Automated the full lifecycle of security risk management: from a self-service Slack form anyone in the company can submit, through security team review, to a fully populated risk register and Linear tracking issue. Built with Claude Cowork skills, Slack workflows, and Google Apps Script.
Anyone fills out a simple form in #risk-intake. Six fields capture enough context for a full risk assessment. No security expertise required.
The submission posts to #risk-review, visible only to the security team. Each submission arrives as a structured message with all form fields populated.
The reviewer adds the calls that require judgment: likelihood, impact dimensions, risk response strategy, and owner. These go in a thread reply.
A checkmark reaction marks the submission as approved. The pipeline picks it up on the next scheduled run.
The system creates a Linear issue in the Risk project with a structured description: risk details, assessment table, controls, and treatment plan.
Google Apps Script populates all 28+ non-formula columns in a single execution. No cell-by-cell clicking. Every field lands in the right column.
Column A of the risk register row gets a rich-text hyperlink to the Linear issue. This is the source of truth for whether a risk is being tracked.
The pipeline replies in the review thread with the risk ID, Linear issue link, and a clipboard emoji reaction to mark it complete.
Early attempts to populate the spreadsheet involved clicking into each cell and typing values. This was fragile: the Name Box did not navigate reliably, cells sometimes did not activate, dropdowns were finicky. A single Apps Script function writes all 28+ columns in one execution. If your workflow involves Google Sheets and you are automating through the UI, stop and write an Apps Script instead.
Encodes the 33-column register structure, risk statement patterns, Linear description templates, rating scales, and Apps Script templates. Supports structured and quick-intake modes.
Weekday mornings at 9am, the pipeline scans #risk-review for approved submissions. Each one gets a Linear issue, a populated register row, and a confirmation reply.
A public-channel workflow form collects risk submissions from anyone in the company. Structured fields feed directly into the review pipeline.
Creates issues in the Risk project with structured descriptions. Links risk IDs to the register via column A hyperlinks.
Two functions: one writes all non-formula columns in a single execution, the other sets rich-text hyperlinks programmatically. No manual cell navigation.
The risk register: 33 columns across four sections covering identification, assessment, treatment, and monitoring. Formula columns calculate residual risk automatically.
Anyone in the company can submit a security risk from Slack. No security expertise required, no knowledge of the register structure or tracking tools.
Apps Script writes all 28+ non-formula columns in a single execution. Risk statement, ratings, owner, treatment plan, and monitoring fields all land in the right cells.
Every risk gets a Linear issue with a structured description template. Column A of the register hyperlinks to the issue as the single source of truth.
The skill generates structured risk statements: "[Threat] increases the risk of [Event], leading to [Impact]." Consistent language across the register.
A scheduled task runs every weekday morning. Approved submissions from the previous day are processed automatically alongside existing GRC triage work.
Drop in raw notes, a Slack thread, or a pentest finding. The skill drafts the full risk assessment in one response for the reviewer to confirm.