From prism-devtools
Use to assess and document risk factors for stories or features. Creates risk profiles with mitigation strategies.
npx claudepluginhub resolve-io/.prismThis skill uses the workspace's default tool permissions.
<!-- Powered by PRISMâ„¢ Core -->
Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.
Provides patterns for autonomous Claude Code loops: sequential pipelines, agentic REPLs, PR cycles, de-sloppify cleanups, and RFC-driven multi-agent DAGs. For continuous dev workflows without intervention.
Applies NestJS patterns for modules, controllers, providers, DTO validation, guards, interceptors, config, and production TypeScript backends with project structure and bootstrap examples.
Generate a comprehensive risk assessment matrix for a story implementation using probability × impact analysis.
required:
- story_id: '{epic}.{story}' # e.g., "1.3"
- story_path: 'docs/stories/{epic}.{story}.*.md'
- story_title: '{title}' # If missing, derive from story file H1
- story_slug: '{slug}' # If missing, derive from title (lowercase, hyphenated)
Identify, assess, and prioritize risks in the story implementation. Provide risk mitigation strategies and testing focus areas based on risk levels.
Category Prefixes:
TECH: Technical RisksSEC: Security RisksPERF: Performance RisksDATA: Data RisksBUS: Business RisksOPS: Operational RisksPriority Focus: E2E Integration-Testable Risks
E2E integration tests provide the most effective risk mitigation for cross-system, multi-component, and real-world scenario risks. Prioritize risks that can be validated through complete user workflows and system interactions.
Security Risks (SEC) - Critical Priority for E2E Testing
Data Risks (DATA) - High Priority for E2E Testing
Technical Risks (TECH) - High Priority for E2E Testing
Operational Risks (OPS) - Medium Priority for E2E Testing
Performance Risks (PERF) - Medium Priority for E2E Testing
Business Risks (BUS) - Low Priority for E2E Testing
For each category, identify specific risks with E2E testing focus:
risk:
id: 'SEC-001' # Use prefixes: SEC, PERF, DATA, BUS, OPS, TECH
category: security
title: 'Multi-tenant authentication boundary violation'
description: 'Cross-tenant access possible through compromised auth tokens or session hijacking'
affected_components:
- 'Authentication Service'
- 'API Gateway'
- 'Tenant Context Resolution'
detection_method: 'E2E testing with multi-tenant scenarios'
e2e_testable: true
integration_scope: 'cross-service'
E2E Integration Testing Priority Examples:
# Critical E2E Risks
risk:
id: 'DATA-001'
title: 'Cross-tenant data leakage through shared services'
e2e_validation: 'Complete tenant isolation workflows'
test_scenarios:
- 'Tenant A cannot access Tenant B data through any API endpoint'
- 'Database connections properly isolated by tenant context'
- 'Shared services maintain tenant boundaries'
risk:
id: 'SEC-002'
title: 'API endpoint authentication bypass'
e2e_validation: 'End-to-end authentication workflows'
test_scenarios:
- 'Expired tokens properly rejected across all services'
- 'Service-to-service auth maintained throughout request chain'
- 'Token refresh cycles work across integrated services'
risk:
id: 'TECH-001'
title: 'Container orchestration dependency failure'
e2e_validation: 'Full deployment and runtime scenarios'
test_scenarios:
- 'Service mesh communication under container restarts'
- 'Database connections survive container scaling events'
- 'Load balancing maintains service availability'
Evaluate each risk using probability × impact:
Probability Levels:
High (3): Likely to occur (>70% chance)Medium (2): Possible occurrence (30-70% chance)Low (1): Unlikely to occur (<30% chance)Impact Levels:
High (3): Severe consequences (data breach, system down, major financial loss)Medium (2): Moderate consequences (degraded performance, minor data issues)Low (1): Minor consequences (cosmetic issues, slight inconvenience)Create risk matrix:
## Risk Matrix
| Risk ID | Description | Probability | Impact | Score | Priority |
| -------- | ----------------------- | ----------- | ---------- | ----- | -------- |
| SEC-001 | XSS vulnerability | High (3) | High (3) | 9 | Critical |
| PERF-001 | Slow query on dashboard | Medium (2) | Medium (2) | 4 | Medium |
| DATA-001 | Backup failure | Low (1) | High (3) | 3 | Low |
E2E Integration Testing as Primary Mitigation
For integration-testable risks, E2E tests provide the most comprehensive mitigation:
mitigation:
risk_id: 'SEC-001'
strategy: 'preventive' # preventive|detective|corrective
primary_mitigation: 'E2E Integration Testing'
actions:
- 'Implement comprehensive multi-tenant E2E test suites'
- 'Add tenant boundary validation in all API endpoints'
- 'Create cross-service authentication test scenarios'
- 'Implement tenant context isolation verification'
testing_requirements:
- 'E2E multi-tenant isolation tests (CRITICAL)'
- 'Cross-service authentication flow validation'
- 'API endpoint security boundary testing'
- 'Database connection tenant isolation verification'
- 'Container orchestration failure recovery testing'
e2e_coverage:
- 'Complete tenant lifecycle workflows'
- 'Authentication/authorization across all services'
- 'Data isolation under various load conditions'
- 'Service-to-service communication security'
residual_risk: 'Low - E2E tests validate complete system behavior'
owner: 'qa'
timeline: 'Continuous - with every integration'
