oss-forensics

Correlate forensic evidence from git, GitHub API, GH Archive, Wayback, and IOC sources.

3|Updated Mar 20, 2026
One-click install
npx skills add https://github.com/ever-oli/io --skill oss-forensics-ever-oli
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/ever-oli/io/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/ever-oli/io --skill oss-forensics-ever-oli

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Coordinate and orchestrate multi-source OSS forensic investigations to determine if a repository experienced a supply-chain incident, gathering evidence, forming hypotheses, and generating a formal report.

Core Features & Use Cases

  • Orchestrates a structured, phase-driven investigation (Initialization, Phase 1 IOC extraction, Phase 2 evidence collection, Phase 3 consolidation, Phase 4 hypothesis validation, Phase 5 final reporting)
  • Aggregates evidence from multiple sources (local git, GitHub API, GH Archive/BigQuery, Wayback Machine, and IOC enrichment)
  • Produces an auditable investigation report with chain-of-custody and evidence citations

Quick Start

Initialize a new OSS-forensics investigation, populate the evidence store, delegate investigators across phases, and generate the final report.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a potential open source supply chain compromise?

To investigate an open source supply chain compromise, orchestrate a multi-source forensic investigation that collects evidence from local git, GitHub API, GH Archive, BigQuery, and Wayback Machine to validate hypotheses and generate a cited report.

What is the best way to collect forensic evidence from a GitHub repository?

Collect forensic evidence by aggregating data across local git history, GitHub API, GH Archive via BigQuery, and Wayback Machine, using an evidence store to maintain chain-of-custody and structured citations.

Can I use BigQuery and GH Archive to investigate a repository's commit history?

Yes, you can use BigQuery and GH Archive to investigate repository commit history. The forensic investigation extracts IOCs and aggregates evidence from these sources alongside local git and the GitHub API to detect supply-chain incidents.

How do I generate an auditable incident report for a compromised package?

Generate an auditable incident report by running a phase-driven investigation that validates hypotheses against an evidence store, producing a final report with clear citations and chain-of-custody details.

Does open source forensic investigation work with Wayback Machine snapshots?

Yes, open source forensic investigation works with Wayback Machine snapshots. It collects historical web data to enrich IOCs and correlate evidence when determining if a repository experienced a supply chain attack.

What are the limitations of multi-agent forensic investigations for OSS?

Multi-agent forensic investigations for OSS depend on data availability and historical retention of external platforms like GitHub API and BigQuery, requiring cross-source verification to validate findings.