Identify GitHub OSS supply chain compromises through multi-source evidence gathering.
npx skills add https://github.com/gqf2008/hermez-ai --skill oss-forensics-gqf2008
Please help me install this Agent Skill. Skill: oss-forensics Source: https://github.com/gqf2008/hermez-ai/tree/main/skills/security/oss-forensics Command: npx skills add https://github.com/gqf2008/hermez-ai --skill oss-forensics-gqf2008
Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories. Covers deleted commit recovery, force-push detection, IOC extraction, multi-source evidence collection, hypothesis formation/validation, and structured forensic reporting.
Use the oss-forensics skill to initialize a multi-source OSS supply chain investigation against a target repository.
High-intent search queries and answers about installing and using this skill.
To investigate deleted commits and force-push history, this Skill recovers missing commits and detects force-push events by accessing the GitHub Archive and Wayback Machine, ensuring evidence-driven analysis of the repository timeline.
Documenting a GitHub supply chain compromise requires gathering multi-source evidence, extracting IOCs, and validating hypotheses. This Skill applies a 7-phase investigation framework to generate a structured forensic report with strict evidence citation.
Forensic reporting handles discovered secrets by applying redaction guardrails during evidence gathering. The final report ensures sensitive data is removed while maintaining the integrity of the cited supply chain attack evidence.
Yes, you can combine local git analysis with GitHub API data. The investigation framework cross-verifies evidence across local repositories, GitHub API, and historical archives to prevent hallucination and validate supply chain attack hypotheses.
You need multi-source evidence collection when investigating suspected OSS security compromises. It allows you to recover deleted commits, extract IOCs, and cross-verify timelines using the Wayback Machine and GitHub Archive for accurate forensic reporting.
NousResearchManage GitHub repositories via gh CLI or REST API.
Q16GOrchestrate incident response workflows across detection, containment, eradication, and recovery.
AradotsoHarden npm, pnpm, and Bun installs against supply-chain attacks.
openeuler-mirrorGenerate atomic Git commits and rebase history with forensic search.
