Security ownership map

Skill PramodDutta/qaskills/seed-skills/security-ownership-map

QA Skills Directory QA Skills is a curated directory of testing-specific skills for AI coding agents (Claude Code, Cursor, Copilot, etc.).

Install

npx -y skills add PramodDutta/qaskills --skill security-ownership-map

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Analyze git repositories to build security ownership topology, compute bus factor for sensitive code, detect orphaned security-critical files, and export ownership graphs for visualization.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.4 KB, 693 tokens by cl100k_base, as published. Nobody here has run it

Security Ownership Map

Build a bipartite graph of people and files from git history to compute ownership risk, detect orphaned security-critical code, and identify bus factor hotspots.

Overview

This skill analyzes git repositories to answer critical security ownership questions:

Who owns the security-sensitive code? Map people to auth, crypto, and secrets-related files
What is the bus factor? Identify files with dangerously low contributor diversity
Where is orphaned code? Find sensitive code that hasn't been touched recently
How do files cluster? Build co-change graphs to understand code movement patterns

Workflow

1. Scope the Repository

Define the repo root and any in-scope paths
Set time window with --since / --until parameters
Decide sensitivity rules (defaults flag auth/crypto/secret paths)

2. Build the Ownership Map

python run_ownership_map.py \
  --repo . \
  --out ownership-map-out \
  --since "12 months ago" \
  --emit-commits

3. Query Security Findings

# Orphaned sensitive code (stale + low bus factor)
python query_ownership.py --data-dir ownership-map-out summary --section orphaned_sensitive_code

# Hidden owners for sensitive tags
python query_ownership.py --data-dir ownership-map-out summary --section hidden_owners

# Sensitive hotspots with low bus factor
python query_ownership.py --data-dir ownership-map-out summary --section bus_factor_hotspots

# Auth/crypto files with bus factor <= 1
python query_ownership.py --data-dir ownership-map-out files --tag auth --bus-factor-max 1

Output Artifacts

The analysis produces:

people.csv — Nodes: people with timezone detection
files.csv — Nodes: files with sensitivity tags
edges.csv — Edges: touch relationships
cochange_edges.csv — File-to-file co-change edges with Jaccard weight
summary.json — Security ownership findings
communities.json — Code community clusters with maintainers

Sensitivity Rules

Default rules flag common sensitive paths:

# pattern,tag,weight
**/auth/**,auth,1.0
**/crypto/**,crypto,1.0
**/*.pem,secrets,1.0
**/middleware/auth*,auth,1.0
**/password*,auth,0.8

Override with --sensitive-config path/to/sensitive.csv.

Key Security Queries

Bus factor hotspots — Files with bus_factor <= 1 that handle auth/crypto
Orphaned code — Sensitive files not touched in 6+ months
Hidden owners — Developers who silently control large portions of sensitive code
Ownership drift — Compare against CODEOWNERS to highlight discrepancies

Best Practices

Run quarterly to track ownership changes
Compare against CODEOWNERS for drift detection
Filter bots with --ignore-author-regex '(bot|dependabot)'
Use --window-days 90 to smooth churn effects
Export to Neo4j/Gephi for visual analysis