oss-forensics

Name: oss-forensics
Availability: InStock
Author: entrovyx

Investigate open-source repositories for supply chain attacks using git history and GitHub API events.

3|1|Updated Jul 2, 2026

Search Tags:#git #security #github #supply-chain #forensics #incident-response

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill oss-forensics-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill oss-forensics-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3, gcloud, jq, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill addresses the complexity of investigating open-source supply chain attacks by providing a structured, evidence-based framework to detect compromises, recover deleted history, and validate hypotheses without manual data-gathering overhead.

Core Features & Use Cases

Multi-Source Evidence Collection: Automatically aggregates data from local git, GitHub API, BigQuery (GitHub Archive), and the Wayback Machine.
Forensic Integrity: Maintains a tamper-proof evidence store with SHA-256 verification to ensure all findings are verifiable and audit-ready.
Use Case: If a repository suddenly force-pushes its history, use this skill to recover the deleted commit SHAs, identify the actor, and generate a structured forensic report to determine if a malicious payload was injected.

Quick Start

Use the oss-forensics skill to investigate the repository owner/repo for potential supply chain compromise.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate a git repository for a supply chain attack?▼

Recovering deleted git commits after a force push involves querying GitHub API events and BigQuery archive data to retrieve the original commit SHAs, identify the actor, and determine if a malicious payload was injected into the supply chain.

How does forensic evidence verification work for unauthorized code injections?▼

Validating unauthorized code injection hypotheses requires an evidence-first framework that cryptographically verifies findings from local git, GitHub APIs, and BigQuery archives, ensuring all detected supply chain compromises are documented and audit-ready.

Do I need python3 and gcloud to investigate open-source supply chain compromises?▼

Yes, python3, gcloud, and jq are required dependencies. They provide the necessary environment to execute forensic scripts, query BigQuery GitHub Archive data via gcloud, and parse JSON outputs for supply chain compromise detection.

What is the best way to reconstruct an incident timeline after a repository force-push?▼

Multi-source evidence collection is the best approach, aggregating local git history, GitHub API events, BigQuery GitHub Archive data, and Wayback Machine snapshots to reconstruct incident timelines and validate supply chain attack hypotheses.

Can I use the Wayback Machine to recover deleted GitHub repository history?▼

Yes, the Wayback Machine provides web snapshots that help recover deleted GitHub repository history. Combined with BigQuery archive data and GitHub API events, these snapshots reconstruct incident timelines after a force-push.