| name | risk-assessment |
| description | Classifies Pull Requests to the agent-skills repository as LOW, MEDIUM, or HIGH risk based on what changed — new skills, reference edits, existing skill modifications, or structural changes. Use when reviewing PRs on agent-skills to decide review action (comment, approve, request changes). Includes auto-approval policy for safe additive changes. |
PR Risk Assessment for agent-skills
This skill defines what LOW, MEDIUM, and HIGH risk mean for Pull Requests to the
agent-skills repository. Use these definitions to classify the overall severity
of a PR when reviewing changes to this skill library.
Severity Definitions
LOW Risk
The PR is safe to approve without deep review. Changes are either purely additive
or restricted to content that cannot break existing skill invocations.
Criteria — ALL of the following must be true:
- No existing skill's
name: frontmatter field is modified
- No existing skill directory is deleted or renamed
- No validation scripts (
scripts/, hooks/, Makefile) are modified
- No
AGENTS.md, CODEOWNERS, or package.json are modified
Examples of LOW risk changes:
- Adding a brand new skill (
development/skills/<new-skill>/SKILL.md + references)
— new skills are self-contained and cannot break existing invocations
- Editing
references/ files within any skill (supporting docs, templates, examples)
- Fixing typos or improving wording in an existing
SKILL.md body (not the name: field)
- Updating skill metadata:
description, version, license, metadata.*
- Adding or editing
*.md files at the repo root (README.md, Makers.md, docs/**)
- Adding new
.github/workflows/ files (new CI jobs, not modifying existing ones)
- Adding new category directories (
quality/, business/, etc.)
MEDIUM Risk
The PR modifies existing skill logic or CI behaviour in ways that could affect
how skills are discovered, validated, or executed.
Criteria — ANY of the following:
- Modifying the body/steps of an existing
SKILL.md (changing how a skill instructs
the LLM — could change behaviour for all consumers of that skill)
- Modifying existing
.github/workflows/ files (could break CI for all skills)
- Adding or modifying scripts in
scripts/ that aren't part of validation
- Changing
package.json dependencies or configuration
- Moving a skill to a different category directory
HIGH Risk
The PR makes changes that could break existing skill invocations, validation, or
the repository's structural contracts.
Criteria — ANY of the following makes the PR HIGH risk:
- Renaming or changing the
name: field in any existing skill's frontmatter
— skill consumers invoke skills by name; renaming silently breaks them
- Deleting an existing skill directory
- Modifying validation scripts (
hooks/, scripts/validate*, pre-commit hooks)
that run against all skills — a bug here fails every skill commit
- Modifying
AGENTS.md or CODEOWNERS — changes ownership and access control
- Changing
Makefile targets that other pipelines depend on
File Path Risk Map
| Path Pattern | Default Risk | Notes |
|---|
development/skills/<new>/ | LOW | New skill — fully additive |
*/skills/*/references/** | LOW | Supporting docs, no invocation impact |
*/skills/*/SKILL.md (body edits) | MEDIUM | Behaviour change for skill consumers |
*/skills/*/SKILL.md (name: change) | HIGH | Breaks all invocations by name |
.github/workflows/ (new file) | LOW | Additive CI job |
.github/workflows/ (edit existing) | MEDIUM | Could break CI pipeline |
scripts/, hooks/ | MEDIUM–HIGH | Affects validation and build |
Makefile | MEDIUM–HIGH | Pipeline dependency |
README.md, docs/**, *.md (root) | LOW | Documentation only |
AGENTS.md, CODEOWNERS | HIGH | Access control |
package.json | MEDIUM | Dependency changes |
Auto-Approval Policy
If the following conditions are ALL true, set auto_approve: true in your output:
- The severity assessment is LOW.
- ALL changed files satisfy at least one of:
- Are new files (not modifications to existing files) under
.github/workflows/
- Are within any skill's directory under
*/skills/<skill-name>/ (new skill or references edit)
- Are
*.md files at the repo root or under docs/
- No existing skill's
name: frontmatter field is modified in any changed SKILL.md.
- No existing files are deleted.
If any condition is not met, set auto_approve: false.
If you are uncertain whether a file is new vs modified, set auto_approve: false.
