skills.rest
JamesFincher
JamesFincherCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Investigate GitHub supply-chain compromise using multi-source evidence recovery and IOC extraction.

Updated May 4, 2026
Search Tags:#github#incident response#oss-forensics#evidence reporting#supply-chain security#force push detection#ioc extraction
One-click install
npx skills add https://github.com/JamesFincher/gengar --skill oss-forensics-jamesfincher
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/JamesFincher/gengar/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/JamesFincher/gengar --skill oss-forensics-jamesfincher

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

OSS forensics helps teams determine whether a GitHub repository shows signs of supply-chain compromise by recovering erased activity, extracting IOCs, and producing an evidence-backed incident narrative.

Core Features & Use Cases

  • 7-phase multi-agent investigation: Runs a structured workflow from prompt parsing and IOC extraction through evidence collection, hypothesis validation, and final reporting.
  • Evidence store with integrity checks: Captures findings as SHA-256 hashed evidence items and enforces evidence-first reporting rules.
  • Multi-source recovery and verification: Uses local git analysis, GitHub REST API data, GitHub Archive (BigQuery), and Wayback Machine snapshots to detect force-pushes, deletions, and timeline discrepancies.
  • Defensive, disclosure-oriented output: Produces a forensic report with confidence level, validated hypotheses, IOC registry, chain of custody, and recommended mitigations.

Quick Start

Ask the agent to investigate owner/repo for a possible supply chain attack and generate an evidence-backed forensic report with extracted IOCs.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a GitHub repository for a supply chain compromise?▼

To investigate a GitHub repository for a supply chain compromise, you can orchestrate a multi-source forensic workflow that analyzes local git data, GitHub API, and Wayback Machine snapshots to recover erased evidence and validate security hypotheses.

Can I recover deleted commits after a force push on GitHub?▼

Yes, you can recover deleted commits after a force push on GitHub by cross-referencing local git history, GitHub Archive data, and Wayback Machine snapshots to detect timeline discrepancies and force-erased evidence.

What is OSS forensics and when do I need it?▼

OSS forensics is the process of examining open-source repositories to detect supply-chain attacks, maintainer takeovers, and suspicious commits. You need it when you suspect malicious activity or evidence has been force-erased from a repository.

How do I extract IOCs from a compromised open source repository?▼

You extract IOCs from a compromised open source repository by running a structured investigation workflow that parses suspicious commits, collects multi-source evidence with SHA-256 integrity checks, and outputs a validated IOC registry.

Does GitHub incident response reporting support chain of custody documentation?▼

Yes, GitHub incident response reporting supports chain of custody documentation by capturing findings as SHA-256 hashed evidence items and enforcing evidence-first citation rules to produce a disclosure-oriented forensic report.

What is the best way to detect a maintainer takeover in an open source project?▼

The best way to detect a maintainer takeover in an open source project is to perform multi-source evidence collection across local git, GitHub REST API, and GitHub Archive to identify suspicious commits and timeline discrepancies within defined time windows.

Related Skills

Explore More Software Engineering Skills→
twjarviszyra-webtwjarviszyra-web
3

oss-forensics

Investigate GitHub repositories for compromise and evidence erasure across git history and API data.

Community
Advanced
coreymaypraycoreymaypray
1

forensics-investigator

Automate evidence collection, timeline reconstruction, and artifact analysis from memory, disk, log, and network data.

Community
Advanced
peteromalletpeteromallet
97

oss-forensics

Recover and analyze evidence from GitHub repositories across multiple sources.

Community
Advanced
afel6afel6

oss-forensics

Investigates GitHub repositories for supply-chain compromise and recovers deleted commits.

Community
Advanced