risk-based-verification

name	risk-based-verification
description	Match verification depth to change risk. Use after code, test, config, dependency, data, or docs changes. Helps agents choose targeted checks for low risk, broader checks for medium/high risk, and report unverified residual risk clearly.

Risk-Based Verification

Use this skill to verify enough without wasting effort or claiming false confidence.

Risk levels

Low risk:

• small local change
• no public contract or data change
• existing tests cover area
• reversible

Medium risk:

• multiple files or boundaries
• new branch/error path
• test coverage uncertain
• behavior visible to users or other modules

High risk:

• data migration or destructive operation
• security/privacy/auth change
• dependency/runtime upgrade
• concurrency/distributed behavior
• public contract or compatibility change

Verification choices

• Low: targeted unit test, focused lint/type/build check, or direct script/example.
• Medium: affected test suite, integration/contract check, diff review, edge-case tests.
• High: broad test suite, migration/rollback validation, security review, performance check, manual approval when needed.

Final report

Always state:

• checks run
• checks not run
• why verification is sufficient or what risk remains