Results for “risk-rating”

Identify and prioritize risks by impact and controllability. Use for risk management, project planning, and strategic decision support.

Use `review-agent` for a high-risk Engineering Brief when a critical path, architecture boundary, material risk, or multiple downstream tasks need deeper design evidence. Skip ordinary work without those signals.

Provides a structured risk scoring methodology for Data Protection Impact Assessments aligned with ENISA threat taxonomy and ISO 29134. Covers likelihood and severity assessment, risk matrix construction, inherent vs residual risk calculation, and risk appetite thresholds per EDPB WP248rev.01 guidance. Keywords: risk scoring, DPIA risk matrix, likelihood, severity, ENISA, ISO 29134, residual risk, risk appetite.

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology, from scoping and threat identification to risk determination and communication.

Calculate portfolio risk metrics including VaR, CVaR, Sharpe, Sortino, and drawdown analysis. Use when measuring portfolio risk, implementing risk limits, or building risk monitoring systems.

Identify, assess, and mitigate project risks across technical, scope, dependency, and timeline categories using a structured register and escalation rules.

Use when evaluating potential risks before making decisions, starting initiatives, or implementing changes. This skill provides a structured risk assessment framework for identifying, analyzing, and responding to risks across all domains.

Identifies, assesses, and mitigates risks at every phase of a development pipeline.

Monitor portfolio risk, R-multiples, and position limits. Creates hedging strategies, calculates expectancy, and implements stop-losses. Use PROACTIVELY for risk assessment, trade tracking, or portfolio protection.

Analyzes .NET project code coverage and CRAP (Change Risk Anti-Patterns) scores to identify risk hotspots, methods blocking coverage gains, and prioritize where to add tests.

Ranks any list of impediments and their countermeasures using a value-stream scoring model (ROI, Cost to Implement, Ease of Deployment, Risk Factor) and a fixed prioritization formula.

Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.

Identify what to measure, test, or track to de-risk a product or AI idea across internal and external risk dimensions.

Agent profile for PPC and paid-growth risk review before changing ads, budgets, bidding, tracking, or landing pages.

Run a pre-mortem risk analysis on a PRD or launch plan. Categorizes risks as Tigers (real problems), Paper Tigers (overblown concerns), and Elephants (unspoken worries), then classifies as launch-blocking, fast-follow, or track. Use when preparing for launch, stress-testing a product plan, or identifying what could go wrong.

Rank a backlog of feature ideas by impact, effort, risk, and strategic alignment to identify the top 5 to pursue.

Scores deal margin and risk, routes discount approval to the right human approver, and redlines terms against commercial policy for per-deal review.

Apply bottom-up and top-down role mining techniques to discover optimal RBAC roles from existing user-permission assignments, reducing role explosion and enforcing least privilege.

Turn "is this deal real?" into a deal-by-deal risk verdict. An 8-state risk taxonomy, a qualification-vs-stage gap check, multi-thread coverage, days-dark per deal, and a commit-creep watch. Built for B2B sales teams, customizable to your CRM and your sales process. Trigger on "how are my deals", "which deals are stuck", "what's at risk this month", "is the rep sandbagging", "multi-thread check", or any open-deal diagnostic.

Calculates a per-ticker panic index (0-100) from six weighted signals including VIX, IV Rank, RSI-14, volume anomaly, put/call ratio, and consecutive down days, triggering Bull Put Spread entry signals at scores ≥60.

Broad risk assessment — key-person, technical, regulatory, competitive, financial, and execution risks beyond product/market

Security vulnerability assessment identifying OWASP risks, injection vectors, authentication issues, and data exposure with severity classification.

Security Craft

Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.

Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.

Red-team a PRD, roadmap, or strategy by attacking its load-bearing assumptions before reality does, ranking failure modes by impact, likelihood, and cheapness to test.

Quantify security risks in dollars, build compliance roadmaps (SOC 2, ISO 27001, HIPAA, GDPR), and justify security budgets for growth-stage companies.

Use an independently assigned `review-agent` for post-authoring review of changed rd-skills routing registries, fixtures, mappings, or owner conflicts without repair. Skip product work and in-task global rerouting.

Prioritize assumptions using an Impact × Risk matrix and suggest targeted experiments for each.

任意のリポジトリ（アプリ/ライブラリ/運用スクリプト/コンテンツ等）の種別を判定し、 種別に応じた評価軸（品質・テスト・依存、または検証ゲート等）で**実測ベース**評価して優先度付き改善案を出すスキル。 言語非依存（Python は AST 詳細・その他は近似と明記）。ベンダーコード混入・除外の空振り・偽の成功終了コードなど、 「黙って間違った数値を出す」失敗を構造的に封じる。 「リポジトリレビューして」「コード品質を評価して」「このプロジェクトを診断して」「包括レビュー」「repo-review」 「アーキテクチャ評価して」等で発火。/repo-review でも起動。

Review protected asset policy and risky local data surfaces.

Use to build an account's cumulative support record ahead of a renewal or QBR, so the review reflects the whole relationship rather than the most recent ticket. Trigger for "prepare for this renewal", "what has this account's support experience been", "which accounts are at risk before renewal", QBR preparation, account health review, or an account that renewed badly with no warning.

Aggregates market-wide sentiment indicators including VIX, Put/Call ratio, Fear & Greed Index, market breadth, and sector rotation to classify the current regime as risk-on, risk-off, or neutral.

Ingests, normalizes, and enriches structured and unstructured threat intelligence feeds into STIX 2.1 format, evaluating feed quality and deduplicating indicators for distribution to SIEM, firewall, and EDR platforms.

OWASP Top 10 + Supabase-first hardening burndown. Use when "security audit plan", "OWASP audit", "hardening plan", or "security burndown". App-layer auth flows → audit-auth-flows. Table RLS → plan-rls-audit. Key rotation → plan-secrets-audit. App LLM attacks → audit-llm-security.