Risk Assessment
When NOT to Use
- Security vulnerability detection (use
/codex-security)
- Code correctness / lint / test review (use
/codex-review-fast)
- Project-level health audit (use
/project-audit)
Procedure
- Run
bash scripts/run-skill.sh risk-assess risk-analyze.js --json to collect deterministic scores
- Parse the JSON output — overall_score, risk_level, dimensions, flags, gate, next_actions
- If risk_level = Critical (score 75-100) — highlight all breaking signals, recommend splitting PRs
- If risk_level = High (score 50-74) — auto-escalate to
--mode deep, detail blast radius
- If risk_level = Medium (score 30-49) — summarize dimensions, note areas of concern
- If risk_level = Low (score 0-29) — brief summary, confirm safe to proceed
- Add qualitative interpretation beyond the scores (e.g., "high blast radius but all dependents are test files")
Script Integration
The script analyzes 3 dimensions + 2 conditional flags:
| Dimension |
Weight |
What It Measures |
| breaking_surface |
45% |
Removed exports, renamed APIs, changed signatures, deleted modules |
| blast_radius |
35% |
Number of files importing changed modules (grep-based) |
| change_scope |
20% |
File count, LOC delta, directory span, rename ratio |
| Flag |
Trigger |
What It Checks |
| migration_safety |
Migration/schema files in diff |
Rollback/down file exists |
| regression_hint |
(v2 stub) |
Future: git history analysis |
Scoring Model
- Overall:
breaking_surface * 0.45 + blast_radius * 0.35 + change_scope * 0.20
- Each dimension: 0-100 scale
- Overall: 0-100 scale
Risk Levels
| Score |
Level |
Gate |
Exit Code |
| 0-29 |
Low |
PASS |
0 |
| 30-49 |
Medium |
PASS |
0 |
| 50-74 |
High |
REVIEW |
1 |
| 75-100 |
Critical |
BLOCK |
2 |
Script Failure Fallback
If the script fails, report the error and suggest running manually:
bash scripts/run-skill.sh risk-assess risk-analyze.js --json
Output Format
## Risk Assessment Report
| Field | Value |
|-------|-------|
| Score | **[N]/100** |
| Risk Level | [icon] [level] |
| Gate | [PASS/REVIEW/BLOCK] |
### Dimensions
[table of dimension scores + weights]
### Breaking Change Signals
[list of detected signals — only if any]
### Next Actions
[prioritized action items]
## Gate: [sentinel]
References
references/risk-dimensions.md — Signal catalog, import patterns, scoring bands (read when investigating a specific dimension)references/output-template.md — JSON schema, report templates per risk level (read when customizing output)
Verification
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
1---2name: sd0xdev-sd0x-dev-flow-risk-assess3description: Risk Assessment4---56# Risk Assessment78## When NOT to Use910- Security vulnerability detection (use `/codex-security`)11- Code correctness / lint / test review (use `/codex-review-fast`)12- Project-level health audit (use `/project-audit`)1314## Procedure15161. Run `bash scripts/run-skill.sh risk-assess risk-analyze.js --json` to collect deterministic scores172. Parse the JSON output — overall_score, risk_level, dimensions, flags, gate, next_actions183. **If risk_level = Critical** (score 75-100) — highlight all breaking signals, recommend splitting PRs194. **If risk_level = High** (score 50-74) — auto-escalate to `--mode deep`, detail blast radius205. **If risk_level = Medium** (score 30-49) — summarize dimensions, note areas of concern216. **If risk_level = Low** (score 0-29) — brief summary, confirm safe to proceed227. Add qualitative interpretation beyond the scores (e.g., "high blast radius but all dependents are test files")2324## Script Integration2526The script analyzes 3 dimensions + 2 conditional flags:2728| Dimension | Weight | What It Measures |29|-----------|--------|-----------------|30| breaking_surface | 45% | Removed exports, renamed APIs, changed signatures, deleted modules |31| blast_radius | 35% | Number of files importing changed modules (grep-based) |32| change_scope | 20% | File count, LOC delta, directory span, rename ratio |3334| Flag | Trigger | What It Checks |35|------|---------|---------------|36| migration_safety | Migration/schema files in diff | Rollback/down file exists |37| regression_hint | (v2 stub) | Future: git history analysis |3839### Scoring Model4041- Overall: `breaking_surface * 0.45 + blast_radius * 0.35 + change_scope * 0.20`42- Each dimension: 0-100 scale43- Overall: 0-100 scale4445### Risk Levels4647| Score | Level | Gate | Exit Code |48|-------|-------|------|-----------|49| 0-29 | Low | PASS | 0 |50| 30-49 | Medium | PASS | 0 |51| 50-74 | High | REVIEW | 1 |52| 75-100 | Critical | BLOCK | 2 |5354### Script Failure Fallback5556If the script fails, report the error and suggest running manually:5758```bash59bash scripts/run-skill.sh risk-assess risk-analyze.js --json60```6162## Output Format6364```65## Risk Assessment Report6667| Field | Value |68|-------|-------|69| Score | **[N]/100** |70| Risk Level | [icon] [level] |71| Gate | [PASS/REVIEW/BLOCK] |7273### Dimensions74[table of dimension scores + weights]7576### Breaking Change Signals77[list of detected signals — only if any]7879### Next Actions80[prioritized action items]8182## Gate: [sentinel]83```8485## References8687- `references/risk-dimensions.md` — Signal catalog, import patterns, scoring bands (read when investigating a specific dimension)88- `references/output-template.md` — JSON schema, report templates per risk level (read when customizing output)8990## Verification9192- [ ] Script ran successfully93- [ ] All 3 dimensions scored94- [ ] Qualitative interpretation added beyond raw scores95- [ ] Next actions are actionable (include commands where applicable)96- [ ] Gate sentinel present in output9798---99> Converted and distributed by [TomeVault](https://tomevault.io/claim/sd0xdev) — claim your Tome and manage your conversions.100<!-- tomevault:4.0:skill_md:2026-04-11 -->
tomevault-io