oss-forensics

Analyze GitHub repositories for supply chain attacks and unauthorized code modifications.

Updated Jun 17, 2026

Search Tags:#git #investigation #security #github #supply-chain #bigquery #forensics

Ready to run

npx skills add https://github.com/cxnaive/hermes-agent-llbot --skill oss-forensics-cxnaive

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/cxnaive/hermes-agent-llbot/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/cxnaive/hermes-agent-llbot --skill oss-forensics-cxnaive

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3, jq, gcloud, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill addresses the complexity of investigating open-source supply chain attacks by providing a structured, evidence-based framework to detect tampering, unauthorized changes, and malicious injections in GitHub repositories.

Core Features & Use Cases

Multi-Source Evidence Collection: Automatically gathers data from local git history, GitHub API, GitHub Archive (BigQuery), and the Wayback Machine.
Forensic Validation: Implements a 7-phase investigation process with strict anti-hallucination guardrails and hypothesis validation.
Use Case: If a repository suddenly force-pushes history or a maintainer account shows anomalous activity, use this skill to recover deleted commits, identify Indicators of Compromise (IOCs), and generate a verified forensic report.

Quick Start

Use the oss-forensics skill to investigate the repository owner/repo for potential supply chain compromise.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate a GitHub repository for a supply chain attack?▼

To investigate a GitHub repository for a supply chain attack, coordinate multi-agent data collection from git history, GitHub APIs, BigQuery, and web archives to validate security hypotheses and detect unauthorized code modifications.

Can I recover deleted git commits to find indicators of compromise during a security investigation?▼

Yes, recovering deleted git commits helps find indicators of compromise by analyzing anomalous maintainer activity and force-pushed history, automatically gathering evidence from local git and GitHub Archive to extract verified IOCs.

Do I need python3 and gcloud to perform forensic analysis on open-source repositories?▼

Yes, you need python3, gcloud, and jq installed to perform forensic analysis, as the investigation requires querying BigQuery for GitHub Archive data and executing scripts for evidence-based reporting.

What is the best way to detect unauthorized code modifications in an open-source project?▼

The best way to detect unauthorized code modifications is through a 7-phase forensic validation process that enforces strict anti-hallucination guardrails and gathers multi-source evidence to ensure high-confidence security assessments.

Does this supply chain forensics process work with the Wayback Machine for investigating repository tampering?▼

Yes, supply chain forensics works with the Wayback Machine by querying web archives alongside GitHub APIs and BigQuery to recover historical repository states, validating security hypotheses and detecting malicious injections.

Why should I use a hypothesis validation framework for open-source security assessments?▼

Using a hypothesis validation framework for open-source security assessments prevents false positives by enforcing strict evidence-based reporting, coordinating multi-source data collection to extract IOCs and verify unauthorized changes.