RiskRadar AI
RiskRadar AI is a general-purpose code risk review and release-quality gate skill for software teams. It turns code changes into actionable engineering and QA evidence: exact code locations, impact, severity, confidence, test strategy, and release recommendation.
It works for backend, frontend, mobile, platform, data, AI, LLM, Agent, RAG, API, infrastructure, and integration-heavy systems.
When To Use
Use this skill when you need to:
- Review a pull request or Git Diff before release.
- Find functional, runtime, dependency, security, performance, compatibility, and regression risks.
- Review AI-enabled workflows such as LLM calls, agents, RAG retrieval, prompt templates, tool calling, and model fallback logic.
- Build a release quality gate with concrete verification steps.
- Generate unit, integration, E2E, adversarial, resilience, and monitoring test recommendations.
Core Workflow
- Scope the change: identify repositories, files, Git Diff, affected modules, user flows, APIs, data flows, and runtime boundaries.
- Map critical paths: trace state transitions, external dependencies, persistence, network calls, async jobs, permissions, and user-visible impact.
- Identify AI dependencies: detect LLM calls, agents, RAG, prompt templates, model routing, tool calls, feature flags, and fallback behavior when applicable.
- Analyze risks: classify functional, runtime, dependency, security, performance, AI, privacy, resilience, and regression risks.
- Validate evidence: link every finding to code, configuration, data flow, logs, tests, or product behavior.
- Design tests: produce targeted unit, integration, E2E, adversarial, resilience, and monitoring tests.
- Write the report: include severity, confidence, exact location, impact, verification steps, and release recommendation.
Reference Guides
| Topic | Reference | Load When |
|---|---|---|
| Code risk review | references/code-risk-review-playbook.md |
Always use for risk classification, evidence requirements, and report table |
Required Output
Produce a Markdown report with:
- Executive summary and release recommendation.
- Risk table with severity, confidence, exact code location, impact, and fix/test recommendation.
- AI workflow risk section when LLM, Agent, RAG, model, or tool-calling logic is involved.
- Test strategy by layer: unit, integration, E2E, adversarial, resilience, monitoring.
- Evidence checklist and open questions.
AI Workflow Risk Section
## AI Workflow Risk Review
| Risk | Code Location | User/System Impact | AI/Model/Agent Link | Evidence Needed | Verification | Priority |
| --- | --- | --- | --- | --- | --- | --- |
Quality Bar
- Do not invent risks without code or configuration evidence.
- Every high-severity risk must include a concrete reproduction or verification path.
- Separate facts, assumptions, and inferred risks.
- Prefer actionable, release-blocking findings over generic advice.
- If evidence is insufficient, state exactly what is missing.