github-evidence-kit

Generate, export, load, and verify forensic evidence from GitHub sources. Use when creating verifiable evidence objects from GitHub API, GH Archive, Wayback Machine, local git repositories, or security vendor reports. Handles evidence storage, querying, and re-verification against original sources.

1,014stars119forksUpdated 1/23/2026

#osint #verification #evidence #forensics #github #git

Security Assessment

Medium Risk(65/100)

Detected risks:

Secret Exposure([SKILL.md] private_key)

Sensitive File Access([SKILL.md] .env, [self_improvement_prompt.md] .env)

Security Score65/100

About github-evidence-kit

The github-evidence-kit skill allows users to generate, export, load, and verify forensic evidence from various GitHub-related sources. By leveraging data from the GitHub API, GH Archive, local git repositories, and other security vendor reports, this skill helps in creating verifiable evidence objects. It is designed for use in digital forensics, especially in cases where verification of GitHub activity, commits, pull requests, and issues is crucial. This tool enables the retrieval and verification of both existing and deleted content, offering a comprehensive solution for forensics and evidence validation.

FAQ

How do I collect evidence from a GitHub repository?

You can collect evidence by using the GitHubAPICollector, which allows you to gather information such as commits, pull requests, issues, and releases from a specific repository.

Can I use this skill with local git repositories?

Yes, you can use the LocalGitCollector to collect evidence from local git repositories. It is especially useful for forensic analysis, such as recovering dangling commits or analyzing cloned repositories.

What is GH Archive, and how is it used in this skill?

GH Archive is a public archive of GitHub data stored in BigQuery. The GHArchiveCollector allows you to recover deleted content, such as issues and pull requests, by querying this archive using timestamps.

Are there any prerequisites for using GH Archive data?

Yes, using the GH Archive data requires credentials for accessing BigQuery. Additionally, the timestamp format must be in 'YYYYMMDDHHMM' format to query the events.

Can this skill recover deleted GitHub content?

Yes, the skill can recover deleted GitHub content like issues, pull requests, and commits using the GHArchiveCollector. This feature is useful for forensic investigations where data may have been removed from the live repository.