Teknium c30505dddd feat: add OSS Security Forensics skill (Skills Hub) (#1482) ...

* feat: add OSS Security Forensics skill (Skills Hub)

Salvaged from PR #1066 by zagiscoming. Adds a 7-phase multi-agent
investigation framework for GitHub supply chain attack forensics.

Skill contents (optional-skills/security/oss-forensics/):
- SKILL.md: 420-line investigation framework with 8 anti-hallucination
  guardrails, 5 specialist investigators, ethical use guidelines,
  and API rate limiting guidance
- evidence-store.py: CLI evidence manager with add/list/verify/query/
  export/summary + SHA-256 integrity + chain of custody
- references/: evidence types, GH Archive BigQuery guide (expanded with
  12 event types and 6 query templates), recovery techniques (4 methods),
  investigation templates (5 attack patterns)
- templates/: forensic report template (151 lines), malicious package
  report template

Changes from original PR:
- Dropped unrelated core tool changes (delegate_tool.py role parameter,
  AGENTS.md, README.md modifications)
- Removed duplicate skills/security/oss-forensics/ placement
- Fixed github-archive-guide.md (missing from optional-skills/, expanded
  from 33 to 160+ lines with all 12 event types and query templates)
- Added ethical use guidelines and API rate limiting sections
- Rewrote tests to match the v2 evidence store API (12 tests, all pass)

Closes #384

* fix: use python3 and SKILL_DIR paths throughout oss-forensics skill

- Replace all 'python' invocations with 'python3' for portability
  (Ubuntu doesn't ship 'python' by default)
- Replace relative '../scripts/' and '../templates/' paths with
  SKILL_DIR/scripts/ and SKILL_DIR/templates/ convention
- Add path convention note before Phase 0 explaining SKILL_DIR
- Fix double --- separator (cosmetic)
- Applies to SKILL.md, evidence-store.py docstring,
  recovery-techniques.md, and forensic-report.md template

---------

Co-authored-by: zagiscoming <zagiscoming@users.noreply.github.com>

2026-03-15 21:59:53 -07:00

..

acp

…

agent

feat(tools): centralize tool emoji metadata in registry + skin integration

2026-03-15 20:21:21 -07:00

cron

fix(cron): support per-job runtime overrides

2026-03-14 22:22:31 -07:00

fakes

fix: streaming tool call parsing, error handling, and fake HA state mutation

2026-03-14 14:27:20 +03:00

gateway

Merge pull request #1490 from NousResearch/fix/1033-telegram-voice-fallback

2026-03-15 21:58:32 -07:00

hermes_cli

fix(cli): prefer curses over simple_term_menu in setup.py (#1487)

2026-03-15 21:16:21 -07:00

honcho_integration

…

integration

test(voice): add integration tests with real NaCl crypto and Opus codec

2026-03-15 05:20:17 -07:00

skills

fix: persist google oauth pkce for headless auth

2026-03-14 22:11:34 -07:00

tools

fix: restore local STT fallback for gateway voice notes

2026-03-15 21:51:40 -07:00

__init__.py

…

conftest.py

feat: add direct endpoint overrides for auxiliary and delegation

2026-03-14 21:11:37 -07:00

run_interrupt_test.py

…

test_413_compression.py

feat: improve context compaction handoff summaries (#1273)

