菜单
Use when the user says /risk-register, "add a risk", "review risks", "escalate R-N", "ack R-N", "resolve R-N", or "show my risk register" during a 90-day ramp or any initiative. Tracks org-level technical risks in any initiative workspace. Six actions: add, review, ack, escalate, resolve, list.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when the user says /org-design <org>, "analyze the org I inherited", "inherited org analysis", "span of control / SPOF / on-call distribution review", or wants a descriptive read of the org structure they just walked into during a senior eng leader ramp. The analyze mode reads a manual org/structure.md + stakeholder memory graph into a 7-section analysis under ~/repos/onboard-<org>/decisions/. The scenario mode projects a reorg (split-team, add-headcount, merge-teams, change-reporting, reduce-headcount), validates it structurally, and gates on explicit user review before writing. reduce-headcount adds a machine layoff-acknowledgment gate (machine-enforced deliberateness; the human confirmation behind the flag is prose-bound, not machine-verified). Do NOT use for codebase architecture (use /architecture-overview).
Use when the user says /strategy-doc <org>, "draft my 90-day plan", "review the 90-day plan", or "challenge the 90-day plan" during a senior eng leader ramp. Phase 1 supports the 90-day-plan mode only — collates /swot + /stakeholder-map + /architecture-overview + free-form notes/*.md into a 7-section markdown artifact under ~/repos/onboard-<org>/decisions/. Cross-org RFC mode is Phase 2 (separate spec).
Use when the user explicitly invokes /glossary, asks to canonicalize a domain term in ./CONTEXT.md, or wants to record agreed-upon project-specific terminology so future sessions and downstream artifacts (ADRs, SDRs, systems-analysis output) stay consistent. Also invoked by define-the-problem and systems-analysis at end-of-skill via the caller-hook contract to offer canonicalization for terms resolved during planning. Write-only format-owner for per-project ./CONTEXT.md. Lazy-create on first term resolution; never auto-write — user approval gates every entry. Do NOT use for: casual term mentions in conversation, code-level naming questions, architectural primitives (Module, Interface, Adapter, Seam — those belong in LANGUAGE.md owned by architecture-overview), general programming concepts, or decisions about why a term was chosen (those belong in docs/superpowers/decisions/ or an ADR).
Use when the user says /ring-review-tiered, "ring review these PRs", "antagonistic ring on this batch", "review PR #N with the ring", or asks to run adversarial / critic review across one or more pull requests. Calibrates critic count to per-PR risk tier — trivial PRs skip the ring, surgical PRs get one cross-dimension critic, medium PRs get two dimension-targeted critics, large/boundary/security PRs get the full 5-critic ring plus arbiter. Use even when the user names a uniform critic count — surface the tier and let them override. Do NOT use for solo single-PR review where the user explicitly asks for the full ring; that's `pr-review-toolkit:review-pr`.
Use when the user says /swot, "landscape analysis", "SWOT analysis", "strengths and weaknesses", or wants to capture, review, or challenge organizational observations.
Use when the user says /onboard <org>, "scaffold a new ramp", "set up onboarding workspace for <org>", or starts a new senior eng leader role. Day-0 scaffolder plus 90-day ramp orchestrator for a per-org workspace: scaffold, cadence nags, 1:1 capture/sanitize with confidentiality enforcement, and graduation are ready; live Calendar scan is deferred (manual paste only). Do NOT use for codebase / architecture onboarding (see `architecture-overview` skill, issue #44).
| name | risk-register |
| description | Use when the user says /risk-register, "add a risk", "review risks", "escalate R-N", "ack R-N", "resolve R-N", or "show my risk register" during a 90-day ramp or any initiative. Tracks org-level technical risks in any initiative workspace. Six actions: add, review, ack, escalate, resolve, list. |
| status | experimental |
| version | 0.1.0 |
Maintains a single durable risk register at <workspace>/risks/register.md for
a senior leader tracking org-level technical risk. Manual-first: no live
integrations. Six actions, all backed by one bun helper.
Announce at start: "I'm using the risk-register skill to track your technical risks."
All state changes go through the script. Never edit register.md by hand.
bun run "$CLAUDE_PROJECT_DIR/skills/risk-register/scripts/risk-register.ts" <action> <ws> [<R-N>] [flags]
(CLAUDE_PROJECT_DIR is harness-provided. If unset, walk up from CWD until a
.git directory is found.) The script is action-first. When the user phrases
it workspace-first ("/risk-register ~/ramps/acme review"), reorder to
action-first before calling.
| Action | Invocation | Effect |
|---|---|---|
| add | add <ws> --desc "<text>" [--likelihood low|med|high] [--impact …] [--owner …] [--mitigation …] | Append a risk. Only --desc required; likelihood/impact default to med, owner/mitigation to TBD. |
| review | review <ws> [--stale-days N] | Read-only meeting glance: summary header, escalated, stale, top-3 active. Default action. |
| ack | ack <ws> <R-N> | Bump last-reviewed; no status change. |
| escalate | escalate <ws> <R-N> | Flip to escalated; bump last-reviewed. |
| resolve | resolve <ws> <R-N> | Flip to resolved; drops out of review, stays in list. |
| list | list <ws> | All risks including resolved, with IDs. |
If the user gives no action, default to review (highest-frequency, read-only).
review and list always show the R-N ID next to each description. For
mutating actions the user may name a risk by description substring instead of an
ID — resolve it to the R-N from the latest list/review, then CONFIRM before
calling the script:
Escalate R-7 "API auth keys not rotated"?
The script accepts R-N only. Substring resolution lives here, not in the script,
so evals stay deterministic.
The helper prints Status: ready (risk-register) to stderr on every run.
Register lives at <ws>/risks/register.md. The skill takes any directory path;
it does not require an /onboard workspace. See
the design spec
for the full design.