skills.rest
ZardLi1115
ZardLi1115COMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Correlates Git, GitHub, and web archive evidence to produce forensic reports.

4|Updated May 18, 2026
Search Tags:#github#incident investigation#supply chain security#evidence integrity#oss forensics#ioc extraction#forensic reporting
One-click install
npx skills add https://github.com/ZardLi1115/zedclaw --skill oss-forensics-zardli1115
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/ZardLi1115/zedclaw/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/ZardLi1115/zedclaw --skill oss-forensics-zardli1115

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

It helps you investigate potential supply-chain compromises in GitHub repositories by recovering deleted or rewritten artifacts and building evidence-backed conclusions.

Core Features & Use Cases

  • Multi-source evidence collection: Collects data from local git analysis, GitHub REST API, GH Archive (BigQuery), and Wayback Machine snapshots without mixing data sources within sub-agents.
  • IOC extraction and enrichment: Extracts commit SHAs, suspicious files, actors, and other IOCs, then enriches them using passive public sources.
  • Evidence-integrity forensic workflow: Uses a JSON evidence store with SHA-256 integrity tracking and a required evidence registry for reporting.
  • Hypothesis lifecycle with anti-hallucination guardrails: Forces fact-vs-hypothesis separation, requires evidence IDs for claims, and validates hypotheses by checking referenced evidence exists and is multi-source when needed.
  • Structured forensic reporting: Produces a report with timeline, validated hypotheses, IOC list, chain of custody, and actionable mitigations.

Quick Start

Ask the agent to investigate owner/repo for possible supply-chain compromise and deleted or force-pushed traces.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a suspected open-source supply chain compromise in a GitHub repository?▼

To investigate a suspected open-source supply chain compromise, you need to collect and correlate repository evidence across git history, GitHub APIs, GH Archive BigQuery events, and archived web snapshots to recover deleted artifacts and build evidence-backed conclusions.

Can I recover evidence from force-pushed commits or deleted pull requests on GitHub?▼

Recovering evidence from force-pushed commits or deleted pull requests is possible by analyzing local git history alongside GitHub REST API data and Wayback Machine snapshots to reconstruct rewritten repository artifacts.

How do I extract and enrich IOCs during a GitHub incident investigation?▼

IOC extraction and enrichment during a GitHub incident investigation involves pulling commit SHAs, suspicious files, and actors from repository artifacts, then validating them against passive public sources within a structured forensic workflow.

Does this supply chain security investigation approach prevent hallucinated forensic conclusions?▼

Preventing hallucinated forensic conclusions requires a hypothesis lifecycle with anti-hallucination guardrails that strictly separates fact from hypothesis, mandates evidence-ID citation, and validates claims against multi-source evidence.

How do I maintain evidence integrity when analyzing suspicious CI/CD workflow changes?▼

Maintaining evidence integrity when analyzing suspicious CI/CD workflow changes requires using a JSON evidence store with SHA-256 integrity tracking and a strict evidence registry to ensure an unbroken chain of custody for reporting.

What's the best way to generate a structured forensic report for a compromised open-source repository?▼

Generating a structured forensic report for a compromised open-source repository requires validating hypotheses against collected evidence to produce a final output containing the incident timeline, IOC list, chain of custody, and actionable mitigations.

Related Skills

Explore More Legal & Compliance Skills→
BermudaLocalsBermudaLocals
1

github-auth

Configure GitHub authentication via HTTPS tokens, SSH keys, or gh CLI.

Community
Intermediate
YukiIto1999YukiIto1999

performing-network-traffic-analysis-with-zeek

Deploy Zeek to collect, parse, and analyze network traffic logs.

Community
Advanced
harperaaharperaa
15

dependency-supply-chain-security

Audit Node.js/npm dependency trees for vulnerabilities and supply chain risks.

Community
Intermediate
gadievrongadievron
3.5k

github-evidence-kit

Generate verifiable forensic evidence objects from GitHub API, GH Archive, and Wayback Machine sources.

Community
Advanced