Can I exclude bots or automated commits from the analysis?

Yes, it excludes Dependabot by default and supports custom regex patterns via the --author-exclude-regex flag to filter out other bots or service accounts.

Does this tool replace the CODEOWNERS file?

No, it acts as a reality check for CODEOWNERS by comparing official ownership against actual git commit history to highlight where maintenance reality differs from documentation.

What is a 'bus factor' in this context?

The bus factor represents the minimum number of developers who must leave the project before critical knowledge or control of a sensitive code file is lost, indicating a high-risk knowledge silo.

How does it identify sensitive code?

It uses default rules to flag common auth, crypto, and secret paths, but you can also provide a custom CSV configuration to define sensitivity rules specific to your project.

Can I visualize the resulting ownership graphs?

Yes, the skill exports data in CSV and GraphML formats, which are fully compatible with graph databases like Neo4j and visualization tools like Gephi.

Security Ownership Map

Name: Security Ownership Map
Author: northseadl

bynorthseadl

0•

Security & Testing

Analyzes git history to map security ownership topology, calculate bus factors for sensitive code, and identify high-risk maintenance clusters.

This skill provides deep insights into the human-to-code relationship within a git repository from a security perspective. By building bipartite and co-change graphs from commit history, it identifies orphaned sensitive code, calculates the 'bus factor' for critical components like authentication and cryptography, and detects hidden ownership clusters. It is particularly useful for security audits, verifying CODEOWNERS accuracy, and visualizing repository health through graph databases like Neo4j or visualization tools like Gephi, helping teams mitigate risks associated with knowledge silos and unmaintained security-critical files.

Key Features

01Exportable graph artifacts in CSV, JSON, and GraphML for Neo4j and Gephi integration.

02Bus factor calculation specifically for sensitive code paths like auth, crypto, and secrets.

03Bipartite people-to-file graph mapping with security-weighted ownership analysis.

04Automated community detection to identify clusters of files that frequently change together.

050 GitHub stars

06LLM-optimized query helper for extracting targeted slices of ownership data without overloading context.

Use Cases

01Identifying orphaned or stale sensitive code that lacks active maintainers in the git history.

02Detecting 'hidden owners' who control a disproportionate amount of security-critical logic.

03Verifying 'CODEOWNERS' reality against actual commit patterns to identify ownership drift.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add northseadl/skillwisp @openai

For use in Claude.ai and ChatGPT

Download Skill