github-archive

Query GitHub Archive data in BigQuery to extract forensic evidence for security investigations.

482|72|Updated Apr 5, 2026

Search Tags:#timeline #investigation #security #github #bigquery #forensics #gharchive

Ready to run

npx skills add https://github.com/deonmenezes/mantishack --skill github-archive-deonmenezes

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: github-archive
Source: https://github.com/deonmenezes/mantishack/tree/main/.claude/skills/oss-forensics/github-archive
Command: npx skills add https://github.com/deonmenezes/mantishack --skill github-archive-deonmenezes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

In security investigations, validating GitHub activity claims and reconstructing attack timelines can be difficult due to incomplete data or conflicting reports. This Skill provides an immutable source of truth by querying tamper-proof GitHub Archive data via BigQuery to verify events, attribute actions to actors, and reconstruct timelines.

Core Features & Use Cases

Forensic evidence: verify actor attribution and event sequences across repositories.
Deleted content recovery: reconstruct deleted PRs, issues, tags, and branches from archive data.
Cross-repo behavior analysis: compare activity patterns over time to support attribution and incident reconstruction.
Timeline reconstruction: piece together attack narratives using preserved events dating back to 2011.

Quick Start

Query gharchive data in BigQuery for a target repository and date range to begin reconstructing a security timeline.

Frequently Asked Questions about github-archive

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I reconstruct a security attack timeline using GitHub event history?▼

You can retrieve deleted GitHub content by querying tamper-proof GitHub Archive data via BigQuery, which allows you to reconstruct deleted pull requests, issues, tags, and branches from preserved historical event records.

Do I need BigQuery to analyze GitHub Archive data for forensic investigations?▼

Yes, BigQuery is required because this approach applies SQL-based extraction directly to the payload field within GitHub Archive data, enabling cost-aware querying and evidence assembly for incident reconstruction.

What's the best way to verify actor attribution across multiple GitHub repositories?▼

Verifying actor attribution across multiple repositories is achieved by querying immutable GitHub Archive data via BigQuery to compare cross-repo behavior patterns and validate event sequences for incident reconstruction.

Are there limitations when using BigQuery for GitHub forensics and incident reconstruction?▼

A key limitation when using BigQuery for GitHub forensics is query cost, which requires cost-aware querying strategies during SQL-based extraction to manage expenses while assembling immutable forensic evidence.