skills.rest
dawsonblock
dawsonblockCOMMUNITY
Explore all skills by this author →
GitHub

github-archive

Query immutable GitHub Archive data in BigQuery for forensic security investigations.

Updated Mar 13, 2026
Search Tags:#investigation#security#github#bigquery#forensics#osint#gharchive
One-click install
npx skills add https://github.com/dawsonblock/OracleOS --skill github-archive-dawsonblock
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: github-archive
Source: https://github.com/dawsonblock/OracleOS/tree/main/Interface/Web/raptor-main/.claude/skills/oss-forensics/github-archive
Command: npx skills add https://github.com/dawsonblock/OracleOS --skill github-archive-dawsonblock

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Investigators need tamper-proof, verifiable evidence of GitHub activity to verify claims, reconstruct incident timelines, and attribute actions across repositories, branches, PRs, and tags.

Core Features & Use Cases

  • Forensic timeline reconstruction across repositories, branches, PRs, issues, and tags using GitHub Archive data.
  • Attribution and verification of events by querying immutable event records with BigQuery.
  • Recovery of deleted or altered content by analyzing historical event streams and payloads.

Quick Start

Query immutable GitHub Archive data via BigQuery to obtain forensic evidence for security investigations.

Frequently Asked Questions about github-archive

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover deleted GitHub repository content for a security investigation?▼

Recover deleted GitHub content by querying immutable GitHub Archive event streams via BigQuery, analyzing historical payloads to reconstruct lost repository data across branches, PRs, and tags.

Can I reconstruct an incident timeline using GitHub Archive data?▼

Reconstruct incident timelines by querying GitHub Archive data in BigQuery with filters on repository, date, and event type to verify activity claims and attribute actions to specific actors.

What is the best way to verify GitHub activity claims during OSINT forensics?▼

Verify GitHub activity claims by analyzing tamper-proof GitHub Archive records in BigQuery, querying immutable event logs to confirm or refute actions across repositories, branches, and issues.

Do I need BigQuery to perform GitHub forensics with this approach?▼

Yes, querying GitHub Archive tables in BigQuery is required to extract forensic evidence, as it provides the immutable event records needed for incident timeline reconstruction and actor attribution.

How do I minimize BigQuery costs when querying GitHub Archive for forensic evidence?▼

Minimize BigQuery costs by applying safe querying practices with strict filters on repo, date, and event type, limiting data exposure and reducing the volume of scanned records during security investigations.

Related Skills

Explore More Data & Analytics Skills→
deonmenezesdeonmenezes
482

github-archive

Query GitHub Archive data in BigQuery to extract forensic evidence for security investigations.

Community
Advanced
duanbiao2000duanbiao2000
3

postmortem-writing

Generate structured postmortem documents with root-cause analysis, timelines, and action items.

Community
Advanced
SnailSploitSnailSploit
2.9k

osint-methodology

Guide structured OSINT investigations from scoping to reporting.

Community
Advanced
sentientspritesentientsprite

alchemy-api

Retrieve on-chain data and monitor real-time events via Alchemy APIs.

Community
Advanced