What problem does it solve? Detecting and proving open-source supply chain attacks is hard because attackers erase evidence through force-pushes, deleted issues, and rewritten git history. This Skill provides a structured 7-phase forensic workflow that recovers deleted commits, cross-references tamper-proof data sources, and produces evidence-backed investigation reports. ## Core Features & Use Cases - Deleted Commit Recovery: Recover force-pushed commits via direct GitHub URLs, the GitHub API, git fsck dangling objects, and Wayback Machine snapshots. - Multi-Source Evidence Collection: Coordinate five specialist investigators covering local git analysis, GitHub REST API, Wayback Machine CDX, GitHub Archive BigQuery, and IOC enrichment. - Hypothesis Validation with Anti-Hallucination Guardrails: Every claim must cite evidence IDs verified against a SHA-256 integrity-checked evidence store before entering the final report. - Use Case: A maintainer suspects a contributor's account was compromised and used to push a backdoored CI workflow. The Skill extracts IOCs, detects force-push events in GH Archive, recovers the erased commit, validates the compromise hypothesis, and generates a forensic report with a chain of custody. ## Quick Start Ask the agent to investigate a GitHub repository for supply chain compromise, for example by saying: investigate owner/repo for a supply chain attack and recover any deleted commits.
