github-archive

Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery. Use when verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines. Provides immutable forensic evidence of all public GitHub events since 2011.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with strong, validated workflows for costly BigQuery operations. Its main weaknesses are length/repetition and a monolithic structure that inlines reference material instead of splitting it into bundle files.

Suggestions

Move the Schema Reference / Event Types payload-field catalog into a references/ file (e.g. references/event-types.md) and link to it from the body to cut the monolithic ~910 lines.

Consolidate the repeated SELECT * / cost-optimization warnings into one section; the current five separate reiterations add length without new information.

Trim the narrative 'Real Example' paragraphs to a one-line citation each, keeping the forensic lesson without the storytelling padding.

Dimension	Reasoning	Score
Conciseness	Mostly useful, non-obvious content (cost mechanics, event-availability caveats, force-push recovery), but the ~910-line body repeats the SELECT * / cost warning across five sections and includes long narrative 'Real Example' paragraphs that could be tightened.	3 / 5
Actionability	Copy-paste-ready SQL and wrapper invocations throughout, with concrete dry-run, execution, and output-envelope examples covering the common investigation cases.	5 / 5
Workflow Clarity	Multi-step patterns are explicitly sequenced (Step 0 availability probe → Step 1 → Step 2) with validation checkpoints, dry-run/cost-gate feedback loops, a maximum_bytes_billed cap, ask-user thresholds, a non-interactive fallback, and a production checklist.	5 / 5
Progressive Disclosure	Section headers and logical flow are good, but the skill is a single ~910-line monolith with ~120 lines of inlined event-type/payload reference material that belongs in a separate file, and no bundle files (references/scripts/assets) exist to offload it.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is third-person, concise, and clearly answers both what the skill does and when to use it with concrete, specific actions. It is highly distinct and trigger-rich, with only minor room to add synonyms like 'OSINT' or 'incident response'.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines' — giving comprehensive, specific capability coverage rather than vague language.	5 / 5
Completeness	Explicitly answers both what ('Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery... Provides immutable forensic evidence') and when ('Use when verifying repository activity claims, recovering deleted PRs/branches/tags/repos...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural keywords a user would say ('GitHub security incidents', 'recovering deleted PRs/branches/tags/repos', 'attack timelines'), but a few adjacent natural terms like 'incident response', 'OSINT', or 'threat intelligence' are absent.	4 / 5
Distinctiveness Conflict Risk	Clear niche (GitHub Archive forensics via BigQuery) with distinct triggers like 'recovering deleted PRs/branches/tags/repos' and 'reconstructing attack timelines' that are unlikely to fire for unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (927 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: gadievron/raptor
Path: .claude/skills/oss-forensics/github-archive/SKILL.md
Commit: a5deef3

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.