What problem does it solve? When an open-source repository may have been compromised—through maintainer takeover, dependency confusion, force-push history erasure, or CI/CD injection—analysts need a rigorous, evidence-backed way to reconstruct what happened without fabricating claims. ## Core Features & Use Cases - 7-Phase Investigation Framework: Orchestrates up to 5 specialist sub-agents covering local git analysis, GitHub REST API, Wayback Machine, GH Archive/BigQuery, and IOC enrichment, each with strict role boundaries. - Tamper-Evident Evidence Store: A CLI tool records every finding with SHA-256 integrity hashes, chain-of-custody logging, verification states, and Markdown export for reports. - Deleted Content Recovery: Techniques to recover force-pushed commits, deleted issues, PRs, and releases via direct GitHub URLs, the git/commits API, git fetch by SHA, and archive.org snapshots. - Use Case: A maintainer suspects a contributor's account pushed a backdoored workflow file. The skill extracts IOCs, cross-references GH Archive PushEvents against the GitHub API to detect force-pushes, validates hypotheses against cited evidence, and produces a forensic report with a confidence-rated verdict. ## Quick Start Ask the agent to investigate the GitHub repository owner/repo for signs of supply-chain compromise and generate an evidence-backed forensic report.
