skills.rest
peteromallet
peteromalletCOMMUNITY
Explore all skills by this author →
𝕏@peteromalletGitHub

oss-forensics

Recover and analyze evidence from GitHub repositories across multiple sources.

97|8|Updated Mar 20, 2026
Search Tags:#github#supply chain security#incident reporting#oss forensics#force push detection#ioc extraction#evidence correlation
One-click install
npx skills add https://github.com/peteromallet/arnold --skill oss-forensics-peteromallet
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/peteromallet/arnold/tree/main/megaplan/agent/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/peteromallet/arnold --skill oss-forensics-peteromallet

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Supply-chain investigations often require reconstructing what happened in an open-source repository (including deleted or rewritten history) while avoiding evidence fabrication and unsafe local execution.

Core Features & Use Cases

  • Multi-source evidence recovery: Collects and correlates repository history from local git, GitHub REST API, GH Archive/BigQuery, and Wayback Machine.
  • Evidence-first forensic workflow: Produces a structured investigation report where every factual claim is backed by evidence IDs.
  • Forensic hypothesis validation: Forms hypotheses about compromise mechanisms and mechanically validates that cited evidence exists and supports the claim.
  • IOC extraction and enrichment: Tracks indicators such as commit SHAs, actors, workflow files, and other suspicious artifacts, then enriches them using passive public sources.

Quick Start

Run the oss-forensics skill to investigate the target repository for supply chain compromise and generate an evidence-backed forensic report.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover deleted commits or force-pushed history from a GitHub repository?▼

You can recover deleted commits and force-pushed history by correlating data across local git, the GitHub API, GH Archive, and the Wayback Machine. This multi-source approach reconstructs rewritten repository timelines without relying on a single point of failure.

What is the best way to investigate open-source supply chain compromises without fabricating evidence?▼

Open-source supply chain investigation requires an evidence-first workflow with anti-hallucination guardrails. It mechanically validates that every factual claim in the final report is backed by explicit evidence IDs, preventing hallucinated forensic conclusions.

How do I extract IOCs from a compromised open-source repository?▼

IOC extraction tracks indicators like commit SHAs, actors, and workflow files from suspicious repository artifacts. These indicators are then enriched using passive public sources to provide context for supply chain incident reporting.

Can I detect cross-source discrepancies between local git and GitHub Archive data?▼

Yes, cross-source discrepancy detection compares repository history from local git, the GitHub REST API, GH Archive/BigQuery, and the Wayback Machine. Identifying mismatches between these sources exposes hidden or deleted malicious activity.

Does oss-forensics require local execution of suspicious repository code?▼

No, the forensic workflow avoids unsafe local execution of suspicious repository code. It focuses on safely recovering and analyzing repository metadata and history to generate a structured investigation report.

How do I validate forensic hypotheses about a repository compromise mechanism?▼

Forensic hypothesis validation forms theories about compromise mechanisms and mechanically verifies that cited evidence exists and supports the claim. This ensures the structured investigation report contains only verified factual conclusions.

Related Skills

Explore More Software Engineering Skills→
DaddyElonMusk69DaddyElonMusk69

oss-forensics

Investigate GitHub repositories for supply-chain compromise and recover deleted commits.

Community
Advanced
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced
cmaennercmaenner
5

code-review-security

Scan codebases for security vulnerabilities and dependency risks.

Community
Intermediate
zli5460zli5460
2

oss-forensics

Recover deleted commits, issues, and PRs from GitHub repositories.

Community
Advanced