# Security Ownership Map

> Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.

- Skill: `hebertzhu/security-ownership-map` (Agent Skill)
- Install (CLI): `npx skillmds@latest add hebertzhu/security-ownership-map`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hebertzhu/security-ownership-map/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: hebertzhu (https://skillmd.com/u/hebertzhu)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/hebertzhu/security-ownership-map

---


# security-ownership-map

## Intent
- Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.

## Default operating pattern
1. Identify assets, trust boundaries, attacker assumptions, and sensitive flows.
2. Inspect the current implementation or design surface that creates risk.
3. Rank issues by impact, likelihood, and exploitability.
4. Recommend the smallest safe-by-default changes that materially reduce exposure.
5. Note verification steps and any residual risk that still remains.

## Pack fit
- Included in: `security-quality`
- Keep examples generic, privacy-safe, and portable across hosts.

## Boundary
- Do not use for generic maintainer lists that do not involve security ownership.