skills.rest
carterwayneskhizeine
carterwayneskhizeineCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Extract IOCs and collect evidence from GitHub repositories for supply-chain security forensics.

19|4|Updated Apr 22, 2026
Search Tags:#evidence verification#oss forensics#github archive#force push detection#ioc extraction#supply chain investigation#forensic reporting
One-click install
npx skills add https://github.com/carterwayneskhizeine/hermes-agent-windows-R --skill oss-forensics-carterwayneskhizeine
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/carterwayneskhizeine/hermes-agent-windows-R/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/carterwayneskhizeine/hermes-agent-windows-R --skill oss-forensics-carterwayneskhizeine

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3, curl, jq, git, gcloud, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps you investigate open-source supply chain compromise by systematically recovering and cross-referencing evidence across Git history, GitHub APIs, GitHub Archive, and the Wayback Machine.

Core Features & Use Cases

  • Evidence-first forensic workflow: Builds a structured evidence store and produces citation-backed reports with verification gates.
  • Deleted and rewritten history recovery: Detects force-push and attempts recovery paths for erased commits and deleted pages.
  • Multi-source correlation for hypotheses: Uses parallel specialist investigators, then validates hypotheses only with mechanically checked evidence.

Quick Start

Ask your AI agent to run an OSS forensics investigation on owner/repo and produce a defensible report with an evidence registry and IOC list.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate an open-source supply chain attack on a GitHub repository?▼

Deleted commits and pull requests can be recovered by querying the GitHub REST API, GitHub Archive, BigQuery, and the Wayback Machine to retrieve erased data that local git history no longer contains.

How do I detect a force push that erased repository history?▼

Force push detection involves comparing local git history against GitHub Archive and API records to identify overwritten or erased commits, applying recovery paths to reconstruct the compromised supply chain timeline.

Do I need specific dependencies to run a GitHub forensic investigation?▼

Yes, open-source supply chain forensics requires python3, curl, jq, git, and gcloud installed to query APIs, parse JSON responses, manage local repositories, and access GitHub Archive via BigQuery.

How do I generate a defensible forensic report for a compromised maintainer account?▼

Defensible forensic reporting requires building a structured evidence store with SHA-256 integrity, strict evidence-ID citations, and a hypothesis validation phase that mechanically verifies multi-source evidence for CI/CD or maintainer compromise.

What is the best way to extract IOCs from a compromised open-source repository?▼

The best way to extract IOCs is running parallel specialist investigators across git history and GitHub data sources, validating findings only with mechanically checked evidence IDs stored in a structured registry.

Related Skills

Explore More Legal & Compliance Skills→
rnbenrnben

github-repo-management

Automate GitHub repository creation, cloning, forking, and configuration via gh CLI.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

report-bug-bounty

Draft structured vulnerability disclosure reports with CVSS v4.0 scoring and CWE mapping.

Community
Advanced
harperaaharperaa
15

dependency-supply-chain-security

Audit Node.js/npm dependency trees for vulnerabilities and supply chain risks.

Community
Intermediate
Himanshu040604Himanshu040604

repo-security-audit

Audit GitHub repository URLs for malicious code and supply chain risks.

Community
Advanced