github-archive

The 'github-archive' skill allows users to query immutable GitHub event data through BigQuery, providing tamper-proof forensic evidence for security investigations. This skill enables users to retrieve detailed historical data on GitHub events, including actions like pull requests, issue creation, branch and tag deletions, and repository activity. It serves as a powerful tool for investigating security incidents involving GitHub repositories, enabling security analysts to track and verify the actions of specific actors and events across repositories. GitHub Archive data is particularly valuable because it persists even after content is deleted or modified on the GitHub platform, allowing for the recovery of lost data and enabling timeline reconstruction with definitive timestamps.

Key features of the 'github-archive' skill include the ability to recover deleted pull requests, issues, tags, and branches, track commit SHAs even after repository deletion, and verify claims about GitHub repository activities. It can be used for a variety of purposes, such as building threat actor attribution profiles, verifying repository activity, reconstructing attack timelines, and detecting automation system compromises or supply chain reconnaissance. The skill is designed to provide a ground truth source for investigators, ensuring that the data is reliable and immutable, offering forensic value in a range of security contexts.

Target users of this skill include security researchers, incident response teams, forensics analysts, and anyone involved in investigating GitHub-related security incidents. It is particularly useful for organizations dealing with GitHub-based infrastructure and those who require an auditable, immutable record of events for incident response or legal investigations.