Deep analysis of Git history: identify frequently changed hotspot files, analyze code ownership by contributor, and scan for leaked secrets. Triggered when users ask about Git analysis, code hotspots, who owns what code, secret scanning, security audits of commit history, or optimizing code review assignments.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Repo Audit — Deep Analysis of Git History
Perform three-dimensional analysis on a Git repository: **hotspot file detection**, **code ownership analysis**, and **secret leak scanning**.
## Feature Overview
### 1. Hotspot File Analysis (`scripts/hotfiles.sh`)
Identify the most frequently changed files in a repository to help spot:
- High-risk code areas (frequent changes = potential instability)
- Files that deserve extra attention during code review
- Modules that may need splitting or refactoring
**Usage:**
```bash
bash scripts/hotfiles.sh [options]
```
| Option | Description | Default |
|--------|-------------|---------|
| `--repo PATH` | Repository path | Current directory |
| `--top N` | Show top N files | 20 |
| `--since DATE` | Start date (e.g. `2024-01-01`) | None |
| `--until DATE` | End date | None |
| `--author AUTHOR` | Filter by author | None |
| `--format FORMAT` | Output format: `table` / `csv` / `json` | table |
### 2. Code Ownership Analysis (`scripts/ownership.sh`)
Analyze actual code ownership, reporting for each contributor within the specified scope:
- Commit count and percentage
- Lines changed (additions/deletions)
- Last active date
**Usage:**
…
The line at the top of this page pins the label git:20260531.164971d, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_fumvnpllghjhuspc
GET https://markdownregistry.com/api/v1/resolve?ref=zebbern/claude-code-guide/repo-audit
GET https://markdownregistry.com/api/v1/blob/978d00c620f6e3ab775684e18d7928efe6e837bb92ebe46268cb29b92fa4ecbc
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
zebbern/claude-code-guide · skills/active-directory-attacks/SKILL.md · This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync"…
zebbern/claude-code-guide · skills/api-fuzzing-bug-bounty/SKILL.md · This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test…
zebbern/claude-code-guide · skills/api-shape-explorer/SKILL.md · Generate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to…
zebbern/claude-code-guide · skills/audit-flow/SKILL.md · Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid…
zebbern/claude-code-guide · skills/aws-penetration-testing/SKILL.md · This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud…
zebbern/claude-code-guide · skills/broken-authentication/SKILL.md · This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session…
zebbern/claude-code-guide · skills/burp-suite-testing/SKILL.md · This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for…
zebbern/claude-code-guide · skills/caching/SKILL.md · Caching strategies — invalidation, TTL guidelines, cache keys, cache layers, and when not to cache. Use when…
zebbern/claude-code-guide · skills/cloud-penetration-testing/SKILL.md · This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP…
kanevry/session-orchestrator · skills/repo-audit/SKILL.md · Use this skill when the user wants to audit a repository for baseline compliance, check code quality, security posture…
kanevry/session-orchestrator · .agents/skills/repo-audit/SKILL.md · Use this skill when the user wants to audit a repository for baseline compliance, check code quality, security posture…
kanevry/session-orchestrator · .codex-plugin/skills/repo-audit/SKILL.md · Use this skill when the user wants to audit a repository for baseline compliance, check code quality, security posture…
kanevry/session-orchestrator · .cursor/skills/repo-audit/SKILL.md · Use this skill when the user wants to audit a repository for baseline compliance, check code quality, security posture…
