CtrlK
BlogDocsLog inGet started
Tessl Logo

github-archive

Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery. Use when verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines. Provides immutable forensic evidence of all public GitHub events since 2011.

71

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced forensic skill with executable code and clear validation loops, weakened by monolithic structure and modest verbosity. Splitting the schema reference, cost-optimization guide, and investigation patterns into separate bundled files would lift both conciseness and progressive disclosure.

Suggestions

Move the Event Types Reference and Schema Structure sections into a reference file (e.g., references/SCHEMA.md) and link to it from the body to break up the monolithic document and improve progressive disclosure.

Extract the cost-optimization techniques and investigation patterns into separate files (e.g., references/COST_OPTIMIZATION.md, references/INVESTIGATION_PATTERNS.md), keeping only a concise Quick Start and core principles in SKILL.md.

Trim the extended 'Real Example' narratives to one-line illustrations, since the surrounding executable queries already convey the technique.

DimensionReasoningScore

Conciseness

Mostly dense, actionable reference material, but the ~945-line body includes some inflation Claude could infer (e.g., explaining BigQuery columnar pricing) and lengthy real-example narratives that could be trimmed, so it is efficient but not lean enough for the top anchor.

2 / 3

Actionability

Provides fully executable SQL and Python with concrete table names (githubarchive.day.202506*), real JSON_EXTRACT payload paths, and copy-paste-ready helpers like estimate_gharchive_cost and safe_gharchive_query.

3 / 3

Workflow Clarity

Investigation patterns are sequenced into numbered steps with explicit validation checkpoints and feedback loops — dry-run cost estimation before execution, 'No results → Claim disproven' interpretation, and a production checklist — matching the clear-sequence-with-validation anchor.

3 / 3

Progressive Disclosure

The skill is a single monolithic ~945-line SKILL.md with no references/, scripts/, or assets/ bundle files and no one-level-deep file pointers; well-headed sections provide some structure, but large blocks (event-type schema, cost optimization, investigation patterns) that belong in separate files are all inline.

2 / 3

Total

10

/

12

Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete capabilities, provides an explicit 'Use when' trigger clause, and carves out a clearly distinctive forensic niche. It hits every anchor at the top of the rubric scale.

DimensionReasoningScore

Specificity

The description enumerates multiple concrete actions — 'verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines' — matching the anchor that lists multiple specific concrete actions.

3 / 3

Completeness

It opens with what the skill does ('Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery') and follows with an explicit 'Use when' clause listing triggers, clearly answering both what and when.

3 / 3

Trigger Term Quality

Phrases like 'security incidents', 'repository activity claims', 'deleted PRs/branches/tags/repos', and 'attack timelines' are natural terms a user would say; coverage spans common variations. Voice is third person ('Investigate', 'verifying').

3 / 3

Distinctiveness Conflict Risk

The GitHub Archive + BigQuery forensic-evidence niche is sharply scoped with distinctive triggers (deleted PR/branch/tag/repo recovery, attack-timeline reconstruction) that are unlikely to fire for unrelated skills.

3 / 3

Total

12

/

12

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (960 lines); consider splitting into references/ and linking

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

14

/

16

Passed

Repository
gadievron/raptor
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.