skills.rest
MarbleSodas
MarbleSodasCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

oss-forensics

Recover deleted commits and detect force-pushes in GitHub repositories.

Updated Apr 9, 2026
Search Tags:#supply chain security#incident reporting#github archive#ioc extraction#open-source forensics#force-push detection#evidence registry
One-click install
npx skills add https://github.com/MarbleSodas/Mavis --skill oss-forensics-marblesodas
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/MarbleSodas/Mavis/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/MarbleSodas/Mavis --skill oss-forensics-marblesodas

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

OSS security forensics helps you investigate suspected open-source supply chain compromise by reconstructing activity across time, recovering deleted artifacts, and producing evidence-backed findings you can trust.

Core Features & Use Cases

  • Multi-source evidence collection: Correlates local git analysis, GitHub REST API data, GitHub Archive (BigQuery), and Wayback Machine snapshots into a single investigation workflow.
  • Force-push and deletion recovery: Detects history rewrite indicators and attempts recovery of erased commits and deleted GitHub content.
  • Evidence registry with integrity checks: Records each evidence item with an EV-XXXX ID and SHA-256 integrity, then uses that registry to validate or reject hypotheses.
  • Validated forensic reporting: Generates a structured report with timelines, IOC lists, and chain of custody, while enforcing strict anti-hallucination guardrails.
  • Use Case: Investigate whether a repository was compromised by a suspicious push or workflow change, recover missing traces, extract IOCs, and output a defensible forensic report for remediation and disclosure.

Quick Start

Ask the skill to investigate the target repository and produce a structured forensic report with recovered evidence, validated hypotheses, and a complete IOC list.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover commits deleted by a force-push on GitHub?▼

The workflow detects force-push indicators by cross-referencing local git history, GitHub REST API data, and GitHub Archive snapshots to recover erased commits and generate a structured forensic report with validated evidence.

How does open-source supply chain forensics validate compromise hypotheses?▼

Open-source supply chain forensics validates compromise hypotheses by registering multi-source evidence with EV-XXXX IDs and SHA-256 integrity checks, then matching that registry against suspected supply chain compromise claims.

What is the best way to extract IOCs from a compromised GitHub repository?▼

Extracting IOCs from a compromised repository is best handled by a forensic workflow that cross-references Wayback Machine snapshots and local git analysis to output a defensible report with a complete IOC list and chain of custody.

Can I investigate GitHub repository compromise without local git history?▼

You can investigate GitHub repository compromise without local git history by querying GitHub REST API data, GitHub Archive BigQuery, and Wayback Machine snapshots to reconstruct deleted activity and recover evidence.

Does open-source forensic reporting prevent evidence hallucination?▼

Open-source forensic reporting prevents evidence hallucination by enforcing strict role boundaries per data source and requiring evidence-first citations with EV-XXXX IDs for every claim in the final defensible report output.

When should I not use an evidence registry for supply chain incident reporting?▼

You should avoid using an evidence registry for supply chain incident reporting if you lack access to raw data sources like local git or the GitHub API, because the registry requires SHA-256 integrity checks from collected artifacts to validate hypotheses.

Related Skills

Explore More Legal & Compliance Skills→
AlexiosBluffMaraAlexiosBluffMara
2

oss-forensics

Automate evidence collection and hypothesis validation for GitHub repository forensics.

Community
Advanced
coreymaypraycoreymaypray
1

forensics-investigator

Automate evidence collection, timeline reconstruction, and artifact analysis from memory, disk, log, and network data.

Community
Advanced
Chris-Chai-MinjaeChris-Chai-Minjae

oss-forensics

Coordinate multi-source evidence collection to identify supply-chain attacks in open-source repositories.

Community
Advanced
BagelHoleBagelHole
46

dependency-scanning

Scan project dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check.

Community
Intermediate