risk-assess

Risk Assessment

When NOT to Use

• Security vulnerability detection (use /codex-security)
• Code correctness / lint / test review (use /codex-review-fast)
• Project-level health audit (use /project-audit)

Procedure

1. Run bash scripts/run-skill.sh risk-assess risk-analyze.js --json to collect deterministic scores
2. Parse the JSON output — overall_score, risk_level, dimensions, flags, gate, next_actions
3. If risk_level = Critical (score 75-100) — highlight all breaking signals, recommend splitting PRs
4. If risk_level = High (score 50-74) — auto-escalate to --mode deep, detail blast radius
5. If risk_level = Medium (score 30-49) — summarize dimensions, note areas of concern
6. If risk_level = Low (score 0-29) — brief summary, confirm safe to proceed
7. Add qualitative interpretation beyond the scores (e.g., "high blast radius but all dependents are test files")

Script Integration

The script analyzes 3 dimensions + 2 conditional flags:

| Dimension | Weight | What It Measures | |-----------|--------|-----------------| | breaking_surface | 45% | Removed exports, renamed APIs, changed signatures, deleted modules | | blast_radius | 35% | Number of files importing changed modules (grep-based) | | change_scope | 20% | File count, LOC delta, directory span, rename ratio |

| Flag | Trigger | What It Checks | |------|---------|---------------| | migration_safety | Migration/schema files in diff | Rollback/down file exists | | regression_hint | (v2 stub) | Future: git history analysis |

Scoring Model

• Overall: breaking_surface 0.45 + blast_radius 0.35 + change_scope * 0.20
• Each dimension: 0-100 scale
• Overall: 0-100 scale

Risk Levels

| Score | Level | Gate | Exit Code | |-------|-------|------|-----------| | 0-29 | Low | PASS | 0 | | 30-49 | Medium | PASS | 0 | | 50-74 | High | REVIEW | 1 | | 75-100 | Critical | BLOCK | 2 |

Script Failure Fallback

If the script fails, report the error and suggest running manually:

bash scripts/run-skill.sh risk-assess risk-analyze.js --json

Output Format

## Risk Assessment Report

| Field | Value |
|-------|-------|
| Score | **[N]/100** |
| Risk Level | [icon] [level] |
| Gate | [PASS/REVIEW/BLOCK] |

### Dimensions
[table of dimension scores + weights]

### Breaking Change Signals
[list of detected signals — only if any]

### Next Actions
[prioritized action items]

## Gate: [sentinel]

References

• references/risk-dimensions.md — Signal catalog, import patterns, scoring bands (read when investigating a specific dimension)
• references/output-template.md — JSON schema, report templates per risk level (read when customizing output)

Verification

• [ ] Script ran successfully
• [ ] All 3 dimensions scored
• [ ] Qualitative interpretation added beyond raw scores
• [ ] Next actions are actionable (include commands where applicable)
• [ ] Gate sentinel present in output