oss-forensics

Name: oss-forensics
Availability: InStock
Author: Tommy-yw

Investigate open-source supply chain attacks across seven phases using GitHub and BigQuery.

539|39|Updated May 1, 2026

Search Tags:#GitHub #repository analysis #forensics #supply chain security #IOC extraction

Ready to run

npx skills add https://github.com/Tommy-yw/RunbookHermes --skill oss-forensics-tommy-yw

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/Tommy-yw/RunbookHermes/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/Tommy-yw/RunbookHermes --skill oss-forensics-tommy-yw

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pypdf, pdfplumber, pdf2image, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill allows users to perform a detailed investigation and forensic analysis on open-source supply chain repositories to detect, investigate, and mitigate security compromises.

Core Features & Use Cases

Deleted Commit Recovery: Locate deleted commits from the target repository history.
Force-Push Detection: Identify force-push events that could indicate an attempt to rewrite history.
IOC Extraction and Enrichment: Extract and enrich Indicators of Compromise to support investigation.
Hypothesis Formation and Validation: Create hypotheses and validate them with multiple evidence sources.
Forensic Report Generation: Produce structured, verifiable reports that summarize the investigation results.

Quick Start

Run the oss-forensics skill with the repository 'owner/repo' to start the investigation.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate GitHub repository history for deleted commits and force-push events?▼

To investigate deleted commits and force-push events in a GitHub repository, you can run a forensic analysis that recovers missing history and identifies rewritten commits. This multi-agent investigation locates evidence directly from GitHub APIs and local git analysis to detect supply chain compromises.

What is the best way to extract and enrich Indicators of Compromise (IOCs) from an open-source supply chain attack?▼

Extracting and enriching Indicators of Compromise (IOCs) from open-source supply chain attacks involves gathering evidence from repository history and validating it against multiple sources. This forensic process creates structured, verifiable reports to summarize the investigation results.

How does web archive data retrieval work for open-source supply chain forensics?▼

Web archive data retrieval for supply chain forensics works by leveraging BigQuery to analyze historical archives alongside GitHub repository evidence. This method helps validate investigation hypotheses by comparing recovered deleted commits with archived repository states.

Can I use GitHub APIs and local git analysis to detect supply chain vulnerabilities in my repositories?▼

Yes, you can use GitHub APIs and local git analysis to detect supply chain vulnerabilities in your repositories. This forensic investigation requires extensive knowledge of GitHub APIs to recover evidence, identify force-pushes, and generate structured reports on potential compromises.

What steps are involved in a 7-phase open-source supply chain forensic investigation?▼

A 7-phase open-source supply chain forensic investigation involves evidence recovery from GitHub, BigQuery archive analysis, IOC extraction and enrichment, and hypothesis validation. The process concludes with generating structured forensic reports summarizing the detected supply chain vulnerabilities.