oss-forensics

Name: oss-forensics
Availability: InStock
Author: matlee0409

Analyze OSS-forensics workflows across seven phases to investigate supply-chain incidents.

Updated Aug 27, 2026

Search Tags:#investigation #evidence #hypothesis #forensics #oss-security #gh-archive

Ready to run

npx skills add https://github.com/matlee0409/cronus --skill oss-forensics-matlee0409

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/matlee0409/cronus/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/matlee0409/cronus --skill oss-forensics-matlee0409

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Supply-chain security incidents in open-source software often require coordinated, multi-source forensics to determine what happened, who was involved, and how to prevent recurrence.

Core Features & Use Cases

A seven-phase investigation framework (initialization, data gathering from local git, GitHub API, Wayback Machine, GH Archive, IOC enrichment, evidence consolidation, hypothesis formation/validation, and final reporting) for reproducible security inquiries.
Central evidence store and risk-aware reporting that ensures each claim cites verifiable evidence and supports auditable chain-of-custody.
Cross-source reconciliation for deleted commits, force-push events, deleted issues/PRs, and anomalous workflow activity.

Quick Start

Start an OSS-forensics investigation by creating an investigation workspace, initializing the evidence store, and loading the baseline templates and references as described in SKILL.md.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate open-source supply-chain incidents with deleted commits or force-push erasures?▼

OSS forensics provides a seven-phase investigation framework that reconciles deleted commits and force-push erasures by cross-verifying local git history with GitHub REST API and Wayback Machine data to form evidence-backed hypotheses.

What is the best way to conduct evidence-backed security forensics on compromised GitHub workflows?▼

Security forensics on compromised workflows requires gathering IOC enrichment and consolidating evidence from GH Archive and local git into a central store, ensuring each claim cites verifiable evidence for an auditable chain-of-custody.

Can I recover deleted issues and PRs during a supply-chain security investigation?▼

Supply-chain security investigations can recover context for deleted issues and PRs by querying the GitHub REST API and GH Archive, applying cross-source reconciliation to validate the anomalous activity before generating a formal report.

How do I prevent data leakage and misattribution when analyzing open-source repository incidents?▼

Open-source repository forensics prevents data leakage and misattribution by applying structured guardrails during evidence collection and hypothesis validation, ensuring auditable provenance across all gathered local git and API sources.

Does the OSS forensics framework require specific dependencies to initialize an investigation workspace?▼

The OSS forensics workflow requires no external dependencies to initialize an investigation workspace; it uses built-in scripts and reference templates to establish a central evidence store for gathering local git and API data.

How does cross-source verification work when reconstructing force-push erasure events?▼

Cross-source verification for force-push erasure reconstructs missing git history by gathering evidence from the Wayback Machine and GH Archive, consolidating it with local repository data to validate hypotheses and generate formal reporting.