skills.rest
brucebanner010198-commits
brucebanner010198-commitsCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Analyze GitHub OSS projects for supply-chain compromise by correlating local git history, GitHub API activity, and web archive snapshots into a unified evidence registry.

Updated Apr 21, 2026
Search Tags:#git#investigation#evidence#supply-chain#forensics#oss
One-click install
npx skills add https://github.com/brucebanner010198-commits/DevSecOps-Agency --skill oss-forensics-brucebanner010198-commits
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/brucebanner010198-commits/DevSecOps-Agency/tree/main/skills/oss-forensics
Command: npx skills add https://github.com/brucebanner010198-commits/DevSecOps-Agency --skill oss-forensics-brucebanner010198-commits

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Open-source project investigations often struggle to collect and correlate scattered evidence from local git history, GitHub API activity, and public archives. This skill provides a structured framework to gather, link, and report security-forensic data for OSS repos.

Core Features & Use Cases

  • Multi-source evidence collection (local git logs, API responses, and Wayback snapshots) with a unified evidence registry.
  • Hypothesis formation, validation, and chain-of-custody tracking to support responsible disclosure.
  • Final forensic reporting that summarizes findings, timelines, and IOCs for stakeholders.

Quick Start

Run the OSS-forensics workflow against a target repository to start evidence collection and hypothesis generation.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a git repository for supply-chain compromises?▼

To investigate git repositories for supply-chain compromises, analyze local git logs, GitHub API activity, and web archives to collect multi-source evidence into a unified registry for tracking anomalous contributor events.

What is OSS forensics and when do I need it for open-source projects?▼

OSS forensics is the structured collection and correlation of security evidence from local git history, GitHub APIs, and public archives. You need it to detect and document supply-chain compromises like force-push erasures and deleted issues.

How do I detect force-push erasures and deleted issues in GitHub projects?▼

Detect force-push erasures and deleted issues by correlating anomalous contributor events across local git history and GitHub API responses. This forms validated hypotheses tracked through chain-of-custody documentation for responsible disclosure.

Can I use Wayback snapshots as evidence for deleted GitHub PRs?▼

Yes, Wayback snapshots serve as multi-source evidence for deleted GitHub PRs. They are integrated with local git logs and API responses into a structured evidence registry with clear citations to EV-IDs for forensic reporting.

What's the best way to document supply-chain security findings for stakeholders?▼

Document supply-chain findings by generating a final forensic report that summarizes timelines, indicators of compromise, and validated hypotheses with redacted secrets. This provides stakeholders with clear citations to tracked evidence IDs.

Related Skills

Explore More Software Engineering Skills→
Tommy-ywTommy-yw
539

github-repo-management

Manage GitHub repositories by cloning, creating, forking, and configuring via gh CLI or git with REST API.

Community
Intermediate
nadicodeainadicodeai

oss-forensics

Analyze GitHub repositories for OSS supply-chain compromises using multi-source forensic evidence.

Official
Advanced
statick88statick88
1

cyber-intelligence

Correlate CVE data, MITRE ATT&CK techniques, and social OSINT for threat intelligence.

Community
Advanced
Hack23Hack23
23

open-source-governance

Enforce Hack23 Open Source Policy governance, security, and compliance standards.

Official
Advanced