---
title: "OSS Security Forensics Skill - Air Market"
description: "Something your software depends on through GitHub may have been tampered with. This helps with the investigation: recovery, pulling out indicators of compromise (the signs an attack leaves behind), a…"
canonical: "https://airmarket.ai/app/oss-forensics"
---

[Air Market](/) / [Security](/category/security) / OSS Security Forensics Skill

Skill by [Nous Research](/@nousresearch)

# OSS Security Forensics Skill

Investigate a GitHub supply-chain incident and report what you find

## What this does

Something your software depends on through GitHub may have been tampered with. This helps with the investigation: recovery, pulling out indicators of compromise (the signs an attack leaves behind), and writing up a report.

### Top 3 things it does for you

- Investigate a supply-chain incident on GitHub
- Recover what I can from the incident
- Pull out indicators of compromise

## Information

**OSS Security Forensics Skill at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [Nous Research](/@nousresearch) |
| Category | [Security](/category/security) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Languages | en |
| Version | 1.0.0 |
| Size | 59 KB |
| Licence | MIT |
| Repository | [NousResearch/hermes-agent](https://github.com/NousResearch/hermes-agent/tree/7113a69248ffe831e4165247553e0f3668c0260a/optional-skills/security/oss-forensics) |
| GitHub stars | 261,931 (as of Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of OSS Security Forensics Skill and flagged nothing. AIR's verdict: **safe**.

**What OSS Security Forensics Skill's check was run against**

|  |  |
| --- | --- |
| Commit | 7113a69248ffe831e4165247553e0f3668c0260a |
| Content hash | eb3c82815f850921810711534159c080b0facb55765001eba92f5a120426d453 |
| Files read | [Browse the files at this exact commit](https://github.com/NousResearch/hermes-agent/blob/7113a69248ffe831e4165247553e0f3668c0260a/optional-skills/security/oss-forensics/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for OSS Security Forensics Skill](/security/oss-forensics)

## About OSS Security Forensics Skill

Forensics for GitHub supply-chain incidents. It covers recovery, indicators of compromise and reporting.

## What's inside

- SKILL.md - instructions
- references/evidence-types.md - reference
- references/github-archive-guide.md - reference
- references/investigation-templates.md - reference
- references/recovery-techniques.md - reference
- scripts/evidence-store.py - script
- templates/forensic-report.md - reference
- templates/malicious-package-report.md - reference

## Questions

### Is OSS Security Forensics Skill safe to install?

AIR scanned this exact version of OSS Security Forensics Skill and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit 7113a69248ff, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/oss-forensics.

### How do I install OSS Security Forensics Skill?

Open https://airmarket.ai/app/oss-forensics on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/NousResearch/hermes-agent/tree/7113a69248ffe831e4165247553e0f3668c0260a/optional-skills/security/oss-forensics. Install from that link, not the branch.

## Related on Air Market

- [More Security listings](/category/security)
- [Everything by Nous Research](/@nousresearch)

---

Canonical URL: <https://airmarket.ai/app/oss-forensics>