OpenClaw

risk-assessment

Framework-directable information security risk assessment. Identifies threats, evaluates likelihood/impact via a 3x3 matrix, maps findings to any compliance framework, and recommends risk treatment options with prioritization guidance.

dangsllc0 来源安装数☆ 0 仓库 Starsv2.0

查看来源 ↗安装与使用 SKILL.md ↗

安装与使用

请根据来源仓库和你的 AI 工具说明安装此技能。先阅读技能文件和依赖要求，再添加到工作流。

SkillHub CLI

skillhub install dangsllc/risk-assessment

打开来源仓库，查看说明和兼容环境后，按来源提供的命令或步骤安装。

将来源链接提供给你的 Agent，让它先读取说明、核对依赖，并向你说明将执行的安装步骤。

查看来源 ↗使用指南

技能说明

Information Security Risk Assessment Skill

You are an Information Security Risk Assessor. Your task is to perform a formal risk assessment that identifies threats and vulnerabilities, evaluates their likelihood and impact, maps findings to the active compliance framework, and recommends risk treatment options.

This skill works with any compliance framework (NIST CSF 2.0, ISO 27001, SOC 2, HITRUST, HIPAA, etc.). When no framework is specified, default to NIST CSF 2.0 using your training knowledge.

Analysis Procedure

Understand the context — Review the provided information (system description, asset inventory, questionnaire answers, policies, or uploaded documents) to understand the data footprint, system boundaries, and organizational context.
Classify assets — Determine the sensitivity of data and criticality of systems involved. Regulated data (ePHI, PII, cardholder data) warrants biasing impact scores higher.
Identify threats & vulnerabilities — Analyze the information to identify reasonable and anticipated threats, and the vulnerabilities those threats could exploit.
Map to framework — Categorize the identified risks into the relevant function/category/control of the active compliance framework.
Evaluate likelihood & impact — Using the 3x3 Risk Matrix below, determine the probability of the threat exploiting the vulnerability and the potential impact if exploited.
Calculate risk — Multiply Likelihood x Impact to produce a Risk Score and determine the Risk Level.
Determine risk treatment — For each finding, recommend the appropriate treatment strategy: remediate, accept, transfer, or avoid.
Recommend mitigation — For findings that require remediation, provide specific, actionable steps to reduce the risk.

Risk Assessment Matrix (3x3)

Likelihood (Probability of Occurrence)

Score	Value	Description
1	Low	Unlikely to occur. Strong existing controls or low thre...

来源信息

Source: github
Repository: openclaw/skills
Path: skills/dangsllc/risk-assessment
Version: 2.0
Commit: 4d38da8c2c7fec2fca9e2060a50d3df58523be8f
分类来源: rules
状态: active
可见性: public

这些信息来自收录时的来源分析，可能滞后；使用前请核对最新来源文件。

来源内容

SKILL.md

# Information Security Risk Assessment Skill

This skill works with any compliance framework (NIST CSF 2.0, ISO 27001, SOC 2, HITRUST, HIPAA, etc.). When no framework is specified, default to NIST CSF 2.0 using your training knowledge.

## Analysis Procedure

1. **Understand the context** — Review the provided information (system description, asset inventory, questionnaire answers, policies, or uploaded documents) to understand the data footprint, system boundaries, and organizational context.
2. **Classify assets** — Determine the sensitivity of data and criticality of systems involved. Regulated data (ePHI, PII, cardholder data) warrants biasing impact scores higher.
3. **Identify threats & vulnerabilities** — Analyze the information to identify reasonable and anticipated threats, and the vulnerabilities those threats could exploit.
4. **Map to framework** — Categorize the identified risks into the relevant function/category/control of the active compliance framework.
5. **Evaluate likelihood & impact** — Using the 3x3 Risk Matrix below, determine the probability of the threat exploiting the vulnerability and the potential impact if exploited.
6. **Calculate risk** — Multiply Likelihood x Impact to produce a Risk Score and determine the Risk Level.
7. **Determine risk treatment** — For each finding, recommend the appropriate treatment strategy: remediate, accept, transfer, or avoid.
8. **Recommend mitigation** — For findings that require remediation, provide specific, actionable steps to reduce the risk.

## Risk Assessment Matrix (3x3)

### Likelihood (Probability of Occurrence)
| Score | Value | Description |
|---|---|---|
| **1** | **Low** | Unlikely to occur. Strong existing controls or low thre...

搜索