Phase 3 risks
Skill exchanet/method_enterprise_builder_planning/agents/antigravity/.agent/skills/phase-3-risks
🏗️ Universal 8-phase methodology for planning and building enterprise-grade, mission-critical software with AI coding agents. Supports Cursor AI, Claude Code, Kimi Code, Windsurf & Google Antigravity. Includes ADR validator, microtask linter & CI/CD templates. ≥99% test coverage. MIT.
npx -y skills add exchanet/method_enterprise_builder_planning --skill phase-3-risksAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Phase 3 — Risk Matrix with STRIDE threat modeling and technical risk catalog
SKILL.md
2.5 KB, as published. Nobody here has run it
Skill: Phase 3 — Risk Matrix
Purpose
Execute Phase 3: perform STRIDE threat modeling on the primary API surface, build a technical risk catalog, and ensure all CRITICAL risks have mitigations before proceeding to implementation.
STRIDE Analysis Template
| Threat | Component | Attack vector | Severity | Mitigation |
|---|---|---|---|---|
| Spoofing | [Component] | [Attack] | HIGH/CRITICAL | [Mitigation] |
| Tampering | [Component] | [Attack] | HIGH/CRITICAL | [Mitigation] |
| Repudiation | [Component] | [Attack] | MEDIUM/HIGH | [Mitigation] |
| Info Disclosure | [Component] | [Attack] | CRITICAL | [Mitigation] |
| Denial of Service | [Component] | [Attack] | HIGH | [Mitigation] |
| Elevation of Privilege | [Component] | [Attack] | CRITICAL | [Mitigation] |
Technical Risk Catalog Template
| Risk | Probability | Impact | Score | Mitigation |
|---|---|---|---|---|
| [Technical risk] | L/M/H | CRITICAL/HIGH/MEDIUM | [Calculated] | [Mitigation strategy] |
Risk scoring: Probability × Impact = Score
- Low × Critical = HIGH
- Medium × Critical = HIGH
- High × Critical = CRITICAL
Examples from banking-walkthrough.md
STRIDE — Payment API:
- Info Disclosure (IDOR): Customer accesses another customer's transactions — CRITICAL — mitigated by strict account ownership check at repository layer (not controller — prevents bypass)
- DoS: Request flood on payment endpoint — HIGH — mitigated by rate limiting (per account + per IP) + circuit breaker
Technical Risks:
- Card network timeout mid-authorization — Medium probability × CRITICAL impact — mitigated by Saga with compensation + idempotency keys + Outbox pattern
- PostgreSQL primary failure — Low probability × CRITICAL impact — mitigated by synchronous multi-AZ replication + Patroni HA + RTO ≤30s
Gate rule
No CRITICAL risk may remain unmitigated. If a CRITICAL risk has no mitigation, it blocks Phase 4.
All HIGH risks must have at least a documented mitigation strategy (implementation can be deferred, but the strategy must exist).
Output artifact
Save as docs/risk-matrix.md or append to the main planning document.