QA Risk Analyzer
Purpose
Risk-based testing prioritization and impact analysis for code changes. Calculate risk scores per feature/module, rank testing effort, and produce actionable recommendations using the formula:
Risk = Complexity × ChangeFrequency × (1 - TestCoverage)
Trigger Phrases
- "Risk analysis for [branch/PR/release]"
- "Prioritize tests by risk" / "Risk-based test prioritization"
- "Impact analysis for [git diff/changes]"
- "Risk heatmap" / "Risk matrix for testing"
- "Which tests to run first?" / "Test execution order by risk"
- "Risk index per feature" / "High-risk modules"
Risk Formula
Risk = Complexity × ChangeFrequency × (1 - TestCoverage)
- Complexity: Cyclomatic complexity, coupling, or static analysis metrics
- ChangeFrequency: Commits/changes per file from git history
- TestCoverage: 0–1 from qa-coverage-analyzer (1 = fully covered)
- Defect history and business criticality adjust the final ranking
See references/risk-factors.md for calculation methods.
Risk Factors
| Factor |
Source |
How to Obtain |
| Code complexity |
Cyclomatic complexity, coupling |
SonarQube, ESLint complexity, radon (Python) |
| Change frequency |
Git history |
git log --follow per file; commits per module |
| Test coverage |
Coverage reports |
qa-coverage-analyzer (Istanbul/JaCoCo/coverage.py) |
| Defect history |
Past bugs per module |
Memory MCP, Jira/issue tracker |
| Business criticality |
Stakeholder input |
Manual tagging or config; payment, auth, core flows |
Impact Analysis
Analyze git diff to determine:
- Affected modules — Files changed → map to features/modules
- Affected tests — Tests that cover changed code (from coverage or naming)
- Downstream impact — Dependencies, imports, API consumers
- Regression scope — Suggested regression set based on impact
See references/impact-analysis.md for git diff patterns and mapping strategies.
Output Deliverables
- Risk Matrix — Features/modules ranked by risk with testing recommendations
- Prioritized Test Execution List — Order tests by risk (high → low)
- Risk Heatmap — Visual matrix (complexity × change frequency, colored by coverage)
- Impact Summary — Per PR/branch: affected modules, suggested regression scope
Risk Matrix Template
# Risk Matrix — [Branch/Release]
## Summary
| Module/Feature | Risk Index | Complexity | Change Freq | Coverage | Recommendation |
|----------------|------------|------------|-------------|----------|-----------------|
| [Name] | X.XX | H/M/L | H/M/L | X% | [Action] |
## Prioritized Test Execution
1. [High risk] — [Module] — [Tests]
2. [Medium risk] — [Module] — [Tests]
3. [Low risk] — [Module] — [Tests]
## Heatmap
[Quadrant: Complexity × ChangeFrequency, color = coverage]
Workflow
- Input: Git diff/branch, coverage report, optional defect history (Memory MCP)
- Impact: Parse git diff; map changed files to modules/features
- Factors: Get complexity (static analysis), change frequency (git log), coverage (qa-coverage-analyzer)
- Risk score: Apply formula; apply defect/criticality adjustments
- Rank: Sort modules/features by risk
- Output: Risk matrix, prioritized test list, heatmap (via qa-diagram-generator)
- Recommendations: Suggest tests to run first, coverage gaps to address
MCP Tools Used
- Sequential Thinking MCP: Decompose analysis, reconcile conflicting factors, prioritize recommendations
- Memory MCP: Historical defect data per module, past risk trends, baseline comparison
Integration with Other Skills
| Need |
Skill |
Usage |
| Test coverage data |
qa-coverage-analyzer |
Code coverage per module |
| Risk quadrant chart |
qa-diagram-generator |
Heatmap, quadrant visualization |
| Test cases for modules |
qa-testcase-from-docs, qa-testcase-from-ui |
Map tests to modules |
| Risk matrix patterns |
qa-test-strategy |
references/risk-matrix.md |
Scope
Can do (autonomous):
- Calculate risk scores using the formula
- Parse git diff and map to modules
- Obtain change frequency from git history
- Integrate coverage from qa-coverage-analyzer
