skills.rest
matthew-johnson
matthew-johnsonCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Analyze OSS repositories for supply-chain compromises across multiple data sources.

Updated Apr 20, 2026
Search Tags:#investigation#supply-chain#forensics#oss#evidence-store
One-click install
npx skills add https://github.com/matthew-johnson/hermes-agent --skill oss-forensics-matthew-johnson
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/matthew-johnson/hermes-agent/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/matthew-johnson/hermes-agent --skill oss-forensics-matthew-johnson

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Provides a disciplined framework to investigate open-source supply-chain incidents by collecting diverse evidence, verifying hypotheses, and producing auditable reports.

Core Features & Use Cases

  • 7-phase multi-agent investigation framework for researching OSS supply-chain attacks, including data sources such as GitHub Archive, Wayback Machine, GitHub API, and local git analysis.
  • Evidence-first guardrails: requirement to cite evidence IDs, structured evidence store, and chain-of-custody tracking.
  • Hypothesis formation and validation workflow, with templates and redaction rules for responsible disclosure.
  • Use case: investigate a suspected supply-chain attack in an OSS project by tracing force-push events, deleted issues/PRs, and modified release workflows.
  • Phase-driven execution: prompt parsing, parallel investigation, evidence consolidation, hypothesis validation, and final reporting.

Quick Start

Launch a new OSS forensics investigation by creating a working directory, initializing the evidence store, and loading the forensic report template.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a suspected open-source supply-chain attack?▼

You investigate a supply-chain attack by applying a 7-phase framework that parses prompts, runs parallel investigations across GitHub API and local git, consolidates evidence, validates hypotheses, and generates final auditable reports.

What is force-push analysis in OSS forensics?▼

Force-push analysis in OSS forensics is the process of examining git repository history for unauthorized overwrites to identify supply-chain compromises across a defined time window using local clones and archive services.

Do I need a GitHub API token to investigate deleted issues and PRs?▼

Yes, investigating deleted issues and PRs requires a GitHub API token alongside access to a local clone and archive services like the Wayback Machine to gather evidence for supply-chain compromise analysis.

How do I verify evidence integrity during a supply-chain investigation?▼

You verify evidence integrity during a supply-chain investigation by using a structured evidence store with chain-of-custody tracking and computing SHA-256 integrity checks on all collected data outputs.

Can I analyze modified CI release workflows for indicators of compromise?▼

Yes, you can analyze modified CI release workflows to find indicators of compromise by enriching IOCs across a defined time window using local git analysis and GitHub API data within a multi-phase investigation framework.

What are the limitations of using archive services for supply-chain forensics?▼

A limitation of using archive services for supply-chain forensics is that evidence collection is constrained by the defined time window of available archived data, requiring redaction rules for responsible disclosure during hypothesis validation.

Related Skills

Explore More Data & Analytics Skills→
Tx1207Tx1207
5

project-creator

Create a new project from a template, initialize uv, and configure a local Git repository.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

blue-ir

Structure evidence and construct chronological timelines for incident response triage.

Community
Advanced
menoncellomenoncello
3

deep-research

Automate multi-source research and generate structured business intelligence reports.

Community
Intermediate
AnandaAnugrahHandyantoAnandaAnugrahHandyanto

oss-forensics

Detect supply chain compromises in open-source repositories and produce structured forensic reports.

Community
Advanced