skills.rest
founderphantom
founderphantomCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Correlate git history, GitHub API, archive data, and IOC enrichment to document supply-chain compromise evidence.

Updated Apr 1, 2026
Search Tags:#git#investigation#github#evidence#supply-chain#oss-forensics
One-click install
npx skills add https://github.com/founderphantom/zola-agent --skill oss-forensics-founderphantom
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/founderphantom/zola-agent/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/founderphantom/zola-agent --skill oss-forensics-founderphantom

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Open-source software ecosystems are frequently targeted by supply-chain attacks and stealth compromises. This Skill provides a rigorous, multi-source forensic framework to collect, correlate, and reason about evidence across Git history, GitHub events, archival records, and IOC enrichment to determine if a repository has been compromised and to produce defensible remediation guidance.

Core Features & Use Cases

  • Multi-source evidence gathering across local git data, GitHub REST API responses, GitHub Archive (BigQuery), and Wayback Machine snapshots.
  • Phase-driven investigation workflow including initialization, evidence collection, hypothesis formation, validation, and final reporting.
  • Structured evidence registry with citations, cross-source correlations, and a final forensic report suitable for disclosure and remediation planning.
  • Use Case: Investigate a suspected supply-chain attack in an OSS repository and generate a timeline, validated hypotheses, and actionable mitigations.

Quick Start

Run an OSS forensics investigation against a target repository to begin collecting structured evidence and generate an investigative report.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a suspected open-source supply-chain attack in a GitHub repository?▼

To investigate a supply-chain attack, you must collect and correlate artifacts from git history, GitHub API responses, archive data, and IOC enrichment. This process builds a defensible timeline of compromise and assesses repository risk.

What is the best way to gather forensic evidence from git history for a compromised OSS package?▼

Gathering forensic evidence from git history involves extracting commit logs and metadata to identify unauthorized changes. This data is then correlated with GitHub events and Wayback Machine snapshots to validate compromise hypotheses.

Can I use GitHub Archive data to validate a repository compromise timeline?▼

Yes, GitHub Archive data provides historical event records that can validate a repository compromise timeline. Correlating these archived events with local git artifacts and IOC enrichment ensures cross-source validation of the evidence.

How do you document open-source supply-chain evidence to ensure it is defensible?▼

Documenting defensible supply-chain evidence requires a structured registry where every artifact is cited with specific EV-IDs. This enforces anti-hallucination guardrails and tracks cross-source correlations for the final forensic report.

Does an OSS forensics investigation require IOC enrichment to detect repository compromises?▼

IOC enrichment is a required phase to detect repository compromises, validating hypotheses against known indicators of compromise. It synthesizes git artifacts and GitHub API data to produce a conformant final risk assessment.

What are the limitations of relying solely on git history for a supply-chain investigation?▼

Relying solely on git history limits a supply-chain investigation because local repository data can be manipulated or deleted. A rigorous investigation requires correlating git history with GitHub REST API responses, archive data, and IOC enrichment.

Related Skills

Explore More Software Engineering Skills→
DaddyElonMusk69DaddyElonMusk69

oss-forensics

Investigate GitHub repositories for supply-chain compromise and recover deleted commits.

Community
Advanced
jassicsjassics
6

forensic-triage

Automate forensic triage by collecting disk, memory, and log evidence to build an incident timeline.

Community
Advanced
JKhyroJKhyro

oss-forensics

Reconstruct GitHub repository compromise timelines from git, API, and archive sources.

Community
Advanced
xijunwwxijunww
1

known-product-exploit

Automate identification, exploitation, and post-exploitation of known product vulnerabilities with Nuclei.

Community
Advanced