skills.rest
AlvaroBiano
AlvaroBianoCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Correlate evidence from Git, GitHub API, Wayback Machine, and GH Archive.

Updated May 2, 2026
Search Tags:#git#investigation#reporting#evidence#supply-chain#forensics#oss
One-click install
npx skills add https://github.com/AlvaroBiano/hermes-agent --skill oss-forensics-alvarobiano
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/AlvaroBiano/hermes-agent/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/AlvaroBiano/hermes-agent --skill oss-forensics-alvarobiano

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Provides a structured, repeatable framework to perform open-source supply chain investigations, enabling teams to collect, correlate, and report evidence across multiple sources for defensible OSS security outcomes.

Core Features & Use Cases

  • End-to-end OSS forensics workflow covering local Git history, GitHub API, Wayback Machine archives, GitHub Archive (BigQuery), and IOC enrichment.
  • Phase-driven process from initialization through evidence consolidation, hypothesis formation, validation, and final reporting.
  • Centralized evidence store with integrity checks and a clear chain-of-custody log to support auditable investigations.
  • Pre-built templates and reporting artifacts (executive summaries, timelines, IOCs, and mitigations) for responsible disclosure and remediation.
  • Guardrails and ethical guidelines to minimize intrusion and ensure redaction of secrets during investigations.

Quick Start

Launch the OSS forensics workflow against a target repository by initializing the evidence store, then run Phase 1 through Phase 6 steps to generate the final investigation report.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate an open-source supply chain attack using Git history and GitHub data?▼

Cross-source evidence correlation compares artifacts from local Git data, the GitHub API, Wayback Machine archives, and GH Archive. The investigation workflow validates hypotheses by ensuring every claim is backed by at least two independent sources.

How do I conduct a step-by-step OSS forensics investigation?▼

OSS forensics investigations follow a phase-driven process from initialization through evidence consolidation, hypothesis formation, validation, and final reporting. You initialize an evidence store, then run through the phases to generate the final investigation report.

What is the best way to ensure my open-source security investigation produces defensible evidence?▼

Defensible OSS security outcomes require a centralized evidence store with integrity checks and a clear chain-of-custody log. This structured framework ensures collected artifacts remain auditable and claims are backed by at least two independent sources.

Does the OSS forensics workflow redact sensitive data found during Git history analysis?▼

Yes, the OSS forensics workflow includes guardrails and ethical guidelines to minimize intrusion. It ensures the redaction of secrets and sensitive data during investigations to maintain responsible security practices.

Can I generate executive summaries and IOC reports from GitHub Archive and Wayback Machine data?▼

Yes, the workflow provides pre-built templates and reporting artifacts for executive summaries, timelines, IOCs, and mitigations. These reports consolidate evidence gathered from GitHub Archive, Wayback Machine, and local Git data for responsible disclosure.

Related Skills

Explore More Software Engineering Skills→
blueskies1818blueskies1818
1

oss-forensics

Automate open-source supply chain investigations using GitHub, Archive, and local git data.

Community
Advanced
Liberty91LTDLiberty91LTD
15

ioc-export

Export IOC collections to CSV, STIX 2.1, OpenIOC, and MISP bundles.

Official
Intermediate
Happy-Technologies-LLCHappy-Technologies-LLC
34

correlation-insights

Correlate security incidents with events, vulnerabilities, and threat intelligence.

Official
Advanced
RazisafirRazisafir
1

performing-sca-dependency-scanning-with-snyk

Automate SCA dependency scanning with Snyk CLI across CI/CD pipelines.

Community
Advanced