oss-forensics

Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories. Covers deleted commit recovery, force-push detection, IOC extraction, multi-source evidence collection, hypothesis formation/validation, and structured forensic reporting. Inspired by RAPTOR's 1800+ line OSS Forensics system.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced forensic workflow with strong validation and feedback loops, undermined only by a missing core template file referenced in multiple phases and minor non-operational padding.

Suggestions

Add the missing templates/forensic-report.md file (or correct the path) — it is referenced in Phase 0, Phase 6, and the Reference Materials section but does not exist in the bundle, which breaks the workflow at initialization.

Trim the non-operational provenance lines ('Adapted from RAPTOR's forensics system', 'Inspired by RAPTOR's 1800+ line OSS Forensics system') to reduce token overhead without losing actionable content.

Dimension	Reasoning	Score
Conciseness	Largely efficient and dense with actionable commands rather than concept explanations, but carries minor padding such as 'Adapted from RAPTOR's forensics system'/'Inspired by RAPTOR's 1800+ line OSS Forensics system' that adds no operational value.	4 / 5
Actionability	Fully executable, copy-paste-ready bash throughout (git clone/fsck/reflog, curl GitHub API, bq query with dry_run) plus concrete evidence-store.py commands and explicit IOC output schemas; placeholders (OWNER/REPO, SHA, YYYYMMDD) are appropriately templated.	5 / 5
Workflow Clarity	A clearly sequenced 8-phase process (Phase 0–7) with explicit validation checkpoints (content_sha256 verification in Phase 3, mechanical hypothesis checks in Phase 5) and a defined feedback loop (rejected hypotheses return to Phase 4, max 3 iterations).	5 / 5
Progressive Disclosure	SKILL.md is a well-signaled overview with one-level-deep links to references/ and scripts/ that all exist, but it repeatedly references ./templates/forensic-report.md (Phase 0 cp, Phase 6 population, Reference Materials) and that templates/ directory and file are absent — a navigation break in an otherwise good structure.	4 / 5
	Total	18 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description with strong action coverage and low conflict risk, but it answers 'what' thoroughly while omitting an explicit 'when to use this' trigger clause.

Suggestions

Add an explicit 'Use when...' clause to the description, e.g. 'Use when investigating a GitHub repository for supply-chain compromise, recovering force-pushed or deleted commits, or extracting IOCs from a suspected attack.'

Include a couple of natural user phrasings as synonyms (e.g. 'was this repo compromised', 'suspicious commit') directly in the description text to lift trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions with comprehensive coverage — 'deleted commit recovery, force-push detection, IOC extraction, multi-source evidence collection, hypothesis formation/validation, and structured forensic reporting' — all anchored to GitHub repositories.	5 / 5
Completeness	The 'what' is clearly and comprehensively stated, but there is no 'Use when...' clause or equivalent explicit trigger guidance in the description field, which per the rubric caps completeness at 3.	3 / 5
Trigger Term Quality	Good natural-term coverage ('supply chain investigation', 'forensic analysis', 'force-push detection', 'IOC extraction', 'deleted commit recovery') that users would actually say, but a few natural synonyms/variations are missing and the domain has no file-extension triggers to round it out.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (open-source supply-chain forensics on GitHub repositories) with distinct triggers and minimal overlap risk against general-purpose skills.	5 / 5
	Total	17 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 2 missing	Warning

	Total	14 / 16 Passed

Repository: NousResearch/hermes-agent
Path: optional-skills/security/oss-forensics/SKILL.md
Commit: d92bfa0

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.