oss-forensics/orchestration

Orchestrate OSS forensic investigations across public GitHub repositories with phase-driven workflows.

3.5k|556|Updated Oct 17, 2025
One-click install
npx skills add https://github.com/gadievron/raptor --skill oss-forensics-orchestration
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: oss-forensics/orchestration
Source: https://github.com/gadievron/raptor/tree/main/.claude/skills/oss-forensics/orchestration
Command: npx skills add https://github.com/gadievron/raptor --skill oss-forensics-orchestration

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill orchestrates OSS forensic investigations by coordinating specialist agents to collect evidence across public GitHub repositories and OSS projects, accelerating incident discovery and analysis.

Core Features & Use Cases

  • Orchestrates multiple analysts by spawning OSS investigation agents to collect evidence from GH Archive, GitHub API, Wayback, and local repositories in parallel.
  • Enforces a phase-driven workflow: initialization, prompt parsing, parallel evidence collection, hypothesis formation, verification, and final reporting.
  • Use Case: An organization wants to investigate activity on a given OSS repository, understand events, and compile a comprehensive timeline and findings report.

Quick Start

Use the orchestration skill to initialize an OSS forensic investigation by running the Phase 0 init script to prepare the working directory and evidence store. source .venv/bin/activate && python .claude/skills/oss-forensics/github-evidence-kit/scripts/init_investigation.py

Frequently Asked Questions about oss-forensics/orchestration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate OSS repository investigations across GitHub?

Automate OSS investigations by orchestrating specialist agents to collect evidence from GitHub repositories, GitHub Archive, Wayback Machine, and local sources in parallel. Initialize the workflow using the Phase 0 init script, which sets up the working directory and evidence store to begin coordinated evidence collection.

What is a phase-driven workflow for forensic evidence collection?

A phase-driven workflow structures investigations into initialization, prompt parsing, parallel evidence collection, hypothesis formation, verification, and final reporting. This approach enforces traceable outputs like evidence.json and forensic-report.md while enabling parallel task execution across multiple agents.

Can I run parallel evidence collection from multiple OSS sources?

Yes, this orchestration skill spawns multiple analyst agents to collect evidence from GitHub API, GH Archive, Wayback, and local repositories simultaneously. Parallel execution accelerates incident discovery and compiles comprehensive timelines without sequential bottlenecks.

How do I compile findings from an OSS investigation into a forensic report?

After parallel evidence collection and hypothesis verification, the orchestration workflow generates a forensic-report.md with findings and a structured evidence.json file. This completes the phase-driven process and produces traceable, comprehensive documentation of your investigation.

What data sources does OSS forensic orchestration integrate?

This skill integrates GitHub API for repository metadata, GH Archive for historical events, Wayback Machine for snapshot history, and local repository data. It coordinates evidence retrieval across these sources to build a complete investigation profile.