Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/sd0xdev/sd0x-harnessnpx agentmods add skills/sd0xdev/sd0x-harness/risk-assessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sd0xdev/sd0x-harness/risk-assess)<a href="https://agentmods.dev/skills/sd0xdev/sd0x-harness/risk-assess"><img src="https://agentmods.dev/badge/skills/sd0xdev/sd0x-harness/risk-assess.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.00826 |
| Opus 5 | $0.00039 | $0.00413 |
| Sonnet 5 | $0.00015 | $0.00165 |
| Haiku 4.5 | $0.00008 | $0.00083 |
Grade A, and why
risk-assess scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Risk Assessment
When NOT to Use
- Security vulnerability detection (use
/codex-security) - Code correctness / lint / test review (use
/codex-review-fast) - Project-level health audit (use
/project-audit)
Procedure
- Run
bash scripts/run-skill.sh risk-assess risk-analyze.js --jsonto collect deterministic scores - Parse the JSON output — overall_score, risk_level, dimensions, flags, gate, next_actions
- If risk_level = Critical (score 75-100) — highlight all breaking signals, recommend splitting PRs
- If risk_level = High (score 50-74) — auto-escalate to
--mode deep, detail blast radius - If risk_level = Medium (score 30-49) — summarize dimensions, note areas of concern
- If risk_level = Low (score 0-29) — brief summary, confirm safe to proceed
- Add qualitative interpretation beyond the scores (e.g., "high blast radius but all dependents are test files")
Script Integration
The script analyzes 3 dimensions + 2 conditional flags:
| Dimension | Weight | What It Measures |
|---|---|---|
| breaking_surface | 45% | Removed exports, renamed APIs, changed signatures, deleted modules |
| blast_radius | 35% | Number of files importing changed modules (grep-based) |
| change_scope | 20% | File count, LOC delta, directory span, rename ratio |
| Flag | Trigger | What It Checks |
|---|---|---|
| migration_safety | Migration/schema files in diff | Rollback/down file exists |
| regression_hint | (v2 stub) | Future: git history analysis |
Scoring Model
- Overall:
breaking_surface * 0.45 + blast_radius * 0.35 + change_scope * 0.20 - Each dimension: 0-100 scale
- Overall: 0-100 scale
Risk Levels
| Score | Level | Gate | Exit Code |
|---|---|---|---|
| 0-29 | Low | PASS | 0 |
| 30-49 | Medium | PASS | 0 |
| 50-74 | High | REVIEW | 1 |
| 75-100 | Critical | BLOCK | 2 |
Script Failure Fallback
If the script fails, report the error and suggest running manually:
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 97 lines · 77 tokens per session scan A 341157fd9a33
risk-assess is a skill published in the GitHub repository sd0xdev/sd0x-harness (188 stars, last pushed 2d ago), licensed MIT. It adds 77 tokens to every session and 826 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
code-review
Two-mode skill: (1) adversarial review — spec compliance + code quality + security, confidence-scored findings with file:line evidence; (2) receiving review — verify-before- agreeing discipline for acting on external/human review feedback.
codebase-hygiene
Two-mode skill: (1) find semantic duplicates — functions doing the same thing under different names, invisible to copy-paste detectors; (2) deepen shallow modules — thin wrappers and pass-through layers that spread complexity. Advisory and read-only; changes route through BUILD with full gates.
evaluator-review-contract
Internal Auto-Harness evaluator skill for sprint contract review before implementation. Use only inside the Evaluator subagent during review mode.
comet-verify
Comet Phase 4: Verify and Close. Invoke with /comet-verify. Verify implementation matches design, handle development branch.
comet-review
A read-only review guide for checking the current Comet change, a managed software-change workflow. It focuses on correctness, security, and boundary problems without changing files or advancing the workflow.
comet-github-pr-review
A read-only review process for pull requests in Comet's GitHub repositories. A pull request is a proposed code change; the review checks its current code, related issue, comments, merge status, and automated checks.