skills.rest
AnandaAnugrahHandyanto
AnandaAnugrahHandyantoCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Detect supply chain compromises in open-source repositories and produce structured forensic reports.

Updated Jun 19, 2026
Search Tags:#automation#git#investigation#supply-chain#forensics#evidence-store#oss-security
One-click install
npx skills add https://github.com/AnandaAnugrahHandyanto/savarez_agent --skill oss-forensics-anandaanugrahhandyanto
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/AnandaAnugrahHandyanto/savarez_agent/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/AnandaAnugrahHandyanto/savarez_agent --skill oss-forensics-anandaanugrahhandyanto

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Open-source supply chain investigations require coordinating diverse data sources, preserving evidence, and delivering a defensible forensic report; this skill provides a scalable framework to collect, validate, and document security findings across multiple sources.

Core Features & Use Cases

  • 7-phase OSS forensics framework combining local git analysis, GitHub API signals, Wayback Machine recovery, GH Archive events, and IOC enrichment.
  • Automated evidence consolidation, hypothesis formation, validation, and final report generation to support incident response and responsible disclosure.
  • Use Case: Investigate a suspected supply-chain attack on a public repository and generate a structured investigation report with evidence registry.

Quick Start

Run the OSS Forensics skill against a target repository to begin the 7-phase investigative workflow and generate the final report.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a suspected open-source supply chain attack?▼

To investigate a suspected open-source supply chain attack, you can run an automated 7-phase forensic workflow that analyzes Git history, GitHub API signals, archive data, and IOCs to produce a structured report.

What is multi-source evidence coordination in OSS forensics?▼

Multi-source evidence coordination in OSS forensics combines Git history analysis, GitHub API signals, Wayback Machine recovery, GH Archive events, and IOC enrichment to validate security findings across diverse data sources.

How do I collect and preserve evidence from a compromised public repository?▼

You collect and preserve evidence from a compromised public repository by enforcing provenance, guardrails, and cross-source verification while assigning clearly labeled evidence IDs for traceable conclusions.

Can I automate supply chain forensics report generation for incident response?▼

Yes, you can automate supply chain forensics report generation for incident response by running an investigative workflow that handles evidence consolidation, hypothesis formation, validation, and final report output.

Does the OSS forensics toolkit require external dependencies to analyze Git history?▼

No, the OSS forensics toolkit has no external dependencies, allowing you to directly analyze Git history and GitHub API signals within defined investigation windows without installing prerequisite packages.

What are the limitations of using automated forensics for supply chain compromises?▼

A limitation of using automated forensics for supply chain compromises is that the scope is restricted to defined investigation windows and targets, meaning unindexed historical events may require manual recovery.

Related Skills

Explore More Software Engineering Skills→
jleechanorgjleechanorg

oss-forensics

Analyze open-source supply-chain risk in GitHub repositories with multi-source evidence collection.

Official
Advanced
espensevespensev

forensic-debugger

Generate incident RCAs and patch proposals from forensic artifacts.

Community
Advanced
Rawgrowth-ConsultingRawgrowth-Consulting

oss-forensics

Conduct end-to-end OSS supply chain forensic investigations across GitHub repositories.

Official
Advanced
HarriesHarries

oss-forensics

Analyze GitHub repositories to detect supply-chain compromises and generate structured forensic reports.

Community
Advanced