Skip to content

Commit c4be9b6

Browse files
raifdmuellerraifdmueller
authored
Merge pull request #5 from LLM-Coding/feature/risk-mitigate-skill
feat: /risk-mitigate skill (Issue #3)
2 parents ffca666 + 2c63a41 commit c4be9b6

1 file changed

Lines changed: 234 additions & 0 deletions

File tree

‎.claude/skills/risk-mitigate/SKILL.md‎

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
---
2+
name: risk-mitigate
3+
description: Help implement mitigation measures based on the risk assessment in CLAUDE.md. Detects existing tools, installs missing ones, and tracks progress.
4+
disable-model-invocation: true
5+
---
6+
7+
# /risk-mitigate — Implement Mitigation Measures
8+
9+
Read the shared risk model at `.claude/skills/shared/risk-model.md` for all measure definitions, detection signals, tier requirements, and output formats. Do not duplicate those lists here — always reference the shared model as the single source of truth.
10+
11+
---
12+
13+
## Step 1 — Read Assessment from CLAUDE.md
14+
15+
1. Read the project's `CLAUDE.md` file.
16+
2. Look for a section titled `## Risk Radar Assessment`.
17+
3. If not found, stop and tell the user:
18+
> No Risk Radar Assessment found in CLAUDE.md. Please run `/risk-assess` first.
19+
4. If found, parse every `### Module: {name}` subsection. For each module extract:
20+
- The five dimension scores (codeType, language, deployment, data, blastRadius)
21+
- The overall **Tier** (1–4)
22+
5. Print a summary table:
23+
24+
```
25+
Found N module(s) with risk assessments:
26+
| Module | Tier | Highest Dimension |
27+
|--------|------|-------------------|
28+
| ... | ... | ... |
29+
```
30+
31+
---
32+
33+
## Step 2 — Detect Existing Mitigations
34+
35+
For each module (or repo-wide for measures like CI and linting):
36+
37+
### 2a. Determine project type
38+
39+
- **JavaScript/TypeScript**: `package.json` exists
40+
- **Python**: `pyproject.toml`, `requirements.txt`, or `setup.py` exists
41+
- **Rust**: `Cargo.toml` exists
42+
- **Multi-language**: multiple of the above
43+
44+
### 2b. Check detection signals
45+
46+
Use the **Detection signals** tables in `.claude/skills/shared/risk-model.md` (one per tier) to check which mitigations are already present.
47+
48+
**Tier 1 checks:**
49+
50+
| Measure | What to check |
51+
|---------|---------------|
52+
| Linter | Files: `.eslintrc*`, `eslint.config.*`, `ruff.toml`, `.pylintrc`. Scripts: `lint` in package.json |
53+
| Formatter | Files: `.prettierrc*`, `rustfmt.toml`. Config: `black` or `ruff.format` in pyproject.toml |
54+
| Type Checking | `tsconfig.json` with `"strict": true`. Python: `mypy.ini` or `[tool.mypy]` in pyproject.toml |
55+
| Pre-Commit Hooks | Dirs: `.husky/`. Files: `.pre-commit-config.yaml`. Config: `lint-staged` in package.json |
56+
| Dependency Check | `audit` step in CI workflows. Python: `pip-audit` or `safety` in dependencies |
57+
| CI/CD | Dirs: `.github/workflows/`. Files: `Jenkinsfile`, `.gitlab-ci.yml` |
58+
59+
**Tier 2 checks:**
60+
61+
| Measure | What to check |
62+
|---------|---------------|
63+
| SAST | `semgrep` or `codeql` in CI workflow files. Dir: `.semgrep/` |
64+
| AI Code Review | `coderabbit.yaml`, Copilot review in CI |
65+
| Property-Based Tests | `fast-check` or `hypothesis` in dependencies |
66+
| SonarQube | `sonar-project.properties`. Sonar step in CI |
67+
68+
**Tier 3 checks:**
69+
70+
| Measure | What to check |
71+
|---------|---------------|
72+
| Branch Protection | Run: `gh api repos/{owner}/{repo}/branches/main/protection` (200 = enabled) |
73+
| Fuzzing | Dir: `fuzz/`. Deps: `cargo-fuzz`, AFL config files |
74+
| Canary/Gradual Deploy | Check CI for canary or blue-green deployment steps |
75+
76+
**Tier 4 checks:**
77+
78+
| Measure | What to check |
79+
|---------|---------------|
80+
| Formal Verification | Files: `*.dfy` (Dafny), `*.tla` (TLA+), SPARK annotations |
81+
| MC/DC Coverage | Coverage config requiring MC/DC |
