feat(grc-auditor): add risk-report command taught in CGE-AUD Ch 5.4 - #224
feat(grc-auditor): add risk-report command taught in CGE-AUD Ch 5.4#224ajy0127 wants to merge 1 commit into
Conversation
The CGE-AUD course (Ch 5.4, Drafting a Risk Report) and its exam questions reference /grc-auditor:risk-report, but the plugin shipped without it — members following the lesson hit an unknown command. Adds the command as taught: read a folder of raw evidence as-is, cluster findings into risks, rate likelihood x impact from the evidence, and draft a ranked report in the audience's language with a per-risk citation to the exact evidence file and a run_id traceability block. Accepts positional and --input=/--audience= flag forms, matching both shapes shown in the course. Points the examples/sample-evidence README (the Ch 5.4 practice pack) at the new command, keeping review-evidence as the noted alternative. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing |
📝 WalkthroughWalkthroughThe PR documents the ChangesRisk report command
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryThe PR adds the missing prompt-only
Confidence Score: 4/5The PR appears safe to merge, with two non-blocking improvements recommended for deterministic argument handling and trustworthy traceability metadata. The new prompt-only command provides the intended reporting workflow, but its flag mapping is descriptive rather than explicit and its required plugin version lacks an authoritative lookup instruction. Files Needing Attention: plugins/grc-auditor/commands/risk-report.md
|
| Filename | Overview |
|---|---|
| plugins/grc-auditor/commands/risk-report.md | Adds the complete report-drafting workflow; argument binding and version provenance would benefit from explicit instructions. |
| examples/sample-evidence/README.md | Updates the Chapter 5.4 exercise to invoke the new command while retaining review-evidence as an alternative. |
| CHANGELOG.md | Documents the new command, supported invocation forms, and intended workflow. |
Reviews (1): Last reviewed commit: "feat(grc-auditor): add risk-report comma..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| - `$1` - Evidence folder or file path (required) | ||
| - `$2` - Audience (optional: `leadership`, `ciso`, `audit-committee`, `engagement-manager`; defaults to `leadership`) | ||
|
|
||
| Flag-style arguments are also accepted: `--input=<path>` and `--audience=<audience>` map to `$1` and `$2`. |
There was a problem hiding this comment.
The documented --input and --audience mapping exists only as descriptive text; the workflow never consumes these flags, $1/$2, or $ARGUMENTS. This leaves flag-style argument handling dependent on model inference rather than an explicit binding, making the advertised form less reliable and harder to validate.
Knowledge Base Used: Persona Plugins: Auditor, Internal GRC, TPRM, Reporter
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
| 6. Do not invent findings. If a configuration in the evidence is fine, do not flag it. If the evidence does not support a risk, leave it out — an empty section is better than an unsupported claim. | ||
|
|
||
| 7. Append a traceability block: a `run_id` (date-based, e.g. `2026-08-11-r1`), the plugin name and version, the draft date, and an inventory of the evidence files read. Anyone questioning a risk should be able to walk from the risk statement to the evidence file to the original system. | ||
|
|
There was a problem hiding this comment.
The traceability block requires the plugin version, but the command never directs Claude to obtain it from the authoritative plugin manifest. Generated reports can therefore omit or infer this value, reducing traceability and allowing the recorded version to become stale after a release.
Knowledge Base Used