Analyze GitHub repositories for supply chain attacks using multi-source evidence.
npx skills add https://github.com/icyzh/hermes-web --skill oss-forensics-icyzh
Please help me install this Agent Skill. Skill: oss-forensics Source: https://github.com/icyzh/hermes-web/tree/main/optional-skills/security/oss-forensics Command: npx skills add https://github.com/icyzh/hermes-web --skill oss-forensics-icyzh
This skill provides a structured, evidence-based framework for investigating potential open-source supply chain compromises, ensuring that forensic findings are verifiable and reproducible.
Use the oss-forensics skill to investigate the repository owner/repo for potential supply chain compromise.
High-intent search queries and answers about installing and using this skill.
To investigate a GitHub repository for a supply chain attack, you can run a multi-agent forensic analysis that collects evidence from local git, GitHub API, Wayback Machine, and BigQuery to reconstruct incident timelines and identify Indicators of Compromise.
Yes, you can recover deleted git commits to find evidence of a compromised maintainer account by correlating anomalous repository activity with historical data from the Wayback Machine and GitHub Archive.
The best way to generate verifiable forensic reports for open-source compromises is to enforce strict anti-hallucination guardrails, requiring every claim to be backed by a unique, verifiable evidence ID collected during the investigation.
Yes, BigQuery is used to query the GitHub Archive for anomalous historical events, which helps validate whether force-pushed history in a git repository indicates a potential supply chain compromise.
Evidence-backed hypothesis validation for open-source security incidents works by cross-referencing local git artifacts with external sources like the GitHub API, ensuring every identified Indicator of Compromise is reproducible before generating a structured report.
DaddyElonMusk69Investigate GitHub repositories for supply-chain compromise and recover deleted commits.
projectedanxAnalyze GitHub repositories for supply chain attacks using git, API, and logs.
dawsonblockRecover deleted GitHub content from Wayback Machine and CDX API snapshots.
utsavthakurAudit codebases with static analysis and generate structured risk reports.
