End-to-end automation for security risk management: from raw input to a fully populated risk register row and linked tracking issue. Supports structured assessments and quick intake from unstructured notes, chat threads, or pentest findings.
↓ Download SKILL.mdmkdir -p .claude/skills/risk-assessment
cp SKILL.md .claude/skills/risk-assessment/SKILL.mdOnce installed, Claude references the risk statement patterns, register column structure, and tracking issue templates whenever you mention adding a risk, conducting an assessment, or processing intake submissions. Point it at your own spreadsheet and tracker, and the patterns adapt.
Drop in raw notes, a chat thread, or pentest findings. The skill drafts the risk statement, description, and proposed ratings in a single response. Confirm and the system populates everything.
Step-by-step guided risk assessment covering all 18 required fields. Likelihood, five impact dimensions, control effectiveness, treatment strategy, and ownership.
Google Apps Script templates that write all non-formula columns in a single execution. No cell-by-cell clicking. Spacer columns and formula columns are handled automatically.
Structured issue descriptions with risk analysis, compensating controls, recommendations, and a security metadata table. Column A of the register hyperlinks to the issue as the source of truth.
A chat workflow form lets anyone in the company submit a risk. Submissions route to a private review channel. A scheduled task processes approved submissions automatically.
The Treatment Status field is the one value the skill never proposes on its own. Whether a risk is "Not Started," "Accepted," or "In Progress" is a judgment call that belongs to the operator. Always ask.
Early attempts to populate the register involved clicking into each cell and typing values. Fragile. A single Apps Script function writes all 28+ columns in one execution. If your workflow involves Google Sheets and you are automating through the UI, write an Apps Script instead.
Humans provide the security assessment: likelihood, impact, ownership, treatment strategy. The system handles the mechanical work: formatting the data, creating the issue, populating the spreadsheet, setting the hyperlink.
Name the actual vendor, tool, or system. "Unvetted use of Lovable by staff" over "unvetted use of no-code platforms." "Workday" over "HR systems." Specificity is what makes risk statements actionable.
[Threat/Condition] increases the risk of [Risk Event],
leading to [Impact/Consequence]The skill generates statements that name the specific threat, describe the risk event concretely, and tie it to a business consequence. The description field expands on the statement with 2-3 paragraphs covering context, attack vectors, current controls, and potential consequences.
This skill covers the end-to-end workflow for documenting, assessing, and triaging security risks. The two primary outputs are: (1) a row in the Risk Register spreadsheet, and (2) a corresponding issue in the project tracker for triage and tracking.
The fast path for capturing a new risk. The operator provides raw input and the skill handles generating documentation, populating the spreadsheet, creating the tracking issue, and linking them together.
The key principle: propose everything upfront. Let the operator correct rather than asking one question at a time.
The register is a 33-column Google Sheet organized into four sections: Identification (columns A-J), Assessment (L-T), Residual Risk (V-Y), and Treatment (AA-AG). Spacer columns separate the sections. Formula columns calculate inherent and residual risk ratings automatically.
Pattern: [Threat/Condition] increases the risk of [Risk Event], leading to [Impact/Consequence]
Be specific: name the actual vendor, tool, or system. Refer to the affected population accurately. Use the full format that includes threat, risk event, and consequence.
Multi-paragraph narratives covering: context, threat scenario, current controls, specific vulnerabilities, and potential consequences. For vulnerability-based risks, include technical details such as CVEs, affected versions, and attack mechanisms.
Collect 18 data points covering identification, assessment, controls, and treatment. Draft the risk statement and description, propose all ratings, and confirm with the operator before populating anything.
Critical rule: Always ask for Treatment Status. Never assume a value.
Both population and hyperlinking use Google Apps Script for reliability. A single populateRisk() function writes all non-formula columns in one execution. A separate setHyperlinks() function sets rich-text links from column A to the tracking issue URL.
The hyperlink array supports batch operations, so multiple risks can be linked in a single script execution.