skills.rest
nadicodeai
nadicodeaiOFFICIAL
Explore all skills by this author →
WebsiteGitHub

oss-forensics

Analyze GitHub repositories for OSS supply-chain compromises using multi-source forensic evidence.

Updated Apr 9, 2026
Search Tags:#timeline#investigation#github#evidence#forensics#risk-analysis#oss
One-click install
npx skills add https://github.com/nadicodeai/argo-agent --skill oss-forensics-nadicodeai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/nadicodeai/argo-agent/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/nadicodeai/argo-agent --skill oss-forensics-nadicodeai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a framework and tooling to conduct open-source forensics on OSS supply chains, enabling structured evidence collection, cross-source correlation, and defensible reporting.

Core Features & Use Cases

  • Phase-driven investigation: multi-agent workflow (local git, GitHub API, Wayback, GH Archive) to locate deletions, force-pushes, IOC extractions, and compromised releases.
  • Evidence-backed reporting: enforces citation requirements, hashes, redaction, and a final forensic report suitable for disclosure.
  • Use Case: A security team investigates a suspected supply-chain compromise in a public repository, collects evidence from multiple sources, validates findings, and publishes a report.

Quick Start

Run the OSS Forensics Skill against a target repository to start evidence collection and hypothesis formation.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a suspected OSS supply-chain compromise on GitHub?▼

OSS supply-chain forensics works by coordinating five investigators to collect and correlate multi-source evidence from local Git, GitHub API, Wayback Machine, and GH Archive, verifying findings within a defined time window before producing a defensible report.

What is the best way to collect forensic evidence after a malicious force-push on a GitHub repository?▼

Collecting forensic evidence after a force-push requires cross-referencing local Git history with GitHub API data and Wayback Machine snapshots to locate deletions and validate compromised releases across multiple sources.

Can I use GH Archive and Wayback Machine data to investigate deleted malicious releases?▼

Yes, you can use GH Archive and Wayback Machine data to investigate deleted releases. The Skill queries both sources alongside local Git and GitHub API data to locate missing artifacts and correlate timeline events for supply-chain risk-analysis.

Do I need any external dependencies or API keys to start a GitHub forensics investigation?▼

No external dependencies are required, as the Skill operates independently using its internal scripts and references to coordinate evidence collection across its five investigators for supply-chain risk-analysis.

How does the evidence verification process work for responsible disclosure?▼

The evidence verification process enforces guardrails requiring citations, hashes, and redaction across all collected data, validating findings before exporting an evidence registry and final forensic report suitable for responsible disclosure.

What are the limitations when investigating historical GitHub repository changes?▼

A limitation when investigating historical GitHub repository changes is that evidence collection and correlation are constrained to a defined time window, meaning events outside the specified investigation period may not be captured by the five investigators.

Related Skills

Explore More Data & Analytics Skills→
JamesFincherJamesFincher

oss-forensics

Investigate GitHub supply-chain compromise using multi-source evidence recovery and IOC extraction.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

blue-ioc-generation

Derive and validate Indicators of Compromise from redacted incident logs.

Community
Advanced
jmaglyjmagly
175

ioc-extraction

Extracts and classifies ICOs from investigatorial source files, mapping them to STIX 2.1 objects.

Community
Advanced
AnandaAnugrahHandyantoAnandaAnugrahHandyanto

oss-forensics

Detect supply chain compromises in open-source repositories and produce structured forensic reports.

Community
Advanced