skills.rest
80portisfound
80portisfoundCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

oss-forensics

Investigate GitHub repositories for supply chain compromise using multi-source forensic evidence collection.

Updated May 3, 2026
Search Tags:#bigquery#incident investigation#supply chain security#commit recovery#ioc extraction#github forensics#evidence store
One-click install
npx skills add https://github.com/80portisfound/vibe-learning --skill oss-forensics-80portisfound
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/80portisfound/vibe-learning/tree/main/packages/hermes/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/80portisfound/vibe-learning --skill oss-forensics-80portisfound

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Determining whether an open-source repository has been compromised—through force-pushed commits, deleted issues, maintainer account takeover, or malicious dependency injection—requires correlating evidence across git history, GitHub APIs, BigQuery archives, and the Wayback Machine, which is slow and error-prone when done manually. ## Core Features & Use Cases - Multi-Source Evidence Collection: Coordinates five specialist investigators covering local git analysis, GitHub REST API, Wayback Machine CDX, GitHub Archive via BigQuery, and IOC enrichment. - Deleted Content Recovery: Recovers force-pushed commits, deleted PRs, and erased issues using direct SHA fetch, git fsck dangling objects, and archived snapshots. - Evidence-Backed Reporting: Manages a SHA-256 integrity-checked evidence store and generates structured forensic reports with validated hypotheses and chain of custody. - Use Case: When a maintainer suspects a supply chain attack (e.g., a suspicious workflow change or a typosquatted dependency), run a full 7-phase investigation to produce a verdict—Compromised, Clean, or Inconclusive—with cited evidence for every claim. ## Quick Start Ask the agent to investigate the GitHub repository owner/repo for signs of supply chain compromise and produce a forensic report.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate a GitHub repository for supply chain compromise?▼

Run the 7-phase investigation: extract IOCs from the prompt, collect evidence in parallel from local git, GitHub API, Wayback Machine, and BigQuery, then form and validate hypotheses before generating a forensic report. Every claim must cite an evidence ID from the evidence store.

How to recover force-pushed or deleted commits from GitHub?▼

Force-pushed commits remain on GitHub's servers until garbage collection. Recover them via the direct commit URL (github.com/OWNER/REPO/commit/SHA.patch), the GitHub API git/commits endpoint, or git fetch origin SHA in a local clone.

Does the investigation require BigQuery access?▼

No, BigQuery is optional. The GitHub Archive investigator requires Google Cloud credentials, but if unavailable the other four investigators—local git, GitHub API, Wayback Machine, and IOC enrichment—still cover most investigation needs.

What GitHub API rate limits apply during forensic investigations?▼

Authenticated requests allow 5,000 per hour while unauthenticated requests allow only 60 per hour, which is unusable for investigations. Set a GITHUB_TOKEN or use the gh CLI, and monitor the X-RateLimit-Remaining header.

How are forensic hypotheses validated before reporting?▼

A validator mechanically checks that every cited evidence ID exists in the evidence store, that verified evidence was confirmed from two or more independent sources, and that the timeline is logically consistent. Hypotheses are marked VALIDATED, INCONCLUSIVE, or REJECTED.

Related Skills

Explore More Software Engineering Skills→
bitwize-music-studiobitwize-music-studio
408

researchers-security

Compile source-backed security research briefs with citations from vendor advisories and CVE databases.

Official
Advanced
WhaleylawWhaleylaw

security-incident-specialist

Investigate and contain security incidents in production systems.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

phase-1-foundation-weeks-1-4

Enforce pre-commit secrets checks and branch protection across repositories.

Official
Intermediate
kfolkeskfolkes
2

guarddog-security-scan

Scans Python and Node.js packages for malicious code and supply chain attacks.

Community
Intermediate