oss-forensics

Detect supply-chain integrity issues and generate forensic reports with auditable evidence.

Updated Apr 27, 2026

Search Tags:#investigation #github #evidence #supply-chain #forensics #oss

Ready to run

npx skills add https://github.com/x-TheFox/Corvus --skill oss-forensics-x-thefox

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/x-TheFox/Corvus/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/x-TheFox/Corvus --skill oss-forensics-x-thefox

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories. Covers deleted commit recovery, force-push detection, IOC extraction, multi-source evidence collection, hypothesis formation/validation, and structured forensic reporting.

Core Features & Use Cases

7-phase multi-agent investigation framework for researching OSS supply chain attacks.
Evidence-driven data collection from GitHub, Git, Wayback Machine, and GH Archive with structured reporting.
Hypothesis templates, chain-of-custody tracking, and final forensic report generation for accountable conclusions.

Quick Start

Start a full OSS forensics investigation against a target repository using the built-in evidence store, templates, and delegated investigators.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate an open source supply chain attack on a GitHub repository?▼

To investigate an open source supply chain attack, you need structured evidence collection from local Git, GitHub API, Wayback Machine, and GH Archive. A multi-agent workflow correlates artifacts, forms testable hypotheses, and validates findings to produce a forensic report with an auditable chain of custody.

How can I recover deleted commits and detect force-pushes in Git?▼

Recovering deleted commits and detecting force-pushes requires deterministic evidence collection from local Git history and GitHub API. By correlating artifacts from multiple sources, you can reconstruct repository integrity issues and document them in a final forensic report.

What is a chain of custody in OSS forensics and when do I need it?▼

A chain of custody in OSS forensics tracks evidence handling and validation steps for repository investigations. You need it when investigating supply chain attacks, extracting IOCs, or recovering deleted commits to ensure accountable, reproducible conclusions in your final forensic report.

Can I extract IOCs from GitHub repositories using Wayback Machine and GH Archive?▼

Yes, extracting IOCs from GitHub repositories uses deterministic evidence collection from the Wayback Machine and GH Archive. Applying a structured investigation framework validates findings against multiple sources before generating a comprehensive forensic report.

What is the best way to document repository integrity issues with reproducible evidence?▼

The best way to document repository integrity issues is applying a multi-agent investigation framework that enforces strict evidence handling. By collecting deterministic artifacts from Git, GitHub API, Wayback Machine, and GH Archive, you generate a reproducible forensic report with an auditable chain of custody.