oss-forensics

Name: oss-forensics
Availability: InStock
Author: eddielueng

Investigate GitHub repositories for supply chain compromise using multi-source evidence and IOC extraction.

1|Updated Apr 14, 2026

Search Tags:#supply chain security #evidence verification #oss forensics #github archive #force push detection #ioc extraction #deleted commit recovery

Ready to run

npx skills add https://github.com/eddielueng/hermes-agent-zh --skill oss-forensics-eddielueng

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/eddielueng/hermes-agent-zh/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/eddielueng/hermes-agent-zh --skill oss-forensics-eddielueng

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

It helps you determine whether a GitHub repository shows signs of supply chain compromise and reconstructs what happened, even when malicious commits or pages were deleted.

Core Features & Use Cases

Evidence-backed investigation: Runs a structured, multi-phase workflow that collects data, records verifiable evidence IDs, and prevents report claims from being made without citations.
Deleted/rewritten-history recovery: Detects force-push and attempts to recover erased artifacts using GitHub commit access methods and archived sources (GH Archive, GitHub API, and Wayback Machine).
IOC extraction and validation: Extracts and enriches indicators of compromise (commits, files, actors, domains, secrets) and organizes findings into a forensic report with chain-of-custody and hypotheses validation.
Multi-agent, role-bounded collection: Uses specialist sub-agents with strict data-source boundaries (local git vs GitHub API vs Wayback vs BigQuery) to reduce contamination and improve reliability.

Quick Start

Ask the agent to investigate this repository for supply-chain compromise and recover any evidence of deleted or force-pushed malicious activity.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate a GitHub repository for supply chain compromise?▼

Investigate supply chain compromise by running a multi-phase forensic workflow that collects evidence, extracts indicators of compromise, and validates hypotheses using GitHub history and public archives.

Can I recover deleted commits after a force push on GitHub?▼

Recover deleted commits after a force push by detecting rewritten history and retrieving erased artifacts using GitHub commit access methods, the GitHub API, GH Archive, and Wayback Machine.

How does evidence-validated reporting work for OSS forensics?▼

Evidence-validated reporting enforces an evidence-first approach by assigning evidence IDs, maintaining strict per-agent data-source boundaries, and verifying that cited evidence is independently corroborated before concluding compromise.

What is the best way to extract indicators of compromise from a compromised repository?▼

Extract indicators of compromise from a compromised repository using specialist sub-agents that collect and enrich artifacts like malicious commits, files, actors, domains, and secrets into a structured forensic report.

Does OSS forensics work with GitHub workflow injection and actor compromise scenarios?▼

OSS forensics works with workflow injection and actor compromise scenarios by applying repository history analysis and public archive evidence collection to reconstruct incidents and validate security hypotheses.

What are the limitations of recovering deleted GitHub issues and PRs during an investigation?▼

Recovering deleted GitHub issues and PRs depends on whether artifacts were captured by public archives like GH Archive or Wayback Machine before deletion, as force-push cleanup can permanently erase uncached evidence.