oss-forensics

Investigates GitHub supply chain incidents by analyzing commits, IOCs, and multi-source evidence.

Updated Aug 23, 2026

Search Tags:#investigation #github #reporting #evidence #supply-chain #forensics #oss-forensics

Ready to run

npx skills add https://github.com/wwwillott/jobnimbus --skill oss-forensics-wwwillott

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/wwwillott/jobnimbus/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/wwwillott/jobnimbus --skill oss-forensics-wwwillott

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Supply chain investigations for GitHub repositories by coordinating multi-agent forensic workflows, gathering evidence, and producing defensible reports.

Core Features & Use Cases

Phase-based investigation framework for OSS security incidents
Evidence store and cross-source correlation across Git, GH API, Wayback, and GH Archive
Hypothesis formation and validation with structured reporting
Reproducible workflows for forensic investigations and compliance

Quick Start

Initiate an OSS forensics investigation on a target repository by loading the skill and specifying the repository scope.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate deleted commits and force-pushes in a GitHub repository?▼

You can investigate deleted commits and detect force-pushes by loading the skill and specifying the target repository scope to initiate a multi-agent forensic workflow. The process enforces a seven-phase framework that recovers evidence across local git data and the GitHub API.

Can I extract IOCs and correlate evidence across the Wayback Machine and GH Archive for supply chain incidents?▼

Yes, IOC extraction and cross-source evidence correlation are supported across Git, GitHub API, Wayback Machine, and GH Archive. The integrated evidence store enables multi-source analysis to correlate artifacts and validate hypotheses for supply chain investigations.

What is the best way to generate reproducible forensic reports for open-source security incidents?▼

Reproducible forensic reports are generated through structured reporting following hypothesis formation and validation. The seven-phase investigation framework produces defensible executive reports suitable for compliance and forensic workflows.

Does this forensics skill work with local git data and GitHub API sources simultaneously?▼

Yes, the skill coordinates multi-source analysis simultaneously across local git data and the GitHub API. It uses an integrated evidence store to correlate findings from multiple sources into a single reproducible investigation workflow.

When do I need a phase-based investigation framework for OSS security?▼

A phase-based investigation framework is needed when conducting supply chain investigations that require defensible, reproducible workflows. It enforces a structured seven-phase process covering evidence recovery, correlation, and reporting for compliance.

Why does forensic evidence correlation require hypothesis formation during a supply chain investigation?▼

Hypothesis formation and validation structure the forensic analysis to ensure evidence correlates correctly across sources. This process validates findings before generating structured reports, ensuring the investigation remains defensible and reproducible.