CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

github-archive

Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery. Use when verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines. Provides immutable forensic evidence of all public GitHub events since 2011.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

70%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is exceptionally actionable and its workflows are validated and well-sequenced, but it is a monolithic ~900-line document with duplicated queries and narrative padding. Splitting the schema/event-type reference and pattern details into references/ files would substantially improve token efficiency and organization.

Suggestions

Move the Schema Reference (table organization, top-level fields, event-type payload catalog) and Troubleshooting sections into references/ files (e.g., references/schema.md, references/troubleshooting.md), leaving SKILL.md as an overview with one-level-deep, clearly signaled links.

Deduplicate near-identical SQL blocks — the Quick Start query and 'Deleted PRs' Step 1 are the same query restated; point one at the other or keep a single canonical example per pattern.

Trim the long 'Real Example' narrative paragraphs to one-line evidence citations, and condense the five cost-optimization subsections into the comparison table plus the execution template, which already carry the essential guidance.

DimensionReasoningScore

Conciseness

A ~900-line monolithic body contains clearly redundant passages — the Quick Start query is repeated nearly verbatim as "Deleted PRs" Step 1, and each pattern carries a long narrative "Real Example" paragraph — plus multi-section cost exposition that could be tightened. Not 1: most of the material (wrapper semantics, payload JSON paths, cost mechanics) is non-obvious domain knowledge rather than concepts Claude already knows; not 3: the redundancy and padding are substantial, not occasional.

2 / 5

Actionability

Fully executable throughout: copy-paste-ready SQL for every pattern, exact wrapper invocations with flags (--dry-run, --max-bytes-billed, --output), expected outputs, a structured error-code table, and concrete cost thresholds. Specific examples cover the common investigation cases.

5 / 5

Workflow Clarity

The Safe Query Execution Template gives a dry-run → cost-check → capped-execute sequence, with ask-user thresholds, an explicit non-interactive do-not-run fallback, a production checklist, and troubleshooting entries that map each error exit code to a fix (validate → re-size cap → retry). Validation checkpoints and feedback loops are explicit.

5 / 5

Progressive Disclosure

Section headers make the body navigable, but roughly 200+ lines of schema/event-type reference, troubleshooting, and per-pattern details that clearly belong in references/ files are inlined, and no bundle files exist to offload them. Not 2: structure is present and clearly signaled via headers; not 4: the bulk reference material sits in the main file rather than being split out.

3 / 5

Total

15

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: third person, concrete, and explicit about both capability and trigger conditions, with a well-delineated forensic niche. Its only weakness is keyword coverage that stops just short of full synonym breadth.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — "Investigate GitHub security incidents", "verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines" — with comprehensive coverage of the skill's scope. Not 4: no meaningful gaps in the action inventory; not applicable below since every clause names a specific capability.

5 / 5

Completeness

Explicitly answers both: what ("Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery… Provides immutable forensic evidence of all public GitHub events since 2011") and when ("Use when verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines") with concrete trigger phrases.

5 / 5

Trigger Term Quality

Natural user phrases like "GitHub security incidents", "deleted PRs/branches/tags/repos", "attack timelines", and "repository activity" are present. A few natural terms are missing (e.g., "supply chain", "force push", "OSINT", "threat actor"), which the 5 anchor's synonym-level coverage would require.

4 / 5

Distinctiveness Conflict Risk

A clear niche (GitHub security forensics via BigQuery/GitHub Archive) with distinct triggers (deleted PRs/branches/tags/repos, attack timeline reconstruction) and minimal overlap with generic git or GitHub skills.

5 / 5

Total

19

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (927 lines); consider splitting into references/ and linking

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

14

/

16

Passed

Repository

gadievron/raptor

Path

.claude/skills/oss-forensics/github-archive/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.