risk-analysis-agent

Compare codebase states to score and prioritize transition risks.

Updated Apr 6, 2026
One-click install
npx skills add https://github.com/carlosmarte/skills --skill risk-analysis-agent
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: risk-analysis-agent
Source: https://github.com/carlosmarte/skills/tree/main/.agents/skills/risk-analysis-agent
Command: npx skills add https://github.com/carlosmarte/skills --skill risk-analysis-agent

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Conduct a formal risk analysis on a target codebase location against a user-specified goal. Ingests a <location>/* path as the Current State, parses the <prompt> as the Target State, identifies vulnerabilities and transition risks, evaluates each on a Likelihood × Impact matrix, and emits a prioritized report.

Core Features & Use Cases

  • Identify and quantify risks by comparing Current State (<location>/*) with Target State (<prompt>).
  • Score risks using a Likelihood × Impact matrix and categorize them into P0 (Critical Risk), P1 (High-Value Risk), and P2 (Low-Risk).
  • Emit a structured, prioritized risk report suitable for review and action.

Quick Start

Run the risk-analysis-agent with a <location>/* and a <prompt> describing the Target State to kick off the assessment.

Frequently Asked Questions about risk-analysis-agent

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is codebase risk analysis and how does delta analysis work?

Codebase risk analysis identifies vulnerabilities by comparing a current location path against a target state prompt. Delta analysis works by parsing the differences between these states to evaluate transition risks, scoring them on a likelihood and impact matrix to produce a structured risk report.

How do I prioritize software security vulnerabilities using a risk matrix?

You can prioritize software security vulnerabilities by scoring identified transition risks on a likelihood and impact matrix. This process categorizes risks into P0 critical, P1 high-value, and P2 low-risk classifications, generating a final risk matrix ready for review.

Can I generate a threat modeling report from a repository path and a goal?

Yes, you can generate a threat modeling report by providing a repository location path as the current state and a goal prompt as the target state. The analysis identifies vulnerabilities, applies likelihood and impact scoring, and emits a prioritized report suitable for action.

Does risk analysis for codebases require external dependencies or tools?

No, codebase risk analysis requires no external dependencies or tools. You simply provide the repository location path and the target state prompt to initiate the assessment, and the analysis handles the vulnerability identification and risk report generation internally.

What is the best way to document transition risks when refactoring a codebase?

The best way to document transition risks is to run a delta analysis comparing the current codebase location against the target refactoring goal. This evaluates vulnerabilities, classifies them into P0, P1, and P2 priority levels, and outputs a structured risk report for review.