skills.rest
big4council-prog
big4council-progCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

oss-forensics

Collect and cross-reference supply-chain security evidence from git, GitHub, and Wayback Machine sources.

Updated Aug 23, 2026
Search Tags:#incident response#supply chain#forensics#github archive#ioc extraction#evidence registry#oss security
One-click install
npx skills add https://github.com/big4council-prog/b4c-agent --skill oss-forensics-big4council-prog
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/big4council-prog/b4c-agent/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/big4council-prog/b4c-agent --skill oss-forensics-big4council-prog

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

It helps security teams investigate potential supply-chain compromises in open-source GitHub repositories, including evidence recovery after deletion or force-push history rewrites.

Core Features & Use Cases

  • Evidence-first, audit-ready investigations: Produces structured forensic reports with an evidence registry and chain of custody.
  • Multi-source recovery framework: Collects and cross-references data from local git analysis, GitHub REST API, GitHub Archive (BigQuery), and the Wayback Machine to reconstruct timelines.
  • IOC extraction and validation workflow: Extracts indicators of compromise (e.g., commit SHAs, file paths, actor accounts) and validates hypotheses using a verification gate to prevent evidence fabrication.
  • Defensive security use: Designed for defensive incident response and responsible disclosure, not harassment or doxxing.

Quick Start

Use the oss-forensics skill to investigate a suspected compromised repository by submitting a request like: "Investigate owner/repo for supply chain compromise and recover any evidence of force-pushed malicious commits."

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover evidence of malicious commits after a force-push history rewrite in a GitHub repository?▼

This approach is restricted to defensive security use and responsible disclosure; it should not be used for harassment or doxxing. It relies on cross-referencing local git, GitHub API, GitHub Archive, and Wayback Machine data to prevent evidence fabrication during supply-chain investigations.

Can I retrieve deleted PRs or issues from a compromised open-source repository for incident response?▼

Recover deleted PRs or issues by querying the GitHub Archive and Wayback Machine to retrieve historical snapshots, then validate them against local git and GitHub API data to ensure no evidence fabrication.

How do I extract IOCs from an open-source supply chain attack for evidence validation?▼

Extract indicators of compromise (IOCs) from supply-chain attacks by collecting commit SHAs, file paths, and actor accounts across multiple sources, then validate hypotheses using a mechanically checked evidence store to enforce audit-ready reporting.

Do I need python3 to investigate CI/CD workflow tampering and malicious dependency injection?▼

You need python3 installed to run this forensic analysis. It is designed for defensive incident response and responsible disclosure, requiring access to local git, GitHub API, GitHub Archive, and Wayback Machine sources to investigate compromised maintainers or CI/CD workflow tampering.

What is the best way to investigate a typosquatting incident in a GitHub repository?▼

Supply-chain forensics through cross-source discrepancy detection ensures audit-ready investigations by collecting and validating data across local git, GitHub API, GitHub Archive, and Wayback Machine, preventing evidence fabrication and producing structured reports with a chain of custody.

When should I not use open-source supply-chain forensics tools?▼

This approach is restricted to defensive security use and responsible disclosure; it should not be used for harassment or doxxing. It relies on cross-referencing local git, GitHub API, GitHub Archive, and Wayback Machine data to prevent evidence fabrication during supply-chain investigations.

Related Skills

Explore More Legal & Compliance Skills→
afel6afel6

oss-forensics

Investigates GitHub repositories for supply-chain compromise and recovers deleted commits.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

report-forensic

Compile forensic findings into a structured, legally defensible report.

Community
Advanced
jassicsjassics
6

pipeline-integrity-review

Reviews CI/CD pipelines for supply-chain tampering risks and prioritizes fixes.

Community
Advanced
peteromalletpeteromallet
97

oss-forensics

Recover and analyze evidence from GitHub repositories across multiple sources.

Community
Advanced