security-ownership-map

Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.

4.57x

Quality

88%

Does it follow best practices?

Impact

96%

4.57x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable, well-structured content with executable commands and a real external reference, weakened by repeated full command paths, overlapping query sections, and a batch workflow lacking explicit validation checkpoints.

Suggestions

Add an explicit validation/verification checkpoint to the workflow (e.g., 'after building, run query_ownership.py summary to confirm non-empty output and compare against CODEOWNERS for drift') to lift workflow_clarity above the batch cap.

Reduce repetition by defining the script path once (e.g., 'Alias: MAP=skills/skills/security-ownership-map/scripts') or using relative script names, so the long path isn't repeated in every example.

Consolidate the 'LLM query helper' and 'Basic security queries' sections, or move the extensive query-example catalog into a separate references/query-examples.md file to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Lean on concepts — no explanation of git/bus-factor basics Claude already knows — but the full `python skills/skills/security-ownership-map/scripts/...` path is repeated verbatim ~15 times and the 'LLM query helper' and 'Basic security queries' sections overlap noticeably.	4 / 5
Actionability	Copy-paste-ready commands with concrete flags cover the common cases (queries, co-change overrides, sensitivity config, community maintainers), and output artifacts are enumerated precisely.	5 / 5
Workflow Clarity	A clear 6-step workflow sequence is present, but this is a batch git-history processing job with no explicit validate/verify checkpoint or feedback loop in the workflow, so the batch-operation cap applies.	3 / 5
Progressive Disclosure	Well-organized sections with one clearly signaled one-level reference (`references/neo4j-import.md`, a real file), but nearly all query/output detail is inline rather than split across reference files.	4 / 5
	Total	16 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: concrete actions, natural trigger terms with synonyms, explicit what/when guidance, and a clear anti-trigger to avoid misfires. No padding or over-claims.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'build a security ownership topology', 'compute bus factor and sensitive-code ownership', and 'export CSV/JSON for graph databases and visualization' — with comprehensive coverage and no vague filler.	5 / 5
Completeness	Explicitly answers both 'what' (topology/bus-factor/export) and 'when' via 'Trigger only when the user explicitly wants... (for example: ...)' with concrete trigger phrases, plus an explicit anti-trigger.	5 / 5
Trigger Term Quality	Covers natural user phrases plus synonyms and concrete variants: 'security ownership', 'bus factor', 'orphaned sensitive code', 'security maintainers', 'CODEOWNERS reality checks', 'sensitive hotspots', and 'ownership clusters'.	5 / 5
Distinctiveness Conflict Risk	Carves a clear niche (security-oriented ownership analysis grounded in git history) and explicitly excludes overlap with 'Do not trigger for general maintainer lists or non-security ownership questions', minimizing conflict risk.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: foryourhealth111-pixel/Vibe-Skills
Path: bundled/skills/security-ownership-map/SKILL.md
Commit: d5ae560

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.