82+
83+
For each check, record the result as:
84+
- **Present** — config file or tool found and appears correctly configured
85+
- **Missing** — no config found
86+
- **Partial** — config exists but incomplete (e.g., linter config but no CI integration)
87+
88+
---
89+
90+
## Step 3 — Present Gap Analysis
91+
92+
For each module, show a gap analysis table grouped by tier (cumulative up to the module's tier):
93+
94+
```
95+
### Gap Analysis: {module-name} (Tier {N})
96+
97+
#### Tier 1 — Automated Gates
98+
| Measure | Type | Status | Details |
99+
|---------|------|--------|---------|
100+
| Linter & Formatter | deterministic | Present | .eslintrc.js found |
101+
| Pre-Commit Hooks | deterministic | Missing | — |
102+
| ...
103+
104+
#### Tier 2 — Extended Assurance
105+
| Measure | Type | Status | Details |
106+
|---------|------|--------|---------|
107+
| SAST | deterministic | Missing | — |
108+
| ...
109+
```
110+
111+
After the table, summarize:
112+
- Total measures required for this tier: X
113+
- Already present: Y
114+
- Missing: Z
115+
- Completion: Y/X (percentage)
116+
117+
---
118+
119+
## Step 4 — Interactive Implementation
120+
121+
Work through missing measures in priority order: all Tier 1 gaps first, then Tier 2, etc.
122+
123+
For each missing measure:
124+
125+
1. **Explain** what the measure does and why the module's tier requires it.
126+
2. **Ask the user** whether they want to implement it now. Wait for confirmation before proceeding.
127+
3. **Implement** based on the tier level:
128+
129+
### Tier 1 — Install and configure directly
130+
131+
| Measure | JS/TS Project | Python Project |
132+
|---------|---------------|----------------|
133+
| Linter | `npm install -D eslint`, create `eslint.config.js` with recommended rules | `pip install ruff`, create `ruff.toml` |
134+
| Formatter | `npm install -D prettier`, create `.prettierrc` | Add `[tool.ruff.format]` to pyproject.toml or `pip install black` |
135+
| Type Checking | Ensure `tsconfig.json` has `"strict": true` | `pip install mypy`, create `mypy.ini` or add `[tool.mypy]` to pyproject.toml |
136+
| Pre-Commit | `npm install -D husky lint-staged`, `npx husky init`, configure lint-staged in package.json | `pip install pre-commit`, create `.pre-commit-config.yaml` |
137+
| Dependency Check | Add `npm audit` step to CI workflow | Add `pip-audit` step to CI workflow |
138+
| CI Build & Tests | Create `.github/workflows/ci.yml` with install, lint, build, test steps | Create `.github/workflows/ci.yml` with install, lint, test steps |
139+
140+
After installing, **verify** the tool works:
141+
- Run the linter and confirm it executes without config errors
142+
- Run the formatter in check mode
143+
- Run the type checker
144+
- Validate the CI workflow YAML is well-formed
145+
146+
### Tier 2 — Install where possible, suggest for others
147+
148+
| Measure | Action |
149+
|---------|--------|
150+
| SAST (Semgrep) | Create `.github/workflows/semgrep.yml` with Semgrep CI action. Or add CodeQL workflow |
151+
| AI Code Review | Suggest enabling CodeRabbit or Copilot review. Provide setup link |
152+
| Property-Based Tests | JS/TS: `npm install -D fast-check`. Python: `pip install hypothesis`. Create one example test file |
153+
| SonarQube | Create `sonar-project.properties`, add SonarCloud step to CI. Requires user to set up project in SonarCloud |
154+
| Sampling Review | Suggest CODEOWNERS file and PR review policy. Provide template |
155+
156+
### Tier 3 — Configure where possible, guide for others
157+
158+
| Measure | Action |
159+
|---------|--------|
160+
| Branch Protection | Configure via `gh api -X PUT repos/{owner}/{repo}/branches/main/protection` with required reviews, status checks |
161+
| Sandbox/Isolation | Provide guidance for Docker-based isolation, Deno sandbox, or Firecracker setup |
162+
