skills.rest
deonmenezes
deonmenezesCOMMUNITY
Explore all skills by this author →
𝕏@DeonMenGitHub

github-archive

Query GitHub Archive data in BigQuery to extract forensic evidence for security investigations.

482|72|Updated Apr 5, 2026
Search Tags:#timeline#investigation#security#github#bigquery#forensics#gharchive
One-click install
npx skills add https://github.com/deonmenezes/mantishack --skill github-archive-deonmenezes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: github-archive
Source: https://github.com/deonmenezes/mantishack/tree/main/.claude/skills/oss-forensics/github-archive
Command: npx skills add https://github.com/deonmenezes/mantishack --skill github-archive-deonmenezes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

In security investigations, validating GitHub activity claims and reconstructing attack timelines can be difficult due to incomplete data or conflicting reports. This Skill provides an immutable source of truth by querying tamper-proof GitHub Archive data via BigQuery to verify events, attribute actions to actors, and reconstruct timelines.

Core Features & Use Cases

  • Forensic evidence: verify actor attribution and event sequences across repositories.
  • Deleted content recovery: reconstruct deleted PRs, issues, tags, and branches from archive data.
  • Cross-repo behavior analysis: compare activity patterns over time to support attribution and incident reconstruction.
  • Timeline reconstruction: piece together attack narratives using preserved events dating back to 2011.

Quick Start

Query gharchive data in BigQuery for a target repository and date range to begin reconstructing a security timeline.

Frequently Asked Questions about github-archive

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reconstruct a security attack timeline using GitHub event history?▼

You can retrieve deleted GitHub content by querying tamper-proof GitHub Archive data via BigQuery, which allows you to reconstruct deleted pull requests, issues, tags, and branches from preserved historical event records.

Do I need BigQuery to analyze GitHub Archive data for forensic investigations?▼

Yes, BigQuery is required because this approach applies SQL-based extraction directly to the payload field within GitHub Archive data, enabling cost-aware querying and evidence assembly for incident reconstruction.

What's the best way to verify actor attribution across multiple GitHub repositories?▼

Verifying actor attribution across multiple repositories is achieved by querying immutable GitHub Archive data via BigQuery to compare cross-repo behavior patterns and validate event sequences for incident reconstruction.

Are there limitations when using BigQuery for GitHub forensics and incident reconstruction?▼

A key limitation when using BigQuery for GitHub forensics is query cost, which requires cost-aware querying strategies during SQL-based extraction to manage expenses while assembling immutable forensic evidence.

Related Skills

Explore More Data & Analytics Skills→
dawsonblockdawsonblock

github-archive

Query immutable GitHub Archive data in BigQuery for forensic security investigations.

Community
Advanced
SherifEldeebSherifEldeeb
5

forensic-reporting

Generate formal forensic reports from investigation findings and evidence.

Community
Advanced
redhat-etredhat-et
1

investigate-incident

Investigate platform incidents by gathering evidence and generating root cause documentation.

Official
Advanced
ccfosccfos
13.2k

n9e-query-alert-events

Retrieve and filter Nightingale alarm events by severity, time range, and tags.

Official
Basic