases

Multi-source evidence collection: local git analysis, GitHub API, GH Archive/BigQuery, and Wayback snapshots.
Evidence tracking and gating: maintain an evidence store with content, hashes, verification levels, and a chain of custody.
Forensic reporting: generate a templated report with timeline, validated hypotheses, and an evidence registry.
IOC enrichment: augment IOCs from external sources to support investigations.

Quick Start

Launch an OSS Forensics investigation by creating an investigation directory, running the built-in evidence-store, and following the six-phase workflow to collect, verify, and report findings.

Frequently Asked Questions about OSS Forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate an open-source supply-chain incident with auditable evidence?▼

Open-source supply-chain incident investigation requires structured evidence collection from local Git, GitHub API, GH Archive, and Wayback Machine snapshots. This process builds a defensible narrative by enforcing strict provenance, guardrails, and a templated final report with an evidence registry and chain of custody.

What is the best way to collect forensic evidence for an OSS security incident?▼

Forensic evidence collection for OSS security incidents is best handled by coordinating data across multiple sources like local Git, GitHub REST API, GitHub Archive, and Wayback Machine. This multi-source approach ensures comprehensive evidence tracking with content hashes and verification levels.

How does chain of custody work for open-source forensics reporting?▼

Chain of custody for open-source forensics reporting works by maintaining an evidence store that tracks content, hashes, and verification levels throughout the investigation. This enforces strict provenance and guardrails, resulting in a templated final report with a complete evidence registry.

Can I use IOC enrichment to support a supply-chain forensics investigation?▼

IOC enrichment can be used to support supply-chain forensics investigations by augmenting indicators of compromise from external sources. This enriched data is integrated into the multi-source evidence collection process to build a more defensible and comprehensive investigative narrative.

Does OSS Forensics work with local Git and GitHub Archive for evidence collection?▼

OSS Forensics works with local Git and GitHub Archive for evidence collection by coordinating data from these sources alongside the GitHub REST API and Wayback Machine snapshots. This multi-source approach ensures comprehensive evidence gathering with strict provenance and guardrails.

What is included in a templated forensic report for an OSS incident?▼

A templated forensic report for an OSS incident includes a timeline, validated hypotheses, and an evidence registry. It is generated after completing a six-phase workflow that collects, verifies, and reports findings while maintaining a strict chain of custody.