| Fuzzing | JS/TS: Suggest `jsfuzz` or custom property-based fuzzing. Rust: `cargo install cargo-fuzz`, create `fuzz/` dir. Provide starter template |
163+
| Penetration Testing | Provide a recommended schedule and checklist. Suggest tools: OWASP ZAP, Burp Suite |
164+
| Canary Deployments | Provide a workflow template for gradual rollout with auto-rollback |
165+
| PromptBOM/Provenance | Create a `PROMPTBOM.md` template documenting AI model, prompt, and approver for each module |
166+
167+
### Tier 4 — Recommendations and checklists only
168+
169+
| Measure | Action |
170+
|---------|--------|
171+
| Formal Verification | Recommend tools (Dafny, TLA+, SPARK) based on language. Provide getting-started links |
172+
| Independent Re-Verification | Provide a process checklist for independent review per DO-178C DAL A |
173+
| MC/DC Coverage | Recommend coverage tools and configuration for MC/DC. Provide setup guide |
174+
| Contract-Based Design | Suggest libraries: `ts-contract` (TS), `icontract` (Python), `contracts` (Rust). Show example |
175+
| Certification Process | Provide a checklist for relevant standard (IEC 61508, DO-178C, ISO 26262) |
176+
| AI as Draft Aid Only | Suggest a workflow policy document template restricting AI to proposal-only role |
177+
178+
### After each installation
179+
180+
- Verify the tool works (run it, check output)
181+
- Create a git commit for the installed tool:
182+
```
183+
git add <relevant files>
184+
git commit -m "chore: set up {tool name} for {module}"
185+
```
186+
187+
---
188+
189+
## Step 5 — Update CLAUDE.md
190+
191+
After completing implementations (or if the user stops partway through):
192+
193+
1. Open `CLAUDE.md`
194+
2. For each assessed module, add or update a `### Mitigations: {module-name} (Tier N)` section
195+
3. Use the format from `.claude/skills/shared/risk-model.md`:
196+
197+
```markdown
198+
### Mitigations: {module-name} (Tier {N})
199+
200+
_Updated by `/risk-mitigate` on YYYY-MM-DD_
201+
202+
| Measure | Status | Details |
203+
|---------|--------|---------|
204+
| Linter & Formatter | Present | eslint.config.js, .prettierrc |
205+
| Type Checking | Set up | tsconfig.json strict enabled |
206+
| Pre-Commit Hooks | Set up | husky + lint-staged configured |
207+
| SAST | Pending | — |
208+
| Branch Protection | N/A | Not required for Tier 1 |
209+
```
210+
211+
Status values:
212+
- **Present** — was already in place before running this skill
213+
- **Set up** — installed/configured during this session
214+
- **Pending** — required but not yet implemented (user deferred or manual action needed)
215+
- **N/A** — not required at this module's tier level
216+
217+
4. Commit the CLAUDE.md update:
218+
```
219+
git add CLAUDE.md
220+
git commit -m "docs: update mitigation status in CLAUDE.md"
221+
```
222+
223+
---
224+
225+
## Important Guidelines
226+
227+
- **Always read `.claude/skills/shared/risk-model.md`** at the start for the authoritative measure definitions and detection signals. Do not hardcode or duplicate those lists.
228+
- **Never install anything without asking the user first.** Present the measure, explain it, and wait for confirmation.
229+
- **Verify each tool after installation.** Run the tool and confirm it executes without errors.
230+
- **Commit each tool separately.** Each installed mitigation gets its own commit for clean history.
231+
- **Handle both JS/TS and Python projects.** Detect from `package.json` vs `pyproject.toml`/`requirements.txt`.
232+
- **Tiers are cumulative.** A Tier 3 module needs all Tier 1 + Tier 2 + Tier 3 measures.
233+
- **Be conservative with automated configuration.** For measures that require external service setup (SonarCloud, CodeRabbit), provide guidance rather than attempting partial setup that won't work.
234+
- **If a measure is already present, confirm it is properly configured.** A linter config without CI integration is only "Partial".

0 commit comments

Comments
 (0)