# Risk Assessment

> Trigger: risk assessment, refactor risk. Classify technical and functional legacy risk.

- Skill: `andresnator/risk-assessment` (Agent Skill)
- Install (CLI): `npx skillmds@latest add andresnator/risk-assessment`
- Raw SKILL.md: https://api.skillmd.com/api/skills/andresnator/risk-assessment/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: andresnator (https://skillmd.com/u/andresnator)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/andresnator/risk-assessment

---


# Risk Assessment
Assess risk from technical and functional evidence.

## Signals

- Complexity and large methods/classes.
- Missing tests or low coverage.
- CRAP score when available.
- Fan-in/fan-out and number of consumers.
- External dependencies.
- Public contracts.
- Async behavior, transactions, persistence, and critical domain rules.
- Git churn when history is available.

Classify overall risk as low, medium, high, or critical and explain why.

## Churn and hot spots

When git history is available (read-only `git log` / `git blame` / `git shortlog`), rank the target's files by change frequency. High churn on a risky unit raises its priority: refactor pays off where change keeps happening. Churn ≈ 0 lowers it — untouched ugly code is zero-interest debt, and refactoring it has ROI near zero unless a planned change is about to land there.

## Business value tier

Depth of investment follows the target's value tier, not only its technical risk: core domain code (differentiating business logic) justifies deep plans; supporting code justifies moderate ones; generic/commodity code is often better replaced than refactored. Infer the tier from evidence (domain language, dependency direction, test intensity) and say explicitly when it cannot be inferred.