vc-risk-evidence-pack

Generate and validate five-artifact evidence packs for high-risk code changes.

Updated Apr 9, 2026
One-click install
npx skills add https://github.com/HyuseCS/project-c --skill vc-risk-evidence-pack-hyusecs
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: vc-risk-evidence-pack
Source: https://github.com/HyuseCS/project-c/tree/main/.claude/skills/vc-risk-evidence-pack
Command: npx skills add https://github.com/HyuseCS/project-c --skill vc-risk-evidence-pack-hyusecs

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? High-risk changes like auth flows, billing logic, or schema migrations often get finalized without durable proof of review, making work hard to audit, resume, or hand off. This Skill enforces a manual-first evidence pack so risky work is reviewable before it is marked done. ## Core Features & Use Cases - Six High-Risk Class Definitions: Classifies work across auth/identity, billing/credits, schema migrations, public API contracts, deploy/runtime behavior, and permission/secret/trust-boundary logic. - Five-Artifact Schema: Defines risk-gate.json, context-snippets.json, verification.json, review-decision.json, and adversarial-validation.json, colocated in the plan's task folder harness directory. - Validation Scripts: Ships two Node.js validators that check artifact presence, required fields, risk levels, and explicit APPROVE/REJECT review decisions. - Use Case: Before merging a change to Stripe credit accounting, generate the evidence pack, run the validator against the harness directory, and record an explicit reviewer decision instead of relying on narrative updates. ## Quick Start Ask the agent to generate a risk evidence pack for the current high-risk change and validate it with the bundled script before finalizing.

Frequently Asked Questions about vc-risk-evidence-pack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create an evidence pack for a high-risk code change?

Create a harness directory inside the selected plan's task folder and add five JSON artifacts: risk-gate.json, context-snippets.json, verification.json, review-decision.json, and adversarial-validation.json. Then run the bundled validate-evidence-pack.mjs script against the directory.

What counts as a high-risk change requiring an evidence pack?

Six classes qualify: auth or identity flows, billing or credit accounting, schema migrations or destructive writes, public API or external contract changes, deploy/runtime/container/proxy behavior, and permission, secret, or trust-boundary logic.

How do I validate risk artifacts with the Node script?

Run node .claude/skills/vc-risk-evidence-pack/scripts/validate-risk-artifacts.mjs followed by the artifact directory path. The script checks required fields, risk level values, and decision enums, exiting with code 1 on failures.

Does the evidence pack block CI or run automatically?

No. The contract is manual-first and opt-in by risk class. The validators check shape only and do not hook into CI or enforce adoption by default; the auto-stop rule is a workflow convention, not a blocking hook.

When is adversarial-validation.json required?

It is required when the path is high-risk or attack-sensitive, such as auth bypass, privilege escalation, secret exfiltration, or trust-boundary violations. Each scenario must record whether it was ruled out with a written rationale.