skills.rest
projectedanx
projectedanxCOMMUNITY
Explore all skills by this author →
𝕏@ALifeInArtifyAIGitHub

oss-forensics

Analyze GitHub repositories for supply chain attacks using git, API, and logs.

1|Updated May 12, 2026
Search Tags:#git#security#github#supply-chain#forensics#incident-response
One-click install
npx skills add https://github.com/projectedanx/hermes-agent --skill oss-forensics-projectedanx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/projectedanx/hermes-agent/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/projectedanx/hermes-agent --skill oss-forensics-projectedanx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3, jq, git, curl, bq, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill addresses the complexity of investigating open-source supply chain attacks by providing a structured, evidence-based framework to detect compromises, recover deleted history, and validate security hypotheses.

Core Features & Use Cases

  • Multi-Source Investigation: Correlates data from local git repositories, GitHub API, BigQuery (GitHub Archive), and the Wayback Machine.
  • Evidence-First Reporting: Enforces strict anti-hallucination guardrails, requiring independent verification for every factual claim.
  • Use Case: If a repository suddenly force-pushes history or a maintainer account shows anomalous activity, this skill can recover the deleted commits, identify the scope of the compromise, and generate a forensic report with validated indicators of compromise.

Quick Start

Use the oss-forensics skill to investigate the repository owner/repo for potential supply chain compromise.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a GitHub repository for a supply chain attack?▼

To investigate a GitHub repository for a supply chain attack, you perform multi-phase forensic analysis correlating local git history, GitHub API queries, and BigQuery event logs to reconstruct the incident timeline and validate indicators of compromise.

Can I recover deleted commits after a force-push to git history?▼

Yes, you can recover deleted commits after a force-push to git history by analyzing local repository data and correlating it with web archive snapshots to identify the scope of the compromise and reconstruct missing events.

What data sources are needed to validate open source security incidents?▼

Validating open source security incidents requires correlating data from local git repositories, GitHub API, BigQuery GitHub Archive logs, and Wayback Machine web archive snapshots to ensure evidence-based hypothesis validation.

Does this incident response workflow require specific command line tools?▼

Yes, this incident response workflow requires a specific environment setup including python3, jq, git, curl, and bq to execute multi-source forensic analysis queries and process GitHub repository data.

How do you prevent false positives when detecting repository compromises?▼

To prevent false positives when detecting repository compromises, forensic analysis enforces strict anti-hallucination guardrails requiring independent verification for every factual claim and automated validation of indicators of compromise.

Related Skills

Explore More Software Engineering Skills→
zkcpkuzkcpku

session-logs

Search and analyze past conversation logs in JSONL files using jq and rg.

Community
Intermediate
camgrimseccamgrimsec
3

oss-forensics-agent

Detect and analyze supply-chain compromise indicators in GitHub repositories.

Community
Advanced
blueskies1818blueskies1818
1

gif-search

Search and download GIFs from the Tenor API using curl and jq.

Community
Basic
SethyPagnaSethyPagna

oss-forensics

Recover deleted commits and reconstruct timelines from open-source repository history.

Community
Advanced