Risk Assessment
Framework-directable 3x3 risk assessment for any compliance program
Identifies threats and vulnerabilities, evaluates likelihood and impact via a 3x3 risk matrix, maps findings to any compliance framework (NIST CSF 2.0 by default, or any framework you specify), and recommends risk treatment options with prioritization guidance.
From document to output
Provide a system description, asset inventory, questionnaire answers, or policy documents
Data and systems are classified by sensitivity (regulated, business-critical, internal, public)
The skill identifies reasonable threats and the vulnerabilities they could exploit
Each finding is rated on a 3x3 likelihood/impact matrix and mapped to your target framework
Remediate, accept, transfer, or avoid, with specific prioritized mitigation steps for each finding
What you get back
Every finding is structured JSON: status, evidence, risk level, and remediation in one package. No interpretation required before acting on it.
{
"risk_id": "RSK-001",
"asset_or_system": "Remote Access Portal / EHR Database",
"asset_classification": "regulated_data",
"threat_event": "Credential compromise via phishing or brute force",
"likelihood_score": 3,
"impact_score": 3,
"risk_score": 9,
"risk_level": "high",
"risk_treatment": "remediate",
"recommended_mitigation": [
"Implement MFA for all remote access connections",
"Restrict remote access to trusted devices or VPN"
]
} Three ways to run this skill
The first two are yours to run. The third is the platform, which runs as the instrument behind the practice rather than as a product sold here.
One-click install for Claude and Cowork users. The skill runs as a native tool in your Claude environment. No configuration, no MCP setup. Apache 2.0. 1,500+ installs.
Get on ClawHub →Install as an MCP server in Claude Code, or download the SKILL.md and use it as a system prompt with any LLM. Runs the full methodology against documents you provide. Apache 2.0. No account required.
The same methodology conducted by a practitioner against your actual documents, including an on-site physical walkthrough: asset and ePHI inventory covering your AI surface, likelihood/impact scoring with written rationale, a risk register, a risk management plan, and an attestation-ready summary letter. Delivered as an engagement by Dang's Solutions, Dan Gonzalez's practice, and priced there.
See the Security Risk Assessment12 more skills in the methodology.
HIPAA Gap Analysis, BAA Review, Framework Mapping, Control Assessment, AI Claims Assessment, Part 2 Notice Assessment, Compliance Q&A, Compliance Posture Intake, Document Finder, Legal Page Discovery, Skill Router, and AI Tooling Inventory. All open source under Apache 2.0.
Need this done rather than explained? Dan Gonzalez runs Dang's Solutions, the practice that delivers it.