Self-hosted alternatives to openai/security-ownership-map

O

openai/security-ownership-map

Map people-to-file ownership, compute bus factor, and identify risks

security-ownership-map is an agent skill from OpenAI's curated skills collection that analyzes a git repository's history to show who owns which files. It builds a graph linking people to files, then computes the bus factor, which is how few people could leave before a file has no one who knows it, along with the ownership of sensitive code and clusters of files that change together. It exports CSV and graph formats for Neo4j, Gephi or direct queries by a language model, and it compares the results with CODEOWNERS to surface ownership drift, where the file's real owners differ from the owners the team has declared. Git history and CODEOWNERS alone cannot show which sensitive files have drifted to a single hidden owner or sat untouched for a year, and this skill computes that. Typical uses include finding authentication or cryptography files with a bus factor of one, checking who actually owns sensitive code compared with what CODEOWNERS says, locating security-critical files that no one has touched in months, grouping files by co-change patterns to find hidden ownership clusters, and tracking which contributors have the highest concentration of sensitive changes. It suits security and engineering leaders who need to know where knowledge is concentrated before an incident or a departure. The output names people, so handle the results as sensitive and share them only with those who need them. The skill is listed on officialskills.sh and installs from the openai/skills repository. Install it with npx skills add https://github.com/openai/skills --skill security-ownership-map.