What problem does it solve? Open-source supply chain attacks often involve erased commits, deleted issues, and rewritten git history that hide malicious activity. This Skill provides a structured 7-phase forensic framework to investigate GitHub repositories, recover deleted evidence, and produce evidence-backed reports without hallucinated claims. ## Core Features & Use Cases - Multi-Source Evidence Collection: Coordinates five specialist investigators covering local git analysis, GitHub REST API, Wayback Machine, GitHub Archive via BigQuery, and IOC enrichment. - Deleted Commit Recovery: Recovers force-pushed commits via direct GitHub URLs, API git endpoints, git fetch by SHA, and dangling commit detection with git fsck. - Hypothesis Validation with Anti-Hallucination Guardrails: Every claim must cite evidence IDs verified against a SHA-256 integrity-checked evidence store, with mechanical validation before acceptance. - Use Case: A maintainer suspects a contributor's account was compromised and used to push a backdoored workflow file. The Skill extracts IOCs, queries GH Archive for force-push events, recovers the erased commit, validates the compromise hypothesis, and generates a forensic report with a full chain of custody. ## Quick Start Ask the agent to investigate a GitHub repository for supply chain compromise, for example by saying: investigate owner/repo for suspicious force-pushes and recover any deleted commits.
