skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Investigate open-source repositories for supply chain attacks using git history and GitHub API events.

3|1|Updated Jul 2, 2026
Search Tags:#git#security#github#supply-chain#forensics#incident-response
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill oss-forensics-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill oss-forensics-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3, gcloud, jq, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill addresses the complexity of investigating open-source supply chain attacks by providing a structured, evidence-based framework to detect compromises, recover deleted history, and validate hypotheses without manual data-gathering overhead.

Core Features & Use Cases

  • Multi-Source Evidence Collection: Automatically aggregates data from local git, GitHub API, BigQuery (GitHub Archive), and the Wayback Machine.
  • Forensic Integrity: Maintains a tamper-proof evidence store with SHA-256 verification to ensure all findings are verifiable and audit-ready.
  • Use Case: If a repository suddenly force-pushes its history, use this skill to recover the deleted commit SHAs, identify the actor, and generate a structured forensic report to determine if a malicious payload was injected.

Quick Start

Use the oss-forensics skill to investigate the repository owner/repo for potential supply chain compromise.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a git repository for a supply chain attack?▼

Recovering deleted git commits after a force push involves querying GitHub API events and BigQuery archive data to retrieve the original commit SHAs, identify the actor, and determine if a malicious payload was injected into the supply chain.

How does forensic evidence verification work for unauthorized code injections?▼

Validating unauthorized code injection hypotheses requires an evidence-first framework that cryptographically verifies findings from local git, GitHub APIs, and BigQuery archives, ensuring all detected supply chain compromises are documented and audit-ready.

Do I need python3 and gcloud to investigate open-source supply chain compromises?▼

Yes, python3, gcloud, and jq are required dependencies. They provide the necessary environment to execute forensic scripts, query BigQuery GitHub Archive data via gcloud, and parse JSON outputs for supply chain compromise detection.

What is the best way to reconstruct an incident timeline after a repository force-push?▼

Multi-source evidence collection is the best approach, aggregating local git history, GitHub API events, BigQuery GitHub Archive data, and Wayback Machine snapshots to reconstruct incident timelines and validate supply chain attack hypotheses.

Can I use the Wayback Machine to recover deleted GitHub repository history?▼

Yes, the Wayback Machine provides web snapshots that help recover deleted GitHub repository history. Combined with BigQuery archive data and GitHub API events, these snapshots reconstruct incident timelines after a force-push.

Related Skills

Explore More Software Engineering Skills→
ldzhhxxldzhhxx
1

oss-forensics

Performs forensic analysis of container images and discovers CVEs and hidden content.

Community
Advanced
HarriesHarries

oss-forensics

Analyze GitHub repositories to detect supply-chain compromises and generate structured forensic reports.

Community
Advanced
projectedanxprojectedanx
1

oss-forensics

Analyze GitHub repositories for supply chain attacks using git, API, and logs.

Community
Advanced
DaddyElonMusk69DaddyElonMusk69

oss-forensics

Investigate GitHub repositories for supply-chain compromise and recover deleted commits.

Community
Advanced