skills.rest
roberttmadsen13-del
roberttmadsen13-delCOMMUNITY
Explore all skills by this author →
GitHub

github-archive

Query GitHub Archive data via BigQuery to extract forensic metadata from event payloads.

Updated Apr 28, 2026
Search Tags:#timeline#investigation#security#github#archive#bigquery#forensics
One-click install
npx skills add https://github.com/roberttmadsen13-del/TOURney --skill github-archive-roberttmadsen13-del
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: github-archive
Source: https://github.com/roberttmadsen13-del/TOURney/tree/main/SKILLS/raptor-main/.claude/skills/oss-forensics/github-archive
Command: npx skills add https://github.com/roberttmadsen13-del/TOURney --skill github-archive-roberttmadsen13-del

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Investigative teams can rely on tamper-proof GitHub Archive data accessed via BigQuery to establish an immutable record of repository activity for security investigations, timeline reconstruction, and attribution, including recovered content that was deleted or hidden from public view.

Core Features & Use Cases

  • Tamper-proof evidence: query GitHub events from GitHub Archive to establish an immutable timeline.
  • Verify and attribute actions: map events to actors across repositories to attribute activity.
  • Reconstruct attack timelines: assemble sequence of pushes, PRs, deletions, and forks to reveal attacker behavior.
  • Recover deleted content: access events and payloads that persist even after deletion of issues, PRs, or repos.
  • Forensic scope: apply across multiple repos and time windows (since 2011) for comprehensive investigations.

Quick Start

Query the GitHub Archive with a targeted actor and repository to verify events and reconstruct a security timeline.

Frequently Asked Questions about github-archive

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover deleted GitHub commits and pull requests for a security investigation?▼

You can reconstruct an attack timeline by querying BigQuery GitHub Archive tables to assemble sequences of pushes, pull requests, deletions, and forks. This reveals attacker behavior across multiple repositories since 2011.

Can I attribute GitHub repository actions to specific actors using historical data?▼

You need to query BigQuery GitHub Archive tables and parse event payloads to extract structured forensic metadata. This allows you to identify and verify security-relevant GitHub activity spanning back to 2011.

Does GitHub Archive data accessed through BigQuery provide tamper-proof evidence for forensics?▼

BigQuery GitHub Archive data supports comprehensive forensic investigations across multiple repositories and time windows since 2011. It allows you to query events, parse payloads, and extract structured metadata for timeline reconstruction.

What is the best way to reconstruct an attack timeline using GitHub event history?▼

GitHub Archive data via BigQuery is ideal for forensic investigations requiring actor attribution, timeline reconstruction, and recovery of deleted content. It is less suited for analyzing private repository activity not captured in public events.

Related Skills

Explore More Data & Analytics Skills→
gadievrongadievron
3.5k

github-archive

Query GitHub Archive data in BigQuery to verify repository activity claims.

Community
Advanced
DCx7C5DCx7C5

canvas-forensic

Generate structured Obsidian Canvas canvases for forensic investigations.

Community
Intermediate
backbay-labsbackbay-labs
285

Threat Hunt

Automate security event investigation and threat hunting workflows.

Official
Advanced
dawsonblockdawsonblock

github-archive

Query immutable GitHub Archive data in BigQuery for forensic security investigations.

Community
Advanced