# Assess Patch Risk

Assesses a patch's impact, regression risk and merge eligibility without editing it.

- Repository: https://github.com/openai/codex-security (11278 stars)
- Category: Git and review
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add openai/codex-security --skill assess-patch-risk -g -a claude-code -y`
Codex: `npx skills add openai/codex-security --skill assess-patch-risk -g -a codex -y`
Cursor: `npx skills add openai/codex-security --skill assess-patch-risk -g -a cursor -y`
Gemini CLI: `npx skills add openai/codex-security --skill assess-patch-risk -g -a gemini-cli -y`

## Description

Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and recoverability. This skill is read-only and does not generate, edit, apply, push, or merge the patch.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Assess Patch Risk

Before choosing paths or saving retained output, read `../../references/artifact-storage.md` and follow its storage policy.

Explain what can change if the patch merges and whether the available evidence supports merging it. Keep these concepts separate:

- **impact if wrong**: the consequence and blast radius of a regression;
- **regression likelihood**: how likely the patch is to cause one;
- **regression protection**: whether relevant tests or checks would detect it;
- **recoverability**: how safely the change can be disabled or reverted; and
- **confidence**: how complete and reliable the analysis is.

Read [references/risk-rubric.md](references/risk-rubric.md) before assigning ratings or an auto-merge label.

## Workflow

The rest: https://github.com/openai/codex-security/blob/HEAD/plugins/codex-security/skills/assess-patch-risk/SKILL.md