risklisted

Compile and analyse the risks for a device, a piece of software, or a system, as an ISO 14971 risk analysis: hazard, sequence of events, hazardous situation, harm, scored before and after control, with each control typed by the 14971 priority order and tied to the thing that verifies it. Works out which standards apply from what the subject actually is — ISO 13485, IEC 62304, IEC 62366-1, IEC 60601, ISO 10993, IEC 81001-5-1 and the rest — and prints the fact that pulled each one in, rather than listing standards nobody has shown to apply. Every risk level is computed from the acceptability matrix the organisation supplies; the skill refuses to invent one. Writes both a .md and a self-contained .html of the same rows, rendered from one set of computed numbers so the two cannot disagree. Trigger: the user types `/risk`, or says "analyse the risks for this", "write a risk analysis", "do the hazard analysis for the client", "which standards apply to this device", "make the 14971 file".
MattTheCoder556/software-vv-skill · ★ 0 · AI & Automation · score 70

Install: claude install-skill MattTheCoder556/software-vv-skill

# /risk — subject → ISO 14971 risk analysis (.md + .html) **In plain words.** One row per way this thing can hurt somebody. For each: what goes wrong, what happens next, who is harmed, how bad and how likely, what is done about it, and how much risk is left. The score is arithmetic, not opinion — the script computes every level from the matrix and refuses to take one on trust. This is the fifth of the family. `/swurs` says what the software must do, `/swverify` tests it, `/swvalidation` signs it off, `/swbugs` reconciles what is still broken. This one asks the question none of those do: **what happens when it goes wrong, and who does it hurt.** It is the only skill in the family that is not software-only. A risk file covers the device, the software inside it, and the system it sits in — so `/risk` takes a `kind` and adjusts what it asks about. ## What it will not do - **Decide regulatory class.** MDR rule, IEC 62304 software safety class, FDA level of concern, AI Act tier — all asked for, never inferred, and the document records that the organisation stated them. - **Invent acceptability criteria.** Under ISO 14971 these belong to the risk management plan. Without them the script exits 1 and says so. - **Reach the benefit-risk conclusion.** The analysis stops at residual risk per hazard. Overall residual risk and the benefit-risk judgement are a qualified person's signature, not a generator's output. - **Invent hazards from a standard.** Same rule `/validation`