mathiasandClaude Opus 4.8
8f14c572b9
release / tag (push) Successful in 1s
The two new skills shipped without the name/description frontmatter every other skill carries, so harnesses surfaced them as a bare directory name with no description to match against intent. Add frontmatter (body unchanged). Bump-Type: patch Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
111 lines
4.1 KiB
Markdown
111 lines
4.1 KiB
Markdown
---
|
|
name: regulatory-risk-assessment
|
|
description: Produce a structured regulatory risk assessment / risk-register entry for regulated-industry features (banking, payments, PSD2/PSR, DORA, AML). Use when filing a CAD issue that needs a Risk:LOW/MEDIUM/HIGH level, or designing features touching payments, auth, data storage, or external APIs ("what are the risks?", "compliance gate", "risk register").
|
|
---
|
|
|
|
# regulatory-risk-assessment
|
|
|
|
Produce a structured regulatory risk assessment for a feature, component,
|
|
or integration — generating a risk register entry that satisfies the
|
|
audit requirements of regulated-industry clients (banking, finance,
|
|
insurance, PSD2/PSR, DORA, AML/KYC contexts).
|
|
|
|
**Use when:**
|
|
- Filing a Gitea issue dispatched via CAD (needs Risk: LOW/MEDIUM/HIGH)
|
|
- Designing a feature touching payments, auth, data storage, external APIs
|
|
- Preparing a client deliverable in a regulated industry
|
|
- "what are the risks?" / "compliance gate" / "risk register" in session
|
|
|
|
**Do not use for:** routine refactoring, docs-only changes, internal
|
|
tooling with no external data or user impact.
|
|
|
|
## What this skill produces
|
|
|
|
A docs/risk-register.md section with this schema:
|
|
|
|
### R-[DOMAIN]-[NN] — [Short risk title]
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Risk | What could go wrong (concrete, specific) |
|
|
| Regulatory reference | Which obligation/regulation, if any |
|
|
| Likelihood | H / M / L |
|
|
| Impact | H / M / L |
|
|
| Overall | H / M / L (highest of likelihood x impact) |
|
|
| Mitigation | What we are doing about it |
|
|
| Validation | Test name or Gitea issue number |
|
|
| Status | open / mitigated / accepted |
|
|
|
|
Risk ID namespace:
|
|
R-AUTH-NN authentication and authorization
|
|
R-DATA-NN data storage, retention, privacy
|
|
R-API-NN external API integration
|
|
R-PAY-NN payment and financial transactions
|
|
R-INFRA-NN infrastructure and availability
|
|
R-AGENT-NN agentic / AI execution
|
|
R-COMP-NN compliance and regulatory obligation
|
|
|
|
## Mechanics
|
|
|
|
Step 1 — Scope the assessment
|
|
1. What external systems does this touch?
|
|
2. What user data does it read, write, or transmit?
|
|
3. What happens on silent failure? Loud failure?
|
|
4. What is the blast radius of a worst-case bug?
|
|
5. Is a regulation implicated?
|
|
|
|
Step 2 — Enumerate risks (common examples)
|
|
Auth/OAuth: token theft, refresh failure, insufficient scope
|
|
Email/Gmail: misclassification archives HUMAN thread, PII in logs
|
|
Payment/PAIN.001: wrong amount, duplicate submission, missing field
|
|
Agentic: irreversible action without approval, prompt injection, spirals
|
|
Infra: single point of failure, secret in logs
|
|
|
|
Step 3 — Declare overall risk level
|
|
Highest individual risk = feature overall level (LOW/MEDIUM/HIGH).
|
|
This is the **Risk:** declaration in the CAD agent-ready issue contract.
|
|
|
|
Step 4 — Write validations
|
|
Every mitigation needs a validation:
|
|
- Specific test name (TestXxx)
|
|
- Gitea issue number
|
|
- Manual verification step with acceptance criteria
|
|
Not acceptable: "will test later", "review manually"
|
|
|
|
Step 5 — Update docs/risk-register.md
|
|
Append entries. Create if absent:
|
|
|
|
# Risk Register
|
|
All entries follow R-[DOMAIN]-[NN] schema.
|
|
See skills/regulatory-risk-assessment/SKILL.md for conventions.
|
|
Last updated: [date]
|
|
|
|
## Integration with assessor-loop
|
|
|
|
For complex regulated-industry features (PSD2/PSR, DORA, AML), route to
|
|
mathias/assessor-loop for deep obligation decomposition first.
|
|
Use this skill standalone for internal tooling or general engineering risk.
|
|
|
|
## Integration with CAD
|
|
|
|
Every CAD-dispatched issue must include:
|
|
**Risk:** LOW | MEDIUM | HIGH
|
|
|
|
CAD pre-flight (agentsquad#29) rejects issues without it.
|
|
If genuinely no risks: declare LOW and note why.
|
|
|
|
## Example entry
|
|
|
|
### R-DATA-01 — Email misclassification archives a HUMAN thread
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Risk | LLM labels a real person's email as NOISE, causing auto-archive |
|
|
| Regulatory reference | None (internal) |
|
|
| Likelihood | M |
|
|
| Impact | H |
|
|
| Overall | H |
|
|
| Mitigation | Phase 1 read-only; HUMAN class never auto-archived in any phase |
|
|
| Validation | TestClassifier_HumanThreadNeverArchived; 1-week Phase 1 review |
|
|
| Status | open |
|