oss-forensics

Collect multi-source evidence from GitHub repositories for OSS supply chain incidents.

Updated Mar 26, 2026

Search Tags:#investigation #github #evidence #supply-chain #forensics #incident-response

Ready to run

npx skills add https://github.com/cloudliness/Hermes-Autonomous-AI-Agent-Dialed-In-For-Windows-11 --skill oss-forensics-cloudliness

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/cloudliness/Hermes-Autonomous-AI-Agent-Dialed-In-For-Windows-11/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/cloudliness/Hermes-Autonomous-AI-Agent-Dialed-In-For-Windows-11 --skill oss-forensics-cloudliness

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

OSS forensics solves the challenge of systematically investigating open-source supply-chain incidents in GitHub repositories by organizing evidence and guiding structured analysis.

Core Features & Use Cases

7-phase, multi-agent investigation framework for researching OSS supply chain attacks.
Evidence registry with chain-of-custody, cross-source correlation, and hypothesis management.
Forensic reporting with redaction guidelines and remediation recommendations.

Quick Start

Initiate an OSS forensics investigation on a target repository using the skill’s evidence store workflow to begin data collection.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate an OSS supply chain incident on GitHub?▼

To investigate an OSS supply chain incident, use a 7-phase multi-agent framework that collects evidence from local Git data, GitHub API, Wayback Machine, and GH Archive to assemble a comprehensive evidence set for hypothesis validation.

What is a multi-agent evidence registry for supply chain forensics?▼

An evidence registry for supply chain forensics is a structured store that records multi-source evidence with hashed integrity, links artifacts to IOCs, and maintains a chain-of-custody for hypothesis validation and final reporting.

Can I use GitHub API and Wayback Machine archives together for incident response?▼

Yes, you can use GitHub API and Wayback Machine archives together for incident response by cross-correlating data across a fixed window of activity to identify and collect evidence related to potential supply chain attacks.

How do I maintain chain-of-custody when collecting forensic evidence from Git repositories?▼

Maintain chain-of-custody by recording all collected evidence with hashed integrity, linking artifacts directly to identified IOCs, and organizing the evidence store to support structured hypothesis validation and final forensic reporting.

What is the best way to structure forensic reporting for an open-source supply chain attack?▼

The best way to structure forensic reporting for an open-source supply chain attack is to use a framework that includes cross-source correlation, hypothesis management, redaction guidelines, and remediation recommendations based on the assembled evidence.

Do I need GH Archive data to analyze a fixed window of GitHub repository activity?▼

You need GH Archive data alongside local Git data, GitHub API, and Wayback Machine archives to comprehensively analyze a fixed window of GitHub repository activity during a potential supply chain incident.