- Produce risk matrix, prioritized test list, heatmap
- Call qa-diagram-generator for quadrant charts
- Use Sequential Thinking for analysis; Memory for defect history
Cannot do (requires confirmation):
- Override business criticality without stakeholder input
- Change risk formula or factor weights without agreement
- Exclude modules from analysis without justification
Will not do (out of scope):
- Execute tests or generate coverage (consume existing data)
- Modify source code or test automation
- Deploy or change production systems
Quality Checklist
Troubleshooting
| Symptom |
Likely Cause |
Fix |
| Risk scores all similar |
Factors not normalized |
Normalize to 0–1 scale; use relative ranking |
| Missing coverage data |
qa-coverage-analyzer not run |
Run coverage first; use 0 if unavailable |
| Change frequency zero |
New files, no git history |
Use complexity + criticality only; flag as "new" |
| Module mapping fails |
Unclear file→module mapping |
Use directory structure, package.json, or config |
| Heatmap too dense |
Too many modules |
Group by feature; show top N by risk |
| Defect history empty |
Memory MCP not populated |
Proceed without; note "no defect history" |
Reference Files
| Topic |
Reference |
| Risk factor calculation |
references/risk-factors.md |
| Git diff impact analysis |
references/impact-analysis.md |
1---2name: qa-risk-analyzer3description: Risk-based testing prioritization with impact analysis for code changes using the formula Risk = Complexity × ChangeFrequency × (1 - TestCoverage).4---56# QA Risk Analyzer78## Purpose910Risk-based testing prioritization and impact analysis for code changes. Calculate risk scores per feature/module, rank testing effort, and produce actionable recommendations using the formula:1112**Risk = Complexity × ChangeFrequency × (1 - TestCoverage)**1314## Trigger Phrases1516- "Risk analysis for [branch/PR/release]"17- "Prioritize tests by risk" / "Risk-based test prioritization"18- "Impact analysis for [git diff/changes]"19- "Risk heatmap" / "Risk matrix for testing"20- "Which tests to run first?" / "Test execution order by risk"21- "Risk index per feature" / "High-risk modules"2223## Risk Formula2425```26Risk = Complexity × ChangeFrequency × (1 - TestCoverage)27```2829- **Complexity:** Cyclomatic complexity, coupling, or static analysis metrics30- **ChangeFrequency:** Commits/changes per file from git history31- **TestCoverage:** 0–1 from qa-coverage-analyzer (1 = fully covered)32- **Defect history** and **business criticality** adjust the final ranking3334See `references/risk-factors.md` for calculation methods.3536## Risk Factors3738| Factor | Source | How to Obtain |39|--------|--------|---------------|40| **Code complexity** | Cyclomatic complexity, coupling | SonarQube, ESLint complexity, radon (Python) |41| **Change frequency** | Git history | `git log --follow` per file; commits per module |42| **Test coverage** | Coverage reports | qa-coverage-analyzer (Istanbul/JaCoCo/coverage.py) |43| **Defect history** | Past bugs per module | Memory MCP, Jira/issue tracker |44| **Business criticality** | Stakeholder input | Manual tagging or config; payment, auth, core flows |4546## Impact Analysis4748Analyze git diff to determine:49501. **Affected modules** — Files changed → map to features/modules512. **Affected tests** — Tests that cover changed code (from coverage or naming)523. **Downstream impact** — Dependencies, imports, API consumers534. **Regression scope** — Suggested regression set based on impact5455See `references/impact-analysis.md` for git diff patterns and mapping strategies.5657## Output Deliverables58591. **Risk Matrix** — Features/modules ranked by risk with testing recommendations602. **Prioritized Test Execution List** — Order tests by risk (high → low)613. **Risk Heatmap** — Visual matrix (complexity × change frequency, colored by coverage)624. **Impact Summary** — Per PR/branch: affected modules, suggested