oss-forensics

Automate evidence collection and hypothesis validation for GitHub repository forensics.

2|Updated Apr 25, 2026

Search Tags:#investigation #github #reporting #evidence #supply-chain #forensics #oss-forensics

Ready to run

npx skills add https://github.com/AlexiosBluffMara/mercury --skill oss-forensics-alexiosbluffmara

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/AlexiosBluffMara/mercury/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/AlexiosBluffMara/mercury --skill oss-forensics-alexiosbluffmara

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Supply-chain investigation, evidence recovery, and forensic analysis for GitHub repositories. The framework guides users through multi-source evidence collection, hypothesis formation and validation, and structured forensic reporting to protect open-source software from supply-chain attacks.

Core Features & Use Cases

A 7-phase, multi-agent investigation framework inspired by RAPTOR for researching OSS supply-chain attacks.
Evidence collection across local git data, GitHub REST API, Wayback Machine archives, and GitHub Archive (BigQuery) when available.
Hypothesis formation, cross-source validation, and final forensic reporting with redaction and guardrails.
Anti-hallucination guardrails, evidence citation requirements, and a formal chain-of-custody record.

Quick Start

Run the OSS Forensics Skill against a target repository to initiate the phased investigation and generate an evidence-backed forensic report.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate a GitHub repository for supply-chain attacks?▼

Supply-chain forensics for GitHub repositories captures force-push events, deleted content, and IOCs by gathering evidence across local Git data, the GitHub REST API, and Wayback Machine archives to validate security breach hypotheses.

Can I recover deleted content and force-push events from a public GitHub repository?▼

Yes, you can recover deleted content and force-push events from a public GitHub repository by cross-referencing local Git data with Wayback Machine snapshots and GitHub REST API records to reconstruct missing repository history.

What is the best way to generate forensic reports for OSS supply-chain incidents?▼

The best way to generate forensic reports for OSS supply-chain incidents is through a structured investigation framework that enforces anti-hallucination guardrails, cross-source validation, and evidence citation requirements to produce a formal chain-of-custody record.

Does GitHub supply-chain forensics work with GitHub Archive BigQuery data?▼

Yes, GitHub supply-chain forensics works with GitHub Archive BigQuery data as an optional source for comprehensive results. Integrating BigQuery allows you to validate hypotheses using historical event data alongside local Git and Wayback Machine archives.

Do I need local Git data to investigate GitHub forks for malicious IOCs?▼

You need local Git data to comprehensively investigate GitHub forks for malicious IOCs. The forensic framework requires local repository access alongside the GitHub REST API to accurately capture force-push events for forensic reporting.