| name | feature-risk-assessment |
| title | Feature Risk Assessment |
| description | Deeper risk assessment for a single feature or product area when the launch review found something that needs more than a line item. Structured analysis: what could go wrong, how likely, how bad, what mitigates it. Use when user says "deep dive on this risk", "risk assessment for [feature]", "what could go wrong with", or when launch-review flags a novel issue. |
| author | anthropics |
| author_url | https://github.com/anthropics/claude-for-legal/tree/main/product-legal/skills/feature-risk-assessment |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | regulatory |
| language | en |
Feature Risk Assessment
Matter context
Matter context. Check ## Matter workspaces in the practice-level CLAUDE.md. If Enabled is ✗ (the default for in-house users), skip the rest of this paragraph — skills use practice-level context and the matter machinery is invisible. If enabled and there is no active matter, ask: "Which matter is this for? Run /product-legal:matter-workspace switch <slug> or say practice-level." Load the active matter's matter.md for matter-specific context and overrides. Write outputs to the matter folder at ~/.claude/plugins/config/claude-for-legal/product-legal/matters/<matter-slug>/. Never read another matter's files unless Cross-matter context is on.
Purpose
The launch review is broad. This is deep. When a single issue needs more than a table row — a novel AI feature, a children's product, something a regulator is actively looking at — this skill produces a standalone assessment.
Not every launch needs one. Most don't. This is for the 10% where "PIA done, shipped" isn't the right level of scrutiny.
When to run this
- Launch review found a pattern that's not in the calibration table (novel)
- Launch review found something in the "usually blocks" category
- GC or leadership asked "what's the risk here" and wants more than a one-liner
- The feature is in an area with active regulatory attention (AI, children, biometric, health)
- Someone outside legal is worried and a structured answer would help
If none of the above, the launch review is enough. Don't generate paperwork for its own sake.
Structure
1. What we're assessing
One paragraph. What the feature does, what's new about it, why it got escalated to a full assessment.
2. The risks
For each distinct risk (aim for 2-5, not 15):
### Risk [N]: [Short name]
**Scenario:** [What would have to happen for this to go wrong. Be specific —
not "data breach" but "the recommendation algo surfaces a user's sensitive
category interest to someone who shouldn't see it because X."]
**Who gets hurt:** [Users? The company? A third party? Specific.]
**How likely:** [Low / Medium / High — with a reason. "Low — would require
both X and Y to fail simultaneously." Not just a vibes rating.]
[Low / Medium / High — with a reason. "High —
regulatory fine + class action exposure + press" vs. "Low — one angry
tweet, no actual harm."]
[What already reduces the likelihood or impact]
[What's missing, if anything]
[After existing mitigations — is this acceptable or does
it need more?]
