How does this skill recover deleted GitHub content?

It queries the public GitHub Archive (GHArchive) dataset on BigQuery, which preserves permanent records of events like PullRequestEvents and IssuesEvents even if the repository or account is deleted.

Why use GitHub Archive instead of the standard GitHub API?

The GitHub Archive provides an immutable forensic record. Unlike the standard API, it can show events from years ago and data that has been deleted or modified by users, making it superior for security investigations.

What credentials are required to use this skill?

You need a Google Cloud Project with the BigQuery API enabled and a Service Account JSON key with BigQuery User permissions.

Is there a cost for querying the GitHub Archive?

Google BigQuery provides a free tier of 1 TB processed per month. Beyond that, queries cost approximately $6.25 per TiB. This skill includes a dry-run feature to estimate costs before you run a query.

GitHub Archive Forensics

Name: GitHub Archive Forensics
Author: gadievron

bygadievron

•

878

安全与测试

Conducts forensic security investigations and recovers deleted repository data using tamper-proof GitHub Archive data via BigQuery.

关于

The GitHub Archive Forensics skill empowers security researchers and incident responders to access an immutable record of public GitHub activity dating back to 2011. By interfacing directly with Google BigQuery, it enables the reconstruction of attack timelines, attribution of actions to specific actors, and the recovery of deleted pull requests, issues, and branches that are no longer visible on the GitHub web interface. This skill is an essential tool for verifying claims about repository activity and performing behavioral analysis during security audits or breach investigations, featuring built-in cost estimation to manage BigQuery expenses.

主要功能

Identify supply chain reconnaissance and automation system compromises
Perform actor attribution and cross-repository behavioral fingerprinting
Integrated dry-run cost estimation and budget controls for BigQuery
Recover deleted pull requests, issues, branches, and tags
878 GitHub stars
Reconstruct immutable attack timelines with definitive timestamps

使用场景

Verifying the accuracy of public incident reports or media claims about code activity
Investigating a security breach where a threat actor deleted evidence or repositories
Tracking a specific user's activity patterns across multiple public organizations

关于

主要功能

Identify supply chain reconnaissance and automation system compromises
Perform actor attribution and cross-repository behavioral fingerprinting
Integrated dry-run cost estimation and budget controls for BigQuery
Recover deleted pull requests, issues, branches, and tags
878 GitHub stars
Reconstruct immutable attack timelines with definitive timestamps

使用场景

Verifying the accuracy of public incident reports or media claims about code activity
Investigating a security breach where a threat actor deleted evidence or repositories
Tracking a specific user's activity patterns across multiple public organizations