Agent Skills: research-risk

  <substep n="1a" title="Track Progress">
    <action if="first iteration">Create todo list from all instruction step titles (TodoWrite)</action>
    <action>Mark current step as in_progress (TodoWrite)</action>
  </substep>

  <substep n="1b" title="Handle Step Attributes">
    <check>If optional="true" and NOT YOLO -> Use Question tool to ask user whether to include (Yes/Skip)</check>
    <check>If if="condition" -> Evaluate condition</check>
    <check>If for-each="item" -> Repeat step for each item</check>
    <check>If repeat="n" -> Repeat step n times</check>
  </substep>

  <substep n="1c" title="Execute Step Content">
    <action>Process step instructions (markdown or XML tags)</action>
    <action>Replace {{variables}} with values (ask user if unknown)</action>
    <execute-tags>
      <tag>action -> Perform the action</tag>
      <tag>action type="script" -> Execute as shell command, capture output</tag>
      <tag>check if="condition" -> Conditional block wrapping actions (requires closing &lt;/check&gt;)</tag>
      <tag>ask -> Prompt user using Question tool and WAIT for response. When options exist, present them as selectable choices. For open-ended questions, provide helpful suggested options with custom input enabled</tag>
      <tag>invoke-skill name="skill-name" -> Execute another skill via OpenCode skill system</tag>
      <tag>invoke-agent name="subagent" prompt="task" -> Delegate to subagent via Task tool</tag>
      <tag>goto step="x" -> Jump to specified step (used for explicit loop-back in Q-R style flows)</tag>
    </execute-tags>
  </substep>

  <substep n="1d" title="Handle template-output Tags">
    <if tag="template-output">
      <mandate>Generate content for this section</mandate>
      <mandate>Save to file (Write first time, Edit subsequent)</mandate>
      <action>Display generated content</action>
      <action>Use Question tool to present checkpoint options. WAIT for response.
        <options>
          <option label="Continue" description="Approve this section and move to the next step" />
          <option label="Advanced Elicitation" description="Explore this section deeper before proceeding" />
          <option label="YOLO" description="Auto-complete the rest of this workflow without stopping" />
        </options>
        <if response="Advanced Elicitation">
          <action>Invoke advanced-elicitation skill</action>
        </if>
        <if response="Continue">
          <action>Continue to next step</action>
        </if>
        <if response="YOLO">
          <action>Enter YOLO mode for the rest of the workflow</action>
        </if>
      </action>
    </if>
  </substep>

  <substep n="1e" title="Step Completion">
    <action>Mark current step as completed (TodoWrite)</action>
    <check>If no special tags and NOT YOLO:</check>
    <action>Use Question tool to ask:
      <options>
        <option label="Continue" description="Proceed to the next step" />
        <option label="Edit" description="Revise this step before moving on" />
      </options>
    </action>
  </substep>
</step>

<step n="2" title="Completion">
  <check>Confirm all instruction steps have been executed</check>
  <output>Workflow complete.</output>
</step>

<inputs>
  Interactive (user invokes [RX]):
  - The approach to assess (a plan, design, code path, or described
    approach); mentioned sources read first.

  Autonomous (dispatched from a workflow):
  - approach (required): what to assess for risk
  - categories (optional): risk lenses to apply; derived from the
    approach when absent
  - scope (optional): where the approach lives (globs, paths, domain)
  - web_search_approved (boolean): required true to research known
    external risks via web-search-researcher
  - output_location (optional): override for the research directory
</inputs>

<outputs>
  A risk register persisted to the thoughts research directory: risks
  grouped by category, each with an evidence-grounded likelihood and
  impact, the standard mitigation for its class, and a citation; a
  Summary ranking the top risks. Autonomous mode returns a structured
  signal carrying the register path.
</outputs>

<key-discipline>
  Adversarial stance: the job is to find what breaks. A pre-mortem
  framing — "assume this failed in production; what were the causes?"
  — drives the scan. An approach that looks clean still gets its
  residual and low risks surfaced; "no risks" from an adversarial
  scan is suspicious, not reassuring.

  Mitigations are factual, not directives. State the standard
  mitigation for each risk class ("this is mitigated by X") — never a
  remediation order for our code ("rewrite Z"). Whether, when, and how
  to remediate is the orchestrator's call.

  Likelihood and impact are evidence-grounded. "Likelihood HIGH
  because the input is user-controlled and reaches the query
  unescaped [cite]" — a grading backed by evidence, not a hunch.

  Hide-the-intent: every child prompt carries the risk question
  alone — never the parent task's intent.
</key-discipline>

<step n="1" title="Orient">
  <action>Load and execute: references/steps/step-01-orient.xml</action>
</step>

<step n="2" title="Select Risk Categories">
  <action>Load and execute: references/steps/step-02-select-categories.xml</action>
</step>

<step n="3" title="Dispatch Category Scans">
  <action>Load and execute: references/steps/step-03-dispatch-scans.xml</action>
</step>

<step n="4" title="Build Risk Register">
  <action>Load and execute: references/steps/step-04-build-register.xml</action>
</step>

<step n="5" title="Persist">
  <action>Load and execute: references/steps/step-05-persist.xml</action>
</step>

<step n="6" title="Return">
  <action>Load and execute: references/steps/step-06-return.xml</action>
</step>