Risk Assessment
Framework-directable 3x3 risk assessment for any compliance program
Identifies threats and vulnerabilities, evaluates likelihood and impact via a 3x3 risk matrix, maps findings to any compliance framework (NIST CSF 2.0 by default, or any framework you specify), and recommends risk treatment options with prioritization guidance.
From document to output
Provide a system description, asset inventory, questionnaire answers, or policy documents
Data and systems are classified by sensitivity (regulated, business-critical, internal, public)
The skill identifies reasonable threats and the vulnerabilities they could exploit
Each finding is rated on a 3x3 likelihood/impact matrix and mapped to your target framework
Remediate, accept, transfer, or avoid, with specific prioritized mitigation steps for each finding
What you get back
Every finding is structured JSON: status, evidence, risk level, and remediation in one package. No interpretation required before acting on it.
{
"risk_id": "RSK-001",
"asset_or_system": "Remote Access Portal / EHR Database",
"asset_classification": "regulated_data",
"threat_event": "Credential compromise via phishing or brute force",
"likelihood_score": 3,
"impact_score": 3,
"risk_score": 9,
"risk_level": "high",
"risk_treatment": "remediate",
"recommended_mitigation": [
"Implement MFA for all remote access connections",
"Restrict remote access to trusted devices or VPN"
]
} Two ways to run this skill
One-click install for Claude and Cowork users. The skill runs as a native tool in your Claude environment — no configuration, no MCP setup. Apache 2.0. 1,500+ installs installed.
Get on ClawHub →Install as an MCP server in Claude Code, or download the SKILL.md and use it as a system prompt with any LLM. Runs the full methodology against documents you provide. Apache 2.0. No account required.
The same methodology conducted by a practitioner against your actual documents: asset and ePHI inventory including your AI surface, likelihood/impact scoring with written rationale, a risk register, a risk management plan, and an attestation-ready summary letter. $3,500 fixed, 10 business days. MIPS attestation-ready.
See the Security Risk Assessment12 more skills in the methodology.
HIPAA Gap Analysis, BAA Review, Framework Mapping, Control Assessment, AI Claims Assessment, Part 2 Notice Assessment, Compliance Q&A, Compliance Posture Intake, Document Finder, Legal Page Discovery, Skill Router, and AI Tooling Inventory. All open source under Apache 2.0.