gonzalezpazmonica/risk-scoring
.claude/skills/risk-scoring/SKILL.md
Calculate risk score for tasks and route to appropriate review level
$ install --global
skillsauthnpx skillsauth add gonzalezpazmonica/pm-workspace risk-scoringInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 8:50 PM1.7s1 file scanned
SKILL.md
- name:
- risk-scoring
- description:
- Calculate risk score for tasks and route to appropriate review level
- summary:
- |
- 8 factores:
- complejidad, seguridad, deps, cobertura, etc.
- maturity:
- beta
- context:
- fork
- agent:
- architect
- category:
- quality
- tags:
- ["risk", "scoring", "escalation", "review-routing"]
- priority:
- high
Risk Scoring for Intelligent Escalation
Automated 4-phase pipeline to assess task complexity and route code reviews to appropriate escalation levels based on risk factors, replacing fixed Code Review rules with intelligent, data-driven routing.
Decision Checklist
Before scoring, answer sequentially:
- Does the change touch critical paths (auth, payments, data migration)? -> If YES: minimum score = 51 (High)
- Is this a security patch or compliance fix? -> If YES: auto-escalate to Critical (76+)
- Does the PR introduce new external dependencies? -> If YES: add +10 to base score
- Is this the author's first change to this module? -> If YES: add +10 (unfamiliarity penalty)
- Are there >500 lines changed? -> If YES: add +15 to base score
Abort Conditions
- PR modifies .env, secrets, or credentials -> STOP, mandatory security review
- PR has no tests and touches business logic -> STOP, require tests first
Phase 1: Collect Risk Signals
Extract risk indicators from task metadata: files touched, modules affected, external dependencies, security tags, compliance tags, data migration, production impact, change history.
Phase 2: Calculate Risk Score (0-100)
Weighted scoring system across 8 dimensions: file count, module criticality, external dependencies, security, compliance, data impact, historical signals.
Phase 3: Route to Review Level
Four-tier escalation based on score (enforced, not advisory):
- Low (0-25): Skip consensus panel. Auto-merge after PR Guardian Gates 1-5 pass. Spot-check only
- Medium (26-50): Standard 4-judge consensus panel (reflection + code + business + performance)
- High (51-75): Full 4-judge consensus + mandatory human reviewer. Veto on any CRITICAL finding
- Critical (76-100): Full consensus + security team review + PM approval. Block merge until all sign off
Phase 4: Generate Risk Report
Comprehensive breakdown with score, factor breakdown, review requirements, suggested reviewers, timeline, and mitigations.
Integration Points
- PR Guardian Gate 7: Risk score informs context impact analysis
- consensus-validation: Tier determines which judges run (Low skips, Medium-Critical runs full panel)
- dag-scheduling: High/Critical PRs dispatch judges via DAG for parallel execution
- Audit Trail: All routing decisions logged to
output/risk/{timestamp}-{pr}.json - PM Override: Can manually escalate or de-escalate tier
Related Skills
gonzalezpazmonica/skill-creator
testing
VerifiedTrustedCommunity
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
40SKILL.mdUpdated May 24, 2026
gonzalezpazmonica/mcp-builder
tools
VerifiedTrustedCommunity
Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).
40SKILL.mdUpdated May 24, 2026
gonzalezpazmonica/wellbeing-guardian
tools
VerifiedTrustedCommunity
Sistema proactivo de bienestar individual
33SKILL.mdUpdated Apr 17, 2026
gonzalezpazmonica/web-research
development
VerifiedTrustedCommunity
Search the web to resolve context gaps — documentation, versions, CVEs, best practices. Auto-starts SearxNG Docker if available, falls back to WebSearch.
33SKILL.mdUpdated Apr 17, 2026