oss-forensics

Analyze GitHub repositories for supply chain attacks using git, API, and logs.

1|Updated May 12, 2026

Search Tags:#git #security #github #supply-chain #forensics #incident-response

Ready to run

npx skills add https://github.com/projectedanx/hermes-agent --skill oss-forensics-projectedanx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/projectedanx/hermes-agent/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/projectedanx/hermes-agent --skill oss-forensics-projectedanx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3, jq, git, curl, bq, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill addresses the complexity of investigating open-source supply chain attacks by providing a structured, evidence-based framework to detect compromises, recover deleted history, and validate security hypotheses.

Core Features & Use Cases

Multi-Source Investigation: Correlates data from local git repositories, GitHub API, BigQuery (GitHub Archive), and the Wayback Machine.
Evidence-First Reporting: Enforces strict anti-hallucination guardrails, requiring independent verification for every factual claim.
Use Case: If a repository suddenly force-pushes history or a maintainer account shows anomalous activity, this skill can recover the deleted commits, identify the scope of the compromise, and generate a forensic report with validated indicators of compromise.

Quick Start

Use the oss-forensics skill to investigate the repository owner/repo for potential supply chain compromise.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate a GitHub repository for a supply chain attack?▼

To investigate a GitHub repository for a supply chain attack, you perform multi-phase forensic analysis correlating local git history, GitHub API queries, and BigQuery event logs to reconstruct the incident timeline and validate indicators of compromise.

Can I recover deleted commits after a force-push to git history?▼

Yes, you can recover deleted commits after a force-push to git history by analyzing local repository data and correlating it with web archive snapshots to identify the scope of the compromise and reconstruct missing events.

What data sources are needed to validate open source security incidents?▼

Validating open source security incidents requires correlating data from local git repositories, GitHub API, BigQuery GitHub Archive logs, and Wayback Machine web archive snapshots to ensure evidence-based hypothesis validation.

Does this incident response workflow require specific command line tools?▼

Yes, this incident response workflow requires a specific environment setup including python3, jq, git, curl, and bq to execute multi-source forensic analysis queries and process GitHub repository data.

How do you prevent false positives when detecting repository compromises?▼

To prevent false positives when detecting repository compromises, forensic analysis enforces strict anti-hallucination guardrails requiring independent verification for every factual claim and automated validation of indicators of compromise.