Oss Forensics — GitHub supply-chain forensics: recovery, IOCs, reporting
Oss Forensics — GitHub supply-chain forensics: recovery, IOCs, reporting
Start with meaning, then move to detail.
This lesson explains Oss Forensics — GitHub supply-chain forensics: recovery, IOCs, reporting as part of Hermes internals and extension points. You will learn what it does, when it matters, and the smallest safe test that proves it works.
If you are new, do not memorize names. Focus on three questions: what problem does this solve, what access does it need, and how can you verify the result?
For practice, inspect the first example, identify its effects, run it on test data, and compare the result with the source claim.
For advanced readers, inspect Skill metadata, Reference: full SKILL.md, ⚠️ Anti-Hallucination Guardrails, then verify failure modes and version compatibility.
Know Python, Git, and basic project structure before changing code.
A clear outcome before you read.
- Understand Oss Forensics — GitHub supply-chain forensics: recovery, IOCs, reporting without assumed prior knowledge.
- Separate the source description from what still needs testing in your environment.
- Read the first command and identify its inputs and outputs before copying it.
Short definitions before the details.
- Skill
- An instruction bundle that teaches Hermes a repeatable workflow without necessarily adding an external service.
GitHub supply-chain forensics: recovery, IOCs, reporting
What does the source say, and in what order?
- 01Skill metadata
Start here to understand the core idea or structure.
- 02Reference: full SKILL.md
Read this after the foundation, then connect it to the previous step.
- 03⚠️ Anti-Hallucination Guardrails
Read this after the foundation, then connect it to the previous step.
- 04Example Scenarios
Read this after the foundation, then connect it to the previous step.
- 05Phase 0: Initialization
Read this after the foundation, then connect it to the previous step.
- 06Phase 1: Prompt Parsing and IOC Extraction
Read this after the foundation, then connect it to the previous step.
- 07Phase 2: Parallel Evidence Collection
Read this after the foundation, then connect it to the previous step.
- 08Investigator 1: Local Git Investigator
Read this after the foundation, then connect it to the previous step.
- 09Investigator 2: GitHub API Investigator
Read this after the foundation, then connect it to the previous step.
- 10Investigator 3: Wayback Machine Investigator
Finish here to verify the result and special cases.
Copy only after you understand the effect.
mkdir investigation_$(echo "REPO_NAME" | tr '/' '_')
cd investigation_$(echo "REPO_NAME" | tr '/' '_')python3 SKILL_DIR/scripts/evidence-store.py --store evidence.json listcp SKILL_DIR/templates/forensic-report.md ./investigation-report.mdRead the first command and identify its inputs and outputs before copying it.
Match every command to your installed Hermes version, review the files and accounts it can reach, and use non-sensitive data for the first test. If this explanation differs from the source, the official source wins.