skills.rest
SethyPagna
SethyPagnaCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Recover deleted commits and reconstruct timelines from open-source repository history.

Updated May 14, 2026
Search Tags:#github#evidence#git history#supply chain#forensics#force push#ioc extraction
One-click install
npx skills add https://github.com/SethyPagna/Secretary-Jarvis --skill oss-forensics-sethypagna
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/SethyPagna/Secretary-Jarvis/tree/main/src/capabilities/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/SethyPagna/Secretary-Jarvis --skill oss-forensics-sethypagna

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps investigate open-source repositories for supply chain compromise, deleted history, suspicious collaborator activity, and other signs of tampering while keeping findings evidence-backed.

Core Features & Use Cases

  • Multi-source investigation: Correlates local git data, GitHub API responses, Wayback Machine snapshots, and GitHub Archive events.
  • History recovery: Finds force-pushes, dangling commits, deleted branches, and missing pull requests or issues.
  • IOC extraction and enrichment: Captures commit SHAs, file paths, accounts, domains, packages, and secrets for follow-up analysis.
  • Structured forensic reporting: Produces a timeline, validated hypotheses, evidence registry, and mitigation recommendations.
  • Use case: Analyze a suspicious repository after a reported compromise and reconstruct what changed, when it changed, and who likely made the change.

Quick Start

Ask the skill to investigate a specific GitHub repository for supply chain compromise and produce an evidence-backed forensic report.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a GitHub repository for supply chain compromise?▼

To investigate open-source repository compromise, you analyze git history by correlating local git data, GitHub API responses, Wayback Machine snapshots, and GitHub Archive events to recover evidence of deleted commits and reconstruct a timeline.

Can I recover deleted commits and evidence after a git force push?▼

Yes, recovering deleted commits after a git force push is possible by finding dangling commits and correlating historical repository snapshots from the Wayback Machine and GitHub Archive to reconstruct the overwritten history and extract evidence.

What is the best way to extract IOCs from a compromised open-source repository?▼

The best way to extract IOCs from a compromised open-source repository is to analyze recovered git history, capturing commit SHAs, file paths, accounts, domains, packages, and secrets into an evidence registry for follow-up analysis.

Does this forensics approach work with the Wayback Machine and GitHub Archive?▼

Yes, this forensics approach works with the Wayback Machine and GitHub Archive, querying both sources to retrieve historical snapshots and event data to validate forensic hypotheses and ensure evidence-backed reporting.

How do I reconstruct a timeline of suspicious collaborator activity in git history?▼

To reconstruct a timeline of suspicious collaborator activity, you correlate local git logs with GitHub API event data and archived issues to validate forensic hypotheses and produce an evidence-backed reporting registry.

What are the limitations of investigating archived GitHub issues for deleted pull requests?▼

Limitations of investigating archived GitHub issues for deleted pull requests include incomplete historical snapshots or missing API data, which can hinder timeline reconstruction and forensic hypothesis validation.

Related Skills

Explore More Software Engineering Skills→
DaddyElonMusk69DaddyElonMusk69

oss-forensics

Investigate GitHub repositories for supply-chain compromise and recover deleted commits.

Community
Advanced
Q16GQ16G
83

emergency-response

Orchestrate incident response workflows across detection, containment, eradication, and recovery.

Community
Advanced
DTMC-marketplaceDTMC-marketplace

python-dependency-safety

Scan Python pip packages against vulnerability databases for security issues.

Official
Intermediate
davpatel605-beepdavpatel605-beep

oss-forensics

Recover deleted commits and analyze GitHub security anomalies for supply chain investigations.

Community
Advanced