How does this skill recover deleted GitHub content?

It queries the public GitHub Archive (GHArchive) dataset on BigQuery, which preserves permanent records of events like PullRequestEvents and IssuesEvents even if the repository or account is deleted.

Why use GitHub Archive instead of the standard GitHub API?

The GitHub Archive provides an immutable forensic record. Unlike the standard API, it can show events from years ago and data that has been deleted or modified by users, making it superior for security investigations.

What credentials are required to use this skill?

You need a Google Cloud Project with the BigQuery API enabled and a Service Account JSON key with BigQuery User permissions.

Is there a cost for querying the GitHub Archive?

Google BigQuery provides a free tier of 1 TB processed per month. Beyond that, queries cost approximately $6.25 per TiB. This skill includes a dry-run feature to estimate costs before you run a query.

GitHub Archive Forensics

Name: GitHub Archive Forensics
Author: gadievron

bygadievron

•

878

•

安全与测试

Conducts forensic security investigations and recovers deleted repository data using tamper-proof GitHub Archive data via BigQuery.

The GitHub Archive Forensics skill empowers security researchers and incident responders to access an immutable record of public GitHub activity dating back to 2011. By interfacing directly with Google BigQuery, it enables the reconstruction of attack timelines, attribution of actions to specific actors, and the recovery of deleted pull requests, issues, and branches that are no longer visible on the GitHub web interface. This skill is an essential tool for verifying claims about repository activity and performing behavioral analysis during security audits or breach investigations, featuring built-in cost estimation to manage BigQuery expenses.

主要功能

01Identify supply chain reconnaissance and automation system compromises

02Perform actor attribution and cross-repository behavioral fingerprinting

03Integrated dry-run cost estimation and budget controls for BigQuery

04Recover deleted pull requests, issues, branches, and tags

05878 GitHub stars

06Reconstruct immutable attack timelines with definitive timestamps

使用场景

01Verifying the accuracy of public incident reports or media claims about code activity

02Investigating a security breach where a threat actor deleted evidence or repositories

03Tracking a specific user's activity patterns across multiple public organizations

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add gadievron/raptor oss-forensics

For use in Claude.ai and ChatGPT

Download Skill