EXC-Analyzer Documentation

Features

• Repository Analysis: Extracts repository metadata, statistics, language usage, and contributor breakdown.
• User Analysis: Profiles GitHub users, including activity, top repositories, and contribution patterns.
• Secret Scanning: Detects API keys, tokens, and sensitive data in recent commits and files.
• File History: Displays granular commit history for any file in a repository.
• Contributor Impact: Quantifies individual contributor impact based on code changes.
• Security Scoring: Evaluates repository security posture (branch protection, code scanning, etc.).
• Workflow & Content Auditing: Audits repository documentation, policies, and CI/CD workflows for best practices.
• API Key Security: Stores GitHub tokens securely with strict file permissions.

Installation

On Kali Linux / Debian / Ubuntu

Recommended (Global) Installation:

python3 -m pip install --user pipx
python3 -m pipx ensurepath
pipx install exc-analyzer

Alternative (Local/Virtual Environment) Installation:

python3 -m venv env
source env/bin/activate
pip install exc-analyzer

On Windows

pip install exc-analyzer

On macOS

brew install python3
pip3 install exc-analyzer

Quick Start

1. Obtain a GitHub Personal Access Token (instructions).
2. Initialize your API key:
   exc key
3. Run your first analysis:
   exc analysis owner/repo

Note: To avoid issues during analysis, ensure you grant all available permissions to the token. Insufficient permissions may cause errors or incomplete results.

Command Overview

Command	Purpose
key	Manage GitHub API token
analysis <owner/repo>	Analyze repository statistics and health
user-a <username>	Analyze a GitHub user's profile
scan-secrets <owner/repo>	Scan recent commits for secrets
file-history <owner/repo> <file>	Show commit history for a file
dork-scan <query>	Search public code for sensitive patterns
advanced-secrets <owner/repo>	Deep scan for secrets in files and commits
security-score <owner/repo>	Evaluate repository security posture
commit-anomaly <owner/repo>	Detect suspicious commit/PR activity
user-anomaly <username>	Detect unusual user activity
content-audit <owner/repo>	Audit repo docs, policies, and content
actions-audit <owner/repo>	Audit GitHub Actions/CI workflows

Detailed Command Reference

1. API Key Management

• Set or update your GitHub API key:
  exc key
• Reset (delete) your API key:
  exc key --reset
• Storage:
  Linux: ~/.exc/apikey.sec (permissions: 0600)
  Windows: %USERPROFILE%\.exc\apikey.sec

2. Repository Analysis

Analyze repository health, stats, and contributors:

exc analysis owner/repo

Shows description, stars, forks, languages, top committers, contributors, issues, and PRs.

3. User Analysis

exc user-a username

Displays user info, activity, and top repositories.

4. Secret Scanning

exc scan-secrets owner/repo -l 20

Detects AWS keys, GitHub tokens, SSH keys, and generic API keys in the last N commits.

exc advanced-secrets owner/repo -l 30

Scans all files and recent commits for a wide range of secret patterns.

5. File History

exc file-history owner/repo path/to/file.py

Lists commit messages, authors, dates, and links for the file.

6. Dork Scan

exc dork-scan "password filename:.env" -n 20 --ext py --filename config

Supports advanced queries, file extension and filename filters.

7. Contributor Impact

exc contrib-impact owner/repo

Ranks contributors by code additions/deletions.

8. Security Scoring

exc security-score owner/repo

Checks for branch protection, code scanning, dependabot, security.md, and more.

9. Commit/PR Anomaly Detection

exc commit-anomaly owner/repo

Flags risky commit messages and patterns.

10. User Anomaly Detection

exc user-anomaly username

Highlights abnormal event timing or frequency.

11. Content & Workflow Auditing

exc content-audit owner/repo

Checks for LICENSE, SECURITY.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md, and README quality.

exc actions-audit owner/repo

Reviews workflow files for security risks and best practices.

API Key Management

• Your GitHub token is required for all API operations.
• The token is stored securely and never transmitted except to GitHub.
• If you lose or wish to rotate your token, use exc key --reset.

Troubleshooting

• API Rate Limits: If you hit GitHub API rate limits, wait and retry later. Use a personal access token with sufficient permissions.
• Missing Output or Slow Results: Large repositories or high API usage may cause delays. Try reducing the number of results or commit range.
• Color Output Issues: If you do not see colored output, ensure your terminal supports ANSI colors (e.g., use modern terminals on Windows or Linux).
• Permission Errors: Ensure you have write access to your home directory for API key storage.

Disclaimer

This tool is intended for professional security auditing, research, and authorized analysis only. Unauthorized use on systems or repositories you do not own or have explicit permission to analyze is strictly prohibited. The author assumes no liability for misuse or damage caused by this tool.

License

EXC-Analyzer is released under the MIT License. See the LICENSE file for details.