skills.rest
heysuhas
heysuhasCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

oss-forensics

Investigate GitHub repositories for supply chain attacks and unauthorized code modifications.

2|1|Updated Jul 14, 2026
Search Tags:#git#investigation#security#github#supply-chain#forensics
One-click install
npx skills add https://github.com/heysuhas/hermes_cli --skill oss-forensics-heysuhas
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/heysuhas/hermes_cli/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/heysuhas/hermes_cli --skill oss-forensics-heysuhas

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill addresses the complexity of investigating open-source supply chain attacks by providing a structured, evidence-based framework to detect malicious activity, unauthorized code injection, and history manipulation in GitHub repositories.

Core Features & Use Cases

  • Multi-Source Evidence Collection: Aggregates data from local git analysis, GitHub API, BigQuery (GitHub Archive), and the Wayback Machine.
  • Forensic Validation: Implements a rigorous 7-phase process including IOC extraction, hypothesis formation, and mechanical validation to prevent hallucinations.
  • Use Case: If a repository suddenly force-pushes history or a maintainer account shows anomalous activity, this skill reconstructs the timeline, recovers deleted commits, and generates a formal forensic report.

Quick Start

Use the oss-forensics skill to investigate the repository owner/repo for potential supply chain compromise.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a GitHub repository for supply chain attacks?▼

To investigate a GitHub repository for supply chain attacks, you need to analyze git history, API events, and public archive data to detect unauthorized code modifications. This process requires structured evidence collection and cross-source verification to extract indicators of compromise and validate security hypotheses.

What is the best way to detect unauthorized code injection in open-source projects?▼

Detecting unauthorized code injection in open-source projects requires aggregating data from local git analysis, the GitHub API, BigQuery, and the Wayback Machine. This multi-source evidence collection reconstructs the timeline of malicious activity and recovers deleted commits to identify anomalies.

Can I recover deleted commits after a force-push to detect history manipulation?▼

Yes, you can recover deleted commits after a force-push to detect history manipulation by analyzing git history and public archive data. This reconstructs the commit timeline, identifies unauthorized modifications, and extracts indicators of compromise to validate security hypotheses.

How does forensic validation prevent false positives when analyzing malicious activity?▼

Forensic validation prevents false positives by implementing a rigorous seven-phase process including IOC extraction, hypothesis formation, and mechanical validation. This structured approach ensures cross-source verification from local git, GitHub API, and archive data to maintain report integrity.

What data sources are needed to perform comprehensive forensic investigations on GitHub repositories?▼

Comprehensive forensic investigations on GitHub repositories require aggregating data from local git analysis, the GitHub API, GitHub Archive via BigQuery, and the Wayback Machine. These multi-source inputs enable cross-source verification to detect supply chain attacks and unauthorized modifications.

When do I need to extract indicators of compromise from a maintainer account showing anomalous activity?▼

You need to extract indicators of compromise when a maintainer account shows anomalous activity or a repository suddenly force-pushes history. This forensic process reconstructs the timeline, recovers deleted commits, and generates a formal report to identify potential supply chain compromise.

Related Skills

Explore More Software Engineering Skills→
jleechanorgjleechanorg

oss-forensics

Analyze open-source supply-chain risk in GitHub repositories with multi-source evidence collection.

Official
Advanced
trungdo9trungdo9
3

cti-expert

Automate cyber threat intelligence investigations using OSINT and forensic analysis.

Community
Advanced
DaddyElonMusk69DaddyElonMusk69

oss-forensics

Investigate GitHub repositories for supply-chain compromise and recover deleted commits.

Community
Advanced
SignmanalSignmanal
1

oss-forensics

Investigate GitHub supply chain attacks and generate forensic reports.

Community
Advanced