security-ownership-map

Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.

4.57x

Quality

86%

Does it follow best practices?

Impact

96%

4.57x

Average score across 3 eval scenarios

Securityby

Passed

No known issues

Quality

Content

72%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and well-structured with proper progressive disclosure, but it is somewhat verbose due to repeated full paths and lacks explicit validation checkpoints in its batch workflow.

Suggestions

Add an explicit verification step to the workflow (e.g., after running, check that ownership-map-out/summary.json contains expected sections before querying).

Shorten repeated invocations by introducing a short alias or variable for the script path instead of repeating "skills/skills/security-ownership-map/scripts/…" in every example.

Consolidate overlapping quick-start and override examples into fewer, well-chosen ones to reduce token cost.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient executable content, but the full path "skills/skills/security-ownership-map/scripts/…" is repeated in nearly every command and several quick-start blocks overlap, so it could be tightened.	2 / 3
Actionability	Commands are copy-paste-ready and specific, the output-artifact list is concrete, and the sensitivity-rule CSV format is given verbatim with usage flags.	3 / 3
Workflow Clarity	A sequenced six-step workflow is present, but for a batch git-history analysis there are no explicit validation/verification checkpoints (e.g., confirm summary.json sections populated), which caps this dimension at 2.	2 / 3
Progressive Disclosure	The SKILL.md is a clear overview that points one level deep to a real references/neo4j-import.md and to dedicated scripts, with content appropriately split and easy to navigate.	3 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, third-person, and clearly states both capability and trigger conditions with explicit anti-triggers. It is a strong, low-conflict skill description.

Dimension	Reasoning	Score
Specificity	"build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases" lists multiple specific concrete actions rather than vague language.	3 / 3
Completeness	It states both what it does (build topology, compute bus factor, export CSV/JSON) and when to use it via an explicit "Trigger only when the user explicitly wants…" clause plus a "Do not trigger for…" anti-trigger.	3 / 3
Trigger Term Quality	Natural user terms are well covered: "security ownership", "bus-factor analysis", "orphaned sensitive code", "CODEOWNERS reality checks for risk", "sensitive hotspots", and "ownership clusters".	3 / 3
Distinctiveness Conflict Risk	The security-oriented niche is clearly bounded, and the explicit "Do not trigger for general maintainer lists or non-security ownership questions" makes conflict with adjacent skills unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: openai/skills
Commit: 49f948f

Reviewed: 19 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.