What is a 'bus factor' in this context?

The bus factor represents the minimum number of team members who must leave before a specific piece of sensitive code lacks a primary maintainer, highlighting organizational risk.

How does it identify sensitive code?

It uses default patterns for common security paths like auth, crypto, and secrets, but can be fully customized via a CSV configuration file.

Can I export the data for external visualization tools?

Yes, the skill generates CSV and JSON artifacts specifically designed for import into graph databases like Neo4j and visualization tools like Gephi.

How does it handle large, noisy repositories?

It includes filters to exclude bots, specific file patterns (like lockfiles), and time-window scoping to ensure the analysis focuses on meaningful code movement.

Security Ownership Mapper

Name: Security Ownership Mapper
Author: trailofbits

bytrailofbits

•

253

•

セキュリティとテスト

Analyzes git history to map security ownership, calculate bus factors, and identify risks in sensitive codebases.

This skill enables developers and security engineers to visualize the relationship between contributors and sensitive files within a git repository. By building a bipartite graph and computing metrics like Jaccard similarity for co-changes, it identifies 'bus factor' risks, orphaned sensitive components, and hidden owners. It is particularly useful for auditing large codebases, validating CODEOWNERS files against actual historical data, and preparing data for graph databases like Neo4j to uncover complex maintenance patterns and ownership drift.

主な機能

01Bus factor calculation for sensitive code paths and security-critical modules

02Jaccard similarity-based file co-change clustering to group related logic

03253 GitHub stars

04Bipartite graph generation mapping people to specific files via git history

05Exportable data artifacts for Neo4j, Gephi, and JSON-bounded LLM queries

06Automated detection of orphaned or stale sensitive code with low maintenance

ユースケース

01Validating if official CODEOWNERS files match actual historical contribution patterns

02Performing a security audit to find critical code maintained by a single person

03Identifying 'hidden owners' who control significant portions of security-sensitive logic

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add trailofbits/skills-curated openai-security-ownership-map

For use in Claude.ai and ChatGPT

Download Skill