skills.rest
azaanaliraza
azaanalirazaCOMMUNITY
Explore all skills by this author →
GitHub

oss-forensics

Investigate GitHub repositories for supply chain compromise using multi-source forensic evidence collection.

Updated Apr 18, 2026
Search Tags:#bigquery#incident investigation#supply chain security#commit recovery#force push detection#ioc extraction#github forensics
One-click install
npx skills add https://github.com/azaanaliraza/operarius --skill oss-forensics-azaanaliraza
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-forensics
Source: https://github.com/azaanaliraza/operarius/tree/main/src-tauri/bin/hermes/optional-skills/security/oss-forensics
Command: npx skills add https://github.com/azaanaliraza/operarius --skill oss-forensics-azaanaliraza

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Open-source supply chain attacks are hard to prove: attackers force-push to erase malicious commits, delete issues and PRs, and cover their tracks. This Skill provides a structured 7-phase forensic framework that recovers deleted evidence, cross-verifies findings across independent sources, and produces an evidence-backed investigation report instead of guesswork. ## Core Features & Use Cases - Deleted Evidence Recovery: Recover force-pushed commits via direct GitHub URLs, the Git API, git fsck dangling objects, and Wayback Machine snapshots of deleted issues and PRs. - Multi-Source Parallel Investigation: Coordinate five specialist investigators covering local git analysis, the GitHub REST API, Wayback Machine CDX, GitHub Archive via BigQuery, and IOC enrichment, each with strict role boundaries. - Anti-Hallucination Evidence Discipline: Every claim must cite an evidence ID from a SHA-256 integrity-checked evidence store, and hypotheses are mechanically validated before being accepted. - Use Case: A maintainer suspects a contributor's account was compromised after an unusual release. The Skill extracts IOCs, detects a force-push in GH Archive where distinct_size=0, recovers the erased commit containing a malicious workflow file, and generates a forensic report with a validated compromise hypothesis and remediation steps. ## Quick Start Ask the agent to investigate the GitHub repository owner/repo for signs of supply chain compromise and produce a forensic report.

Frequently Asked Questions about oss-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover a force-pushed commit on GitHub?▼

Force-pushed commits remain on GitHub's servers until garbage collection. Access them directly via github.com/OWNER/REPO/commit/SHA.patch, the /git/commits/SHA API endpoint, or git fetch origin SHA in a local clone. GH Archive PushEvents with distinct_size=0 reveal the erased SHA.

How to detect a supply chain attack in a GitHub repository?▼

Look for force-push events in GH Archive, dangling commits via git fsck, deleted issues or PRs recoverable through the Wayback Machine, unexpected collaborator changes in MemberEvents, and suspicious modifications to CI/CD workflow files. Cross-verify each finding from at least two independent sources.

Does this investigation require Google BigQuery access?▼

No, BigQuery is optional. The GitHub Archive investigator requires gcloud credentials, but if unavailable the other four investigators (local git, GitHub API, Wayback Machine, IOC enrichment) still cover most investigation needs, and the limitation is noted in the report.

What GitHub API rate limits apply during an investigation?▼

Authenticated requests allow 5,000 per hour while unauthenticated requests allow only 60 per hour, which is unusable for investigations. Authenticate with a GITHUB_TOKEN or the gh CLI, use conditional requests, and monitor the X-RateLimit-Remaining header.

Why must every claim in the forensic report cite an evidence ID?▼

The evidence-first rule prevents hallucinated conclusions. Every factual claim must reference an EV-XXXX entry from the SHA-256 integrity-checked evidence store, and the hypothesis validator mechanically rejects any hypothesis citing missing or unverified evidence.

Can this skill analyze private or internal repositories?▼

The framework targets public GitHub data sources such as GH Archive, the Wayback Machine, and the public REST API. Its ethical guidelines prohibit investigating proprietary or internal repositories without authorization, and it is intended for defensive security work only.

Related Skills

Explore More Software Engineering Skills→
GhostPWNGhostPWN
4

Threat Hunting & IOC Analysis

Extract and normalize indicators of compromise from threat reports.

Official
Advanced
irahardiantoirahardianto
150

supply-chain-security

Generate SBOMs, scan dependencies for CVEs, and enforce license compliance.

Community
Intermediate
xalgordxalgord
954

performing-automated-malware-analysis-with-cape

Automates malware analysis using the CAPEv2 sandbox API for behavioral monitoring and config extraction.

Community
Intermediate
GhostPWNGhostPWN
4

Incident Response & Digital Forensics

Create PICERL-aligned incident response playbooks and forensic workflows.

Official
Advanced