E2E Testing Mitigation Priorities:
Critical Risks (Score 9) - Must have comprehensive E2E coverage
High Risks (Score 6) - Require targeted E2E scenarios
Medium/Low Risks - Can use selective E2E validation
Generate for pasting into gate file under risk_summary:
Output rules:
# risk_summary (paste into gate file):
risk_summary:
totals:
critical: X # score 9
high: Y # score 6
medium: Z # score 4
low: W # score 2-3
highest:
id: SEC-001
score: 9
title: 'XSS on profile form'
recommendations:
must_fix:
- 'Add input sanitization & CSP'
monitor:
- 'Add security alerts for auth endpoints'
Save to: qa.qaLocation/assessments/{epic}.{story}-risk-{YYYYMMDD}.md
# Risk Profile: Story {epic}.{story}
Date: {date}
Reviewer: Quinn (Test Architect)
## Executive Summary
- Total Risks Identified: X
- Critical Risks: Y
- High Risks: Z
- Risk Score: XX/100 (calculated)
## Critical Risks Requiring Immediate Attention
### 1. [ID]: Risk Title
**Score: 9 (Critical)**
**Probability**: High - Detailed reasoning
**Impact**: High - Potential consequences
**Mitigation**:
- Immediate action required
- Specific steps to take
**Testing Focus**: Specific test scenarios needed
## Risk Distribution
### By Category
- Security: X risks (Y critical)
- Performance: X risks (Y critical)
- Data: X risks (Y critical)
- Business: X risks (Y critical)
- Operational: X risks (Y critical)
### By Component
- Frontend: X risks
- Backend: X risks
- Database: X risks
- Infrastructure: X risks
## Detailed Risk Register
[Full table of all risks with scores and mitigations]
## E2E Integration Risk-Based Testing Strategy
### Priority 1: Critical E2E Integration Tests
**Multi-Tenant Security & Data Isolation**
- Complete tenant lifecycle E2E scenarios (create, migrate, delete)
- Cross-tenant data access prevention validation
- Authentication/authorization boundary enforcement
- Service-to-service security under tenant context
**Container & Service Integration**
- Full deployment cycle with service dependencies
- Container orchestration failure and recovery
- Database connection management across scaling events
- Service mesh communication reliability
**Test Environment Requirements:**
- Multi-tenant test data isolation
- Container orchestration test infrastructure
- Service mesh configuration validation
- Database per-tenant provisioning
### Priority 2: High Risk E2E Integration Tests
**API Security & Service Communication**
- End-to-end API authentication flows
- Cross-service token validation and refresh
- API gateway routing and security enforcement
- Service discovery and load balancing validation
**Data Consistency & Transaction Management**
- Cross-service transaction integrity
- Database connection pool behavior under load
- Data migration workflows across tenant boundaries
- Backup/recovery procedures in multi-tenant environment
### Priority 3: Medium/Low Risk E2E Integration Tests
**Performance & Monitoring Integration**
- End-to-end response time monitoring
- Cross-service performance impact analysis
- Health check cascading validation
- Business workflow performance under load
**Operational Workflow Integration**
- Complete deployment and rollback procedures
- Monitoring and alerting integration validation
- Configuration management across environments
- Disaster recovery workflow testing
### E2E Test Coverage Metrics
**Critical Success Criteria:**
- 100% tenant isolation validation coverage
- 100% authentication/authorization flow coverage
- 100% service integration failure scenario coverage
- 95% container infrastructure dependency coverage
**Integration Test Types by Risk Category:**
- **SEC Risks**: Cross-service security validation, tenant boundary testing
- **DATA Risks**: Multi-tenant data isolation, cross-service consistency
- **TECH Risks**: Service integration, container orchestration, API gateway
- **OPS Risks**: Deployment workflows, monitoring integration, disaster recovery
## Risk Acceptance Criteria
### Must Fix Before Production
- All critical risks (score 9)
- High risks affecting security/data
### Can Deploy with Mitigation
- Medium risks with compensating controls
- Low risks with monitoring in place
### Accepted Risks
- Document any risks team accepts
- Include sign-off from appropriate authority
## Monitoring Requirements
Post-deployment monitoring for:
- Performance metrics for PERF risks
- Security alerts for SEC risks
- Error rates for operational risks
- Business KPIs for business risks
## Risk Review Triggers
Review and update risk profile when:
- Architecture changes significantly
- New integrations added
- Security vulnerabilities discovered
- Performance issues reported
- Regulatory requirements change
Calculate overall story risk score:
Base Score = 100
For each risk:
- Critical (9): Deduct 20 points
- High (6): Deduct 10 points
- Medium (4): Deduct 5 points
- Low (2-3): Deduct 2 points
Minimum score = 0 (extremely risky)
Maximum score = 100 (minimal risk)
Based on risk profile with E2E integration testing focus:
E2E Testing Priority
Integration Development Focus
Deployment Strategy for Integration Risks
Integration Monitoring Setup
E2E Test Environment Requirements
Deterministic gate mapping:
Print this line for review task to quote:
Risk profile: qa.qaLocation/assessments/{epic}.{story}-risk-{YYYYMMDD}.md
E2E Integration Risk Assessment Focus:
Risk Assessment Process:
E2E Testing as Risk Mitigation: