skills.rest
JKhyro
JKhyroCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Reconstruct GitHub repository compromise timelines from git, API, and archive sources.

Updated Apr 2, 2026
Search Tags:#github#git history#supply chain#forensics#force push#wayback machine#ioc extraction
One-click install
npx skills add https://github.com/JKhyro/HERMES-AGENT --skill oss-forensics-jkhyro
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/JKhyro/HERMES-AGENT/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/JKhyro/HERMES-AGENT --skill oss-forensics-jkhyro

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps you investigate whether a GitHub repository has been compromised, tampered with, or rewritten to hide suspicious activity, while keeping every conclusion anchored to evidence.

Core Features & Use Cases

  • Repository Forensics: Reconstruct commit history, detect force-pushes, and identify dangling or deleted changes in local git data.
  • Multi-Source Correlation: Cross-check GitHub API data, GitHub Archive events, and Wayback snapshots to spot deletions, rewrites, and permission changes.
  • IOC Handling and Reporting: Extract indicators of compromise, enrich them from passive public sources, validate hypotheses, and generate a structured forensic report.
  • Use Case: Investigate a suspicious open-source repository after a maintainer account anomaly, recover erased commits, and produce an evidence-backed timeline for responders.

Quick Start

Ask this Skill to investigate a GitHub repository for compromise indicators, recover deleted history, and produce an evidence-backed forensic report.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a GitHub repository for a force-push history rewrite?▼

You can investigate a force-push history rewrite by reconstructing commit history and cross-checking local git data with GitHub Archive events to identify dangling commits. This recovers deleted changes and produces an evidence-backed forensic timeline.

What is the best way to recover deleted commits after a supply chain compromise?▼

Recovering deleted commits after a supply chain compromise involves correlating Wayback Machine snapshots and GitHub API data to spot deletions. Multi-source verification anchors recovery efforts to verified evidence and reconstructs the timeline.

Can I extract indicators of compromise from suspicious GitHub releases?▼

Yes, you can extract indicators of compromise from suspicious GitHub releases and CI/CD abuse. The process enriches IOCs from passive public sources, validates hypotheses against multi-source data, and outputs a structured forensic report.

Does this forensic investigation method require access to the Wayback Machine and GitHub Archive?▼

Yes, multi-source correlation requires access to the Wayback Machine and GitHub Archive to spot deleted PRs and permission changes. These sources cross-check local git and GitHub API data to validate hypotheses and reconstruct an evidence-backed timeline.

How do I validate hypotheses when investigating deleted pull requests and issues?▼

You validate hypotheses when investigating deleted pull requests and issues by cross-referencing GitHub API data with Wayback snapshots and GitHub Archive events. Multi-source verification anchors conclusions to evidence within a forensic report with integrity checks.

What are the limitations of reconstructing git history using only local data?▼

Reconstructing git history using only local data limits visibility into deleted PRs and permission changes. Multi-source correlation across GitHub API, GitHub Archive, and Wayback Machine is required to detect erased commits and generate a complete structured forensic report.

Related Skills

Explore More Software Engineering Skills→
AlexiosBluffMaraAlexiosBluffMara
2

oss-forensics

Automate evidence collection and hypothesis validation for GitHub repository forensics.

Community
Advanced
Q16GQ16G
83

emergency-response

Orchestrate incident response workflows across detection, containment, eradication, and recovery.

Community
Advanced
jmaglyjmagly
175

ioc-extraction

Extracts and classifies ICOs from investigatorial source files, mapping them to STIX 2.1 objects.

Community
Advanced
SethyPagnaSethyPagna

oss-forensics

Recover deleted commits and reconstruct timelines from open-source repository history.

Community
Advanced