2026-03-14 02:33:31 -07:00

test_860_dedup.py

…

test_agent_loop_tool_calling.py

…

test_agent_loop_vllm.py

test: restore vllm integration coverage and add dict-args regression

2026-03-15 08:02:29 -07:00

test_agent_loop.py

fix: salvage gateway dedup and executor cleanup from PR #993

2026-03-14 11:03:20 -07:00

test_anthropic_adapter.py

Merge origin/main into hermes/hermes-daa73839

2026-03-14 23:44:47 -07:00

test_anthropic_oauth_flow.py

fix: preflight Anthropic auth and prefer Claude store

2026-03-14 19:38:55 -07:00

test_anthropic_provider_persistence.py

fix: preflight Anthropic auth and prefer Claude store

2026-03-14 19:38:55 -07:00

test_api_key_providers.py

fix: exclude Coding Plan-only models from Moonshot model selection

2026-03-14 20:42:30 -07:00

test_atomic_json_write.py

test: cover atomic temp cleanup on interrupts

2026-03-14 22:31:51 -07:00

test_atomic_yaml_write.py

test: cover atomic temp cleanup on interrupts

2026-03-14 22:31:51 -07:00

test_auth_codex_provider.py

…

test_auth_nous_provider.py

…

test_auxiliary_config_bridge.py

feat: add direct endpoint overrides for auxiliary and delegation

2026-03-14 21:11:37 -07:00

test_batch_runner_checkpoint.py

…

test_cli_approval_ui.py

fix(cli): repair dangerous command approval UI

2026-03-14 11:57:44 -07:00

test_cli_init.py

fix: initialize CLI voice state for single-query mode

2026-03-14 06:31:32 -07:00

test_cli_interrupt_subagent.py

…

test_cli_loading_indicator.py

…

test_cli_mcp_config_watch.py

fix: auto-reload MCP tools when mcp_servers config changes without restart (#1474)

2026-03-15 19:03:34 -07:00

test_cli_model_command.py

…

test_cli_new_session.py

…

test_cli_plan_command.py

fix: save /plan output in workspace (#1381)

2026-03-14 21:28:51 -07:00

test_cli_prefix_matching.py

fix(test): add missing session_id and _pending_input to _make_cli fixture

2026-03-14 10:33:58 -07:00

test_cli_preloaded_skills.py

feat: preload CLI skills on launch (#1359)

2026-03-14 19:33:59 -07:00

test_cli_provider_resolution.py

fix(custom-endpoint): verify /models and suggest working /v1 base URL (#1480)

2026-03-15 20:09:50 -07:00

test_cli_retry.py

test: lock retry replacement semantics

2026-03-14 21:19:22 -07:00

test_cli_secret_capture.py

…

test_cli_skin_integration.py

fix(test): add missing voice state attrs to CLI stub in skin tests

2026-03-14 15:00:45 +03:00

test_codex_execution_paths.py

…

test_codex_models.py

…

test_dict_tool_call_args.py

test: restore vllm integration coverage and add dict-args regression

2026-03-15 08:02:29 -07:00

test_display.py

…

test_evidence_store.py

feat: add OSS Security Forensics skill (Skills Hub) (#1482)

2026-03-15 21:59:53 -07:00

test_external_credential_detection.py

…

test_fallback_model.py

…

test_file_permissions.py

…

test_flush_memories_codex.py

…

test_hermes_state.py

fix(cli): accept session ID prefixes for session actions

2026-03-15 04:01:56 -07:00

test_honcho_client_config.py

…

test_insights.py

…

test_interactive_interrupt.py

…

test_interrupt_propagation.py

…

test_managed_server_tool_support.py

…

test_minisweagent_path.py

…

test_model_provider_persistence.py

…

test_model_tools.py

…

test_openai_client_lifecycle.py

fix: prevent closed OpenAI client reuse across retries

2026-03-14 21:56:00 -07:00

test_personality_none.py

…

test_provider_parity.py

fix: convert anthropic image content blocks

2026-03-14 23:41:20 -07:00

test_quick_commands.py

fix(gateway): support quick commands from GatewayConfig

2026-03-14 03:51:28 -07:00

test_real_interrupt_subagent.py

…

test_reasoning_command.py

…

test_redirect_stdout_issue.py

…

test_resume_display.py

…

test_run_agent_codex_responses.py

…

test_run_agent.py

fix(agent): skip reasoning extra_body for unsupported OpenRouter models (#1485)

2026-03-15 20:42:07 -07:00

test_runtime_provider_resolution.py

fix: restore config-saved custom endpoint resolution

2026-03-14 20:58:12 -07:00

test_setup_model_selection.py

…

test_timezone.py

test(cron): add cross-timezone naive timestamp regression

2026-03-14 10:33:32 -07:00

test_tool_call_parsers.py

fix: use non-greedy regex in DeepSeek V3 parser for multi-tool calls (#1300)

2026-03-14 06:19:28 -07:00

test_toolset_distributions.py

…

test_toolsets.py

…

test_trajectory_compressor.py

fix: harden trajectory compressor summary content handling

2026-03-14 11:03:25 -07:00

test_worktree_security.py

fix: harden salvaged worktree include checks

2026-03-14 21:51:27 -07:00

test_worktree.py

fix: harden salvaged worktree include checks

2026-03-14 21:51:27 -07:00