maintainers

Identify repository maintainers and contact channels from commit history, issues, and registry ownership.

Updated May 20, 2026

Search Tags:#commit-history #issues-prs #maintainers #contact-information #security-disclosure #repository-ownership #registry-data

Ready to run

npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill maintainers

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: maintainers
Source: https://github.com/lukehinds/scrutineer-attest-test/tree/main/skills/maintainers
Command: npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill maintainers

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify the real maintainers of a repository and the best way to contact them about a security issue. Distinguishes active leads from occasional contributors and bots, using commit history, issue activity, and registry ownership. Use when preparing a disclosure and needing to know who to reach.

Core Features & Use Cases

Distinguish active leads, regular maintainers, occasional contributors, and bots based on commit history, issue activity, and registry data.
Identify contact channels and ownership signals for responsible disclosure.
Support evidence-backed handoffs with a clear escalation path.

Quick Start

Review the repository activity and ownership signals to produce a contact-ready list of maintainers

Frequently Asked Questions about maintainers

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify the real maintainers of a repository for a security disclosure?▼

Repository ownership signals are determined by analyzing commit history, issue activity, and registry data to classify users as leads, maintainers, contributors, or bots, ensuring you contact active maintainers rather than occasional contributors.

What's the best way to find contact information for active repository maintainers?▼

The best way to find contact information is by evaluating repository activity signals from the past year, distinguishing active leads from bots and occasional contributors, and extracting their contact channels for responsible disclosure workflows.

How does a repository distinguish between a lead maintainer and a bot?▼

Distinguishing a lead maintainer from a bot relies on evidence sourced from commits, issues, and package registry lookups, applying classification criteria to separate active human leads from automated contributors.

Can I use registry data to verify package ownership for responsible disclosure?▼

Yes, you can use registry data to verify package ownership, combining it with commit history and issue data to identify primary maintainers and their contact channels for security disclosure preparation.

Does this approach classify occasional contributors differently from regular maintainers?▼

Yes, this approach classifies occasional contributors separately from regular maintainers by evaluating their commit history and issue activity, ensuring disclosure handoffs target users with sustained repository involvement.