github-archive

Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery. Use when verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines. Provides immutable forensic evidence of all public GitHub events since 2011.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable and well-sequenced with robust validation for expensive batch queries, but the single monolithic file is verbose and repeats SQL patterns, and it under-uses progressive disclosure by inlining reference material that should live in bundle files.

Suggestions

Move the Event Types Reference and Schema Reference into references/ files (e.g. SCHEMA.md, EVENT_TYPES.md) and link to them from a short overview section to reduce the inline footprint.

Consolidate the repeated per-pattern SQL into one parameterized template plus a compact table of per-scenario WHERE filters, instead of re-emitting full queries for each investigation pattern.

Trim the 'Real Example' narratives to one-line citations or move them into a references/CASE_STUDIES.md so the core workflow stays lean.

Dimension	Reasoning	Score
Conciseness	The body is ~900 lines with notable repetition — six investigation patterns each re-emit near-identical full SQL blocks, a ~180-line cost section with expensive/optimized SQL pairs plus a comparison table, and lengthy 'Real Example' narratives — so while much is useful domain knowledge Claude lacks, several sections could be tightened.	3 / 5
Actionability	Fully executable guidance throughout: copy-paste SQL, concrete wrapper invocations ('libexec/raptor-bq-query --query-file query.sql --dry-run'), output envelope formats, and exact troubleshooting exit codes covering the common cases.	5 / 5
Workflow Clarity	Multi-step patterns are explicitly sequenced (Step 1/2/3) with strong validation checkpoints — dry-run estimates, cost thresholds, ask-user gates, --max-bytes-billed caps, a production checklist, and row_count=0 interpretation — plus error-recovery feedback loops via the troubleshooting exit-code table.	5 / 5
Progressive Disclosure	No bundle files exist and all reference material (event-type schema, cost optimization, investigation patterns) is inlined into a single ~900-line SKILL.md; section headers provide structure, but content that clearly belongs in separate reference files is not split out or linked.	3 / 5
	Total	16 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely states both capabilities and explicit 'Use when' triggers with natural synonyms, covering a distinct forensic niche. No changes needed.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines' and 'Provides immutable forensic evidence' — giving comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	Explicitly answers both what ('Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery ... Provides immutable forensic evidence') and when ('Use when verifying repository activity claims, recovering deleted ...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural terms a security analyst would say are well covered with synonyms — 'GitHub security incidents', 'deleted PRs/branches/tags/repos', 'attack timelines', 'repository activity claims', 'attributing actions to actors' — plus the technical anchors 'GitHub Archive' and 'BigQuery'.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (immutable GitHub Archive forensics via BigQuery) with distinct triggers that would not fire for general git or GitHub skills; minimal conflict risk.	5 / 5
	Total	20 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (915 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: gadievron/raptor
Path: .claude/skills/oss-forensics/github-archive/SKILL.md
Commit: 4e75ac9

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.