Investigate GitHub supply-chain attacks by collecting evidence and extracting IOCs.
npx skills add https://github.com/devMoez/titan --skill oss-forensics-devmoez
Please help me install this Agent Skill. Skill: oss-forensics Source: https://github.com/devMoez/titan/tree/main/optional-skills/security/oss-forensics Command: npx skills add https://github.com/devMoez/titan --skill oss-forensics-devmoez
It helps you investigate suspected open-source supply-chain compromises by reconstructing what happened in a GitHub repository and producing an evidence-backed forensic report.
Tell the agent: investigate owner/repo for supply-chain compromise and recover any deleted commits, force-push evidence, and IOCs, then generate a structured forensic report.
High-intent search queries and answers about installing and using this skill.
To investigate an open-source supply-chain attack, you need to collect cross-source evidence, extract indicators of compromise (IOCs), and validate hypotheses regarding deleted commits, force-push cover-ups, or workflow injections before generating a structured forensic report.
Yes, you can recover deleted commits or force-push evidence by correlating local git analysis with the GitHub API, Wayback Machine snapshots, and GitHub Archive BigQuery data to reconstruct erased repository activity and establish a chain of custody.
The best way to extract IOCs from a compromised GitHub repository is to apply an evidence-first investigation workflow that identifies suspicious commit SHAs, malicious workflow files, and compromised actor accounts, consolidating them into a final validated report.
Yes, performing advanced OSS forensics typically requires Python3, git, curl, jq, and Google Cloud CLI components like gcloud and bq to query the GitHub Archive on BigQuery and validate multi-source evidence boundaries.
Evidence validation for maintainer takeover signals works by enforcing multi-source boundaries per sub-agent investigation, requiring concrete citations for every claim, and assigning verified Evidence IDs before finalizing the incident reporting output.
Reconstructing CI/CD workflow injection attacks is limited by the availability of historical data from sources like the Wayback Machine and GitHub Archive, as maliciously injected workflow files or force-pushed commits may be permanently erased from the primary repository.
ldzhhxxPerforms forensic analysis of container images and discovers CVEs and hidden content.
dirnbauerGenerate security incident reports using NIST SP 800-61 and SANS-aligned templates.
mazelbReview and optimize Dockerfiles, CI/CD pipelines, Terraform, and Kubernetes manifests.
jmaglyAnalyze software supply chains with SBOM generation, dependency verification, and SLSA mapping.
