skills.rest
Rheasilvia
RheasilviaCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Analyze GitHub repositories for supply chain attacks and unauthorized code modifications.

Updated Jun 25, 2026
Search Tags:#git#investigation#security#github#supply-chain#forensics
One-click install
npx skills add https://github.com/Rheasilvia/hermes-desktop --skill oss-forensics-rheasilvia
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/Rheasilvia/hermes-desktop/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/Rheasilvia/hermes-desktop --skill oss-forensics-rheasilvia

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and templates (resource) components.

What problem does it solve?

This skill addresses the difficulty of investigating open-source supply chain compromises by providing a structured, evidence-based framework to detect malicious activity, recover deleted history, and validate security hypotheses.

Core Features & Use Cases

  • Multi-Source Evidence Collection: Aggregates data from local git, GitHub API, BigQuery (GitHub Archive), and the Wayback Machine.
  • Forensic Integrity: Uses a dedicated evidence store with SHA-256 verification to ensure all findings are tamper-proof and traceable.
  • Use Case: If a repository maintainer's account is compromised and malicious code is pushed then force-pushed to hide the evidence, this skill recovers the deleted commits and reconstructs the timeline to prove the compromise.

Quick Start

Use the oss-forensics skill to investigate the repository rheasilvia/hermes-desktop for potential supply chain compromise.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a GitHub repository for supply chain attacks?▼

To investigate a GitHub repository for supply chain attacks, perform forensic analysis on local git, GitHub API, BigQuery, and Wayback Machine data to detect unauthorized code modifications, force-pushed commits, and suspicious CI/CD workflow changes.

How does forensic analysis detect unauthorized code modifications in git history?▼

Forensic analysis detects unauthorized code modifications by cross-referencing multiple data sources and applying SHA-256 verification to an evidence store, ensuring recovered force-pushed commits and deleted pull requests are tamper-proof and traceable.

Can I use this to recover deleted pull requests and force-pushed commits on GitHub?▼

Yes, you can recover deleted pull requests and force-pushed commits by pulling historical data from the GitHub Archive via BigQuery and the Wayback Machine, validating the recovered history through an evidence-based framework.

Does the investigation process require any external dependencies or API tokens?▼

The investigation process relies on aggregating data from local git, the GitHub API, BigQuery, and the Wayback Machine, requiring appropriate access credentials for these external data sources to collect and verify evidence.

What is the best way to validate security hypotheses during an open-source compromise investigation?▼

The best way to validate security hypotheses is to use a rigorous evidence-based validation framework with SHA-256 verification, ensuring all findings regarding suspicious CI/CD workflow changes and malicious activity are verified and reproducible.

Related Skills

Explore More Software Engineering Skills→
JuanMS20JuanMS20

github-auth

Configure GitHub authentication for Hermes Agent using git, gh CLI, or SSH credentials.

Community
Intermediate
coreymaypraycoreymaypray
1

forensics-investigator

Automate evidence collection, timeline reconstruction, and artifact analysis from memory, disk, log, and network data.

Community
Advanced
gadievrongadievron
3.5k

github-evidence-kit

Generate verifiable forensic evidence objects from GitHub API, GH Archive, and Wayback Machine sources.

Community
Advanced
UseAI-proUseAI-pro
70

dependency-auditor

Audit npm, pip, and Go dependencies for vulnerabilities and typosquatting.

Official
Advanced