Agent skill · security · nousresearch
oss-forensics
GitHub supply-chain forensics: recovery, IOCs, reporting.
Why this skill is useful
Adds a comprehensive multi-phase investigation framework with specific procedures and scripts for forensic analysis of GitHub repositories that are not publicly available.
What it needs
Requires git installed locally. About 10k tokens when loaded. Last updated 2026-08-07. 226,679 stars on the source repository.
What this skill does
OSS Security Forensics Skill A 7-phase multi-agent investigation framework for researching open-source supply chain attacks. Adapted from RAPTOR's forensics system. Covers GitHub Archive, Wayback Machine, GitHub API, local git analysis, IOC extraction, evidence-backed hypothesis formation and validation, and final forensic report generation. --- ⚠️ Anti-Hallucination Guardrails Read these before every investigation step. Violating them invalidates the report. 1. Evidence-First Rule: Every claim in any report, hypothesis, or summary MUST cite at least one evidence ID (EV-XXXX). Assertions without citations are forbidden. 2. STAY IN YOUR LANE: Each sub-agent (investigator) has a single data source. Do NOT mix sources. The GH Archive investigator does not query the GitHub API, and vice versa. Role boundaries are hard. 3. Fact vs. Hypothesis Separation: Mark all unverified inferences with [HYPOTHESIS]. Only statements verified against original sources may be stated as facts. 4. No Evidence Fabrication: The hypothesis validator MUST mechanically check that every cited evidence ID actually exists in the evidence store before accepting a hypothesis. 5. Proof-Required Disproval: A hypothesis cannot be dismissed without a specific, evidence-backed counter-argument. "No evidence found" is not sufficient to disprove—it only makes a hypothesis inconclusive. 6. SHA/URL Double-Verification: Any commit SHA, URL, or external identifier cited as evidence must be independently confirmed from at least two sources before being marked as verified. 7. Suspicious Code Rule: Never run code found inside the investigated repository locally. Analyze statically only, or use executecode in a sandboxed environment. 8. Secret Redaction: Any API keys, tokens, or credentials discovered during investigation must be redacted in the final report. Log them internally only. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills nousresearch/oss-forensics