oss-forensics

Recover deleted commits, issues, and PRs from GitHub repositories.

2|1|Updated May 10, 2026
One-click install
npx skills add https://github.com/zli5460/hermes-agent-X-Phoenix-Architecture --skill oss-forensics-zli5460
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/zli5460/hermes-agent-X-Phoenix-Architecture/tree/main/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/zli5460/hermes-agent-X-Phoenix-Architecture --skill oss-forensics-zli5460

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires google-cloud-bigquery, requests, jq, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill enables comprehensive forensic analysis of GitHub repositories to identify signs of supply chain attacks and malicious activity.

Core Features & Use Cases

  • Supply chain investigation: Detect deleted commits, force-pushes, and hidden malicious changes.
  • Evidence recovery: Retrieve deleted issues, PRs, and releases via Wayback Machine and BigQuery.
  • Multisource analysis: Cross-verify findings from local git, GitHub API, web archives, and public datasets.
  • Use Case: A security analyst suspects a malicious commit was force-pushed. This Skill can recover and verify the original commit and analyze associated activity logs.

Quick Start

Provide the suspicious repository URL and last-known malicious commit SHA to begin forensics investigation.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover deleted commits after a force-push on GitHub?

To recover deleted commits after a force-push, you need forensic evidence collection. This Skill retrieves force-pushed and deleted commits by cross-verifying local git data with the GitHub API, Wayback Machine archives, and BigQuery public datasets.

Can I retrieve deleted GitHub issues, PRs, and releases for a security audit?

Yes, you can retrieve deleted GitHub issues, PRs, and releases using evidence recovery techniques. This Skill queries the Wayback Machine and BigQuery to recover deleted content necessary for validating supply chain attack anomalies.

What is open-source supply chain forensic analysis and when do I need it?

Open-source supply chain forensic analysis is the investigation of malicious activity within repository commit histories. You need it to detect hidden changes, recover deleted evidence, and validate security anomalies during a suspected supply chain compromise.

Does this forensic investigation require Google Cloud BigQuery and Wayback Machine access?

Yes, this forensic investigation requires BigQuery and Wayback Machine access to perform multisource analysis. These dependencies enable cross-verification of local git logs and GitHub API data to recover deleted issues, PRs, and force-pushed commits.

How do I investigate a suspicious GitHub repository for hidden malicious changes?

To investigate a suspicious repository for malicious changes, provide the repository URL and last-known malicious commit SHA. This Skill facilitates deep forensic examination by detecting anomalies and enriching indicators of compromise across multiple data sources.

What are the limitations of relying solely on the GitHub API for commit recovery?

Relying solely on the GitHub API for commit recovery limits visibility into force-pushed or deleted historical data. This Skill overcomes this constraint by integrating multisource analysis across local git, web archives, and BigQuery datasets.

Related Skills