oss-forensics

Investigate open-source repositories for deleted commits and force-push detection.

Updated May 11, 2026

Search Tags:#github #forensics #supply chain security #oss #security investigation

Ready to run

npx skills add https://github.com/richardnguyen0715/keep-it-real --skill oss-forensics-richardnguyen0715

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/richardnguyen0715/keep-it-real/tree/main/refer-projects/hermes-agent/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/richardnguyen0715/keep-it-real --skill oss-forensics-richardnguyen0715

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python, git, github-api, wayback-machine, bigquery, scripts/evidence-store.py, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill offers comprehensive tools for investigating and analyzing open-source software, detecting compromises, and mitigating security risks.

Core Features & Use Cases

Supply Chain Investigation: Identifies and analyzes threats within the supply chain of open-source software.
Evidence Recovery: Recovers deleted commits, issues, PRs, and other critical artifacts.
Forensic Analysis: Conducts structured forensic reporting with multiple data sources and cross-verification.
Use Case: If you suspect a security breach in a critical open-source project, this Skill can help identify the scope of the breach, the nature of the attack, and provide a detailed report.

Quick Start

Use the oss-forensics skill to investigate a repository by running the command 'investigate this repository' and provide the target repository details.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate a suspected open-source software supply chain compromise?▼

Open-source supply chain investigation involves analyzing repository artifacts to detect compromises. This Skill recovers deleted commits, issues, and PRs while extracting IOCs to identify the scope and nature of a security breach across your ecosystem.

Can I recover deleted commits and force-pushed changes from a GitHub repository?▼

Recovering deleted commits and force-pushed changes requires local git analysis combined with GitHub API and Wayback Machine access. This Skill detects force-pushes and restores hidden repository artifacts to reconstruct malicious modifications during an investigation.

What data sources do I need for open-source forensic analysis?▼

Effective open-source forensic analysis requires local git, the GitHub API, Wayback Machine, and BigQuery access. Combining these sources enables cross-verification of evidence, hypothesis validation, and comprehensive artifact recovery during security investigations.

How do I extract Indicators of Compromise from an open-source repository?▼

Extracting Indicators of Compromise from a repository involves running forensic scripts that analyze git history and recovered artifacts. This Skill identifies malicious code injections and outputs structured forensic reports detailing the security breach.

Does this forensic investigation tool work with BigQuery and the Wayback Machine?▼

Yes, this forensic investigation tool integrates with BigQuery and the Wayback Machine to recover deleted artifacts and cross-verify evidence. This multi-source approach ensures comprehensive hypothesis validation and structured reporting for security professionals.