What problem does it solve? Determining whether an open-source repository was compromised—via force-pushes, deleted commits, maintainer takeover, or dependency confusion—requires correlating evidence across git history, the GitHub API, the Wayback Machine, and GH Archive, which is tedious and error-prone to do manually. ## Core Features & Use Cases - Multi-Source Evidence Collection: Coordinates five specialist investigators covering local git analysis, GitHub REST API, Wayback Machine CDX, GH Archive BigQuery, and IOC enrichment. - Deleted Commit Recovery: Recovers force-pushed commits via direct patch URLs, BigQuery PushEvent payloads, and git fsck dangling-commit analysis. - Hypothesis Validation with Anti-Hallucination Guardrails: Every claim must cite evidence IDs that are mechanically verified against a SHA256-hashed evidence store before a report is accepted. - Use Case: A team suspects a dependency was swapped after a maintainer account anomaly. The skill extracts IOCs, detects force-push events in BigQuery, recovers the erased commits, validates the compromise hypothesis, and produces a structured forensic report with chain of custody. ## Quick Start Ask the agent to investigate the GitHub repository owner/repo for signs of supply chain compromise and generate a forensic report.