regression scope6364### Risk Matrix Template6566```markdown67# Risk Matrix — [Branch/Release]6869## Summary70| Module/Feature | Risk Index | Complexity | Change Freq | Coverage | Recommendation |71|----------------|------------|------------|-------------|----------|-----------------|72| [Name] | X.XX | H/M/L | H/M/L | X% | [Action] |7374## Prioritized Test Execution751. [High risk] — [Module] — [Tests]762. [Medium risk] — [Module] — [Tests]773. [Low risk] — [Module] — [Tests]7879## Heatmap80[Quadrant: Complexity × ChangeFrequency, color = coverage]81```8283## Workflow84851. **Input:** Git diff/branch, coverage report, optional defect history (Memory MCP)862. **Impact:** Parse git diff; map changed files to modules/features873. **Factors:** Get complexity (static analysis), change frequency (git log), coverage (qa-coverage-analyzer)884. **Risk score:** Apply formula; apply defect/criticality adjustments895. **Rank:** Sort modules/features by risk906. **Output:** Risk matrix, prioritized test list, heatmap (via qa-diagram-generator)917. **Recommendations:** Suggest tests to run first, coverage gaps to address9293## MCP Tools Used9495- **Sequential Thinking MCP:** Decompose analysis, reconcile conflicting factors, prioritize recommendations96- **Memory MCP:** Historical defect data per module, past risk trends, baseline comparison9798## Integration with Other Skills99100| Need | Skill | Usage |101|------|-------|-------|102| Test coverage data | qa-coverage-analyzer | Code coverage per module |103| Risk quadrant chart | qa-diagram-generator | Heatmap, quadrant visualization |104| Test cases for modules | qa-testcase-from-docs, qa-testcase-from-ui | Map tests to modules |105| Risk matrix patterns | qa-test-strategy | `references/risk-matrix.md` |106107## Scope108109**Can do (autonomous):**110- Calculate risk scores using the formula111- Parse git diff and map to modules112- Obtain change frequency from git history113- Integrate coverage from qa-coverage-analyzer114- Produce risk matrix, prioritized test list, heatmap115- Call qa-diagram-generator for quadrant charts116- Use Sequential Thinking for analysis; Memory for defect history117118**Cannot do (requires confirmation):**119- Override business criticality without stakeholder input120- Change risk formula or factor weights without agreement121- Exclude modules from analysis without justification122123**Will not do (out of scope):**124- Execute tests or generate coverage (consume existing data)125- Modify source code or test automation126- Deploy or change production systems127128## Quality Checklist129130- [ ] Risk formula applied consistently (Complexity × ChangeFrequency × (1 - TestCoverage))131- [ ] All risk factors sourced (complexity, change freq, coverage)132- [ ] Git diff impact analysis maps files to modules133- [ ] Prioritized test list ordered by risk (high → low)134- [ ] Heatmap/quadrant chart generated via qa-diagram-generator135- [ ] Recommendations actionable (specific tests, coverage gaps)136- [ ] No hardcoded secrets; paths/config referenced137138## Troubleshooting139140| Symptom | Likely Cause | Fix |141|---------|--------------|-----|142| Risk scores all similar | Factors not normalized | Normalize to 0–1 scale; use relative ranking |143| Missing coverage data | qa-coverage-analyzer not run | Run coverage first; use 0 if unavailable |144| Change frequency zero | New files, no git history | Use complexity + criticality only; flag as "new" |145| Module mapping fails | Unclear file→module mapping | Use directory structure, package.json, or config |146| Heatmap too dense | Too many modules | Group by feature; show top N by risk |147| Defect history empty | Memory MCP not populated | Proceed without; note "no defect history" |148149## Reference Files150151| Topic | Reference |152|-------|-----------|153| Risk factor calculation | `references/risk-factors.md` |154| Git diff impact analysis | `references/impact-analysis.md` |
azanir