skills.rest
metric-space-ai
metric-space-aiOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-ownership-map

Analyze Git commit history to build security ownership graphs and export CSV/JSON artifacts.

2|Updated Apr 12, 2026
Search Tags:#security#analytics#ownership#graph#git-history#bus-factor#cochange
One-click install
npx skills add https://github.com/metric-space-ai/ctox --skill security-ownership-map-metric-space-ai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-ownership-map
Source: https://github.com/metric-space-ai/ctox/tree/main/skills/packs/security/security-ownership-map
Command: npx skills add https://github.com/metric-space-ai/ctox --skill security-ownership-map-metric-space-ai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires networkx, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Analyze git history to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.

Core Features & Use Cases

  • Build a bipartite graph of people and files from git history, then compute ownership risk and export graph artifacts for Neo4j/Gephi. Also build a file co-change graph (Jaccard similarity on shared commits) to cluster files by how they move together while ignoring large, noisy commits.

  • Communities are computed by default; graphml output is optional (--graphml).

  • Query the outputs with scripts/query_ownership.py for bounded JSON slices.

By default, the script flags common auth/crypto/secret paths. Override by providing a CSV file:

  • The CLI options described in the script include --repo, --since, --until, --identity, --sensitive-config, and so on, to customize scopes, time windows, and visualization outputs.

Quick Start

Run the ownership map on your repository to generate the security-ownership outputs (CSV/JSON) for graph visualization.

Frequently Asked Questions about security-ownership-map

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map security ownership and spot code risk from git history?▼

Security ownership analysis from git history builds a bipartite people-to-file graph to compute bus factor and sensitive-code ownership, exporting per-file and per-person artifacts as CSV and JSON files for graph visualization.

What is a bus factor analysis and how does it identify orphaned sensitive code?▼

Bus factor analysis evaluates commit history to calculate ownership concentration across sensitive code paths maintained by few contributors. It identifies orphaned sensitive code by mapping auth, crypto, and secret paths to their actual maintainers.

How do I export a security ownership topology to Neo4j or Gephi?▼

You export the security ownership topology to Neo4j or Gephi by generating optional graphml files. The Skill computes file co-change graphs using Jaccard similarity and outputs graphml artifacts compatible with external graph databases.

Does the ownership map tool work with large codebases for CODEOWNERS audits?▼

Yes, the ownership map tool works with large codebases for CODEOWNERS audits. It analyzes time-based communities and ownership drift across extensive repositories, providing a reality check against declared CODEOWNERS and identifying risk hotspots.

Can I customize sensitive file paths and time windows in the ownership analysis?▼

You can customize sensitive file paths by providing a CSV configuration file to override default auth, crypto, and secret path flags. The CLI also supports --since, --until, and --repo options to scope time windows and repositories for the ownership analysis.

What are the limitations of using git commit history for security ownership mapping?▼

Using git commit history for security ownership mapping is limited by noisy commits, which the tool mitigates by ignoring large commits during co-change clustering. It requires explicit git history and does not trigger for general maintainer lists or non-security ownership questions.

Related Skills

Explore More Data & Analytics Skills→
jaypatrickjaypatrick

security-ownership-map

Generate a security-ownership map from Git history, outputting CSV/JSON artifacts.

Community
Advanced
cloudofgeorgecloudofgeorge

security-ownership-map

Analyze git histories to map people-to-files ownership and surface security risks.

Community
Advanced
EstomEstom

security-ownership-map

Builds a people-to-file security ownership topology from git history and exports CSV/JSON artifacts.

Community
Advanced
Moliboy5000Moliboy5000

security-ownership-map

Analyze git repositories to map security ownership and calculate bus factor.

Community
Advanced