What problem does it solve? When a GitHub repository may have been compromised—through maintainer account takeover, dependency confusion, CI/CD injection, or force-pushed history erasure—teams lack a structured way to gather tamper-proof evidence, recover deleted commits, and produce a defensible forensic report. ## Core Features & Use Cases - 7-Phase Investigation Framework: Orchestrates IOC extraction, parallel evidence collection across five specialist investigators (local git, GitHub API, Wayback Machine, GH Archive/BigQuery, IOC enrichment), hypothesis formation, mechanical validation, and report generation. - Deleted Content Recovery: Recovers force-pushed commits via direct GitHub URLs, git fetch by SHA, git fsck dangling objects, and archived snapshots of deleted issues and PRs. - Evidence Store with Chain of Custody: A Python CLI (evidence-store.py) records every finding with SHA-256 integrity hashes, verification states, and a full chain-of-custody log. - Use Case: A maintainer suspects a contributor's account pushed a backdoored workflow file. The skill detects the force-push in GH Archive, recovers the erased commit, validates the compromise hypothesis against multi-source evidence, and outputs a structured forensic report with IOCs and mitigations. ## Quick Start Ask the agent to investigate the GitHub repository owner/repo for signs of supply chain compromise and generate a forensic report.
