← All skills
oss-forensics
92 / 100 · Low risk
Fine to try.
By Tommy-yw/RunbookHermes (GitHub) · other · 513 stars · scanned at commit 7fd2b9a
Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories.
Covers deleted commit recovery, force-push detection, IOC extraction, multi-source evidence
collection, hypothesis formation/validation, and structured forensic reporting.
Inspired by RAPTOR's 1800+ line OSS Forensics system.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README.
Found in 7 places.
Show 4 more
Sends data to these websites: api.github.com, web.archive.org, github.com
The author does not mention this.
Found in 25 places.
Show 17 more
- optional-skills/security/oss-forensics/SKILL.md, line 169
curl -s "https://api.github.com/repos/OWNER/REPO/contributors" > api_contributors.json - optional-skills/security/oss-forensics/SKILL.md, line 172
curl -s "https://api.github.com/repos/OWNER/REPO/events?per_page=100" > api_events.json - optional-skills/security/oss-forensics/SKILL.md, line 175
curl -s "https://api.github.com/repos/OWNER/REPO/git/commits/SHA" > commit_detail.json - optional-skills/security/oss-forensics/SKILL.md, line 178
curl -s "https://api.github.com/repos/OWNER/REPO/releases?per_page=100" > api_releases.json - optional-skills/security/oss-forensics/SKILL.md, line 181
curl -s "https://api.github.com/repos/OWNER/REPO/commits/SHA" | jq .sha - optional-skills/security/oss-forensics/SKILL.md, line 202
curl -s "https://web.archive.org/cdx/search/cdx?url=github.com/OWNER/REPO&output=json&limit=100&from=YYYYMMDD&to=YYYYMMDD" > wayback_main.json - optional-skills/security/oss-forensics/SKILL.md, line 205
curl -s "https://web.archive.org/cdx/search/cdx?url=github.com/OWNER/REPO/issues/NUM&output=json&limit=50" > wayback_issue_NUM.json - optional-skills/security/oss-forensics/SKILL.md, line 208
curl -s "https://web.archive.org/cdx/search/cdx?url=github.com/OWNER/REPO/pull/NUM&output=json&limit=50" > wayback_pr_NUM.json - optional-skills/security/oss-forensics/SKILL.md, line 215
curl -s "https://web.archive.org/cdx/search/cdx?url=github.com/OWNER/REPO/releases/tag/*&output=json" > wayback_tags.json - optional-skills/security/oss-forensics/SKILL.md, line 218
curl -s "https://web.archive.org/cdx/search/cdx?url=github.com/OWNER/REPO/wiki/*&output=json" > wayback_wiki.json - optional-skills/security/oss-forensics/references/recovery-techniques.md, line 15
curl -s "https://github.com/OWNER/REPO/commit/SHA" - optional-skills/security/oss-forensics/references/recovery-techniques.md, line 18
curl -s "https://github.com/OWNER/REPO/commit/SHA.patch" > recovered_commit.patch - optional-skills/security/oss-forensics/references/recovery-techniques.md, line 21
curl -s "https://github.com/OWNER/REPO/commit/SHA.diff" > recovered_commit.diff - optional-skills/security/oss-forensics/references/recovery-techniques.md, line 24
curl -s "https://github.com/istio/istio/commit/FORCE_PUSHED_SHA.patch" - optional-skills/security/oss-forensics/references/recovery-techniques.md, line 37
curl -s "https://api.github.com/repos/OWNER/REPO/git/commits/SHA" | jq . - optional-skills/security/oss-forensics/references/recovery-techniques.md, line 40
curl -s "https://api.github.com/repos/OWNER/REPO/git/trees/SHA?recursive=1" | jq . - optional-skills/security/oss-forensics/references/recovery-techniques.md, line 43
curl -s "https://api.github.com/repos/OWNER/REPO/contents/PATH?ref=SHA" | jq .content | base64 -d
and 5 more places
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'oss-forensics' ] || [ -L ~/.agents/skills/'oss-forensics' ]; then echo 'A skill folder named oss-forensics already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/Tommy-yw/RunbookHermes' "$d" && git -C "$d" checkout --quiet '7fd2b9a75cf4930491e9af46a93bf4e5b3f3871e' -- 'optional-skills/security/oss-forensics' && mkdir -p ~/.agents/skills && cp -R "$d"/'optional-skills/security/oss-forensics' ~/.agents/skills/'oss-forensics' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'oss-forensics' ~/.claude/skills/'oss-forensics' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for Tommy-yw/RunbookHermes shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/Tommy-yw/RunbookHermes/)
Score history
| Date | Version | Score |
|---|
| 2026-11-14 | 7fd2b9a | 92 |