Agent skill · security · davila7
security-ownership-map
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.
Why this skill is useful
Adds a comprehensive Python script for analyzing git repositories to compute security ownership and bus factor, which is not commonly found in public documentation.
What it needs
Requires networkx, python installed locally. About 4k tokens when loaded. Last updated 2026-08-06. 30,138 stars on the source repository.
What this skill does
Security Ownership Map Overview Build a bipartite graph of people and files from git history, then compute ownership risk and export graph artifacts for Neo4j/Gephi. Also build a file co-change graph (Jaccard similarity on shared commits) to cluster files by how they move together while ignoring large, noisy commits. Requirements Python 3 networkx (required; community detection is enabled by default) Install with: Workflow 1. Scope the repo and time window (optional --since/--until). 2. Decide sensitivity rules (use defaults or provide a CSV config). 3. Build the ownership map with scripts/runownershipmap.py (co-change graph is on by default; use --cochange-max-files to ignore supernode commits). 4. Communities are computed by default; graphml output is optional (--graphml). 5. Query the outputs with scripts/queryownership.py for bounded JSON slices. 6. Persist and visualize (see references/neo4j-import.md). By default, the co-change graph ignores common “glue” files (lockfiles, .github/, editor config) so clusters reflect actual code movement instead of shared infra edits. Override with --cochange-exclude or --no-default-cochange-excludes. Dependabot commits are excluded by default; override with --no-default-author-excludes or add patterns via --author-exclude-regex. If you want to exclude Linux build glue like Kbuild from co-change clustering, pass: Quick start Run from the repo root: Defaults: author identity, author date, and merge commits excluded. Use --identity committer, --date-field committer, or --include-merges if needed. Example (override co-change excludes): Communities are computed by default. To disable: Sensitivity rules By default, the script flags common auth/crypto/secret paths. Override by providing a CSV file: Use it with --sensitive-config path/to/sensitive.csv. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills davila7/security-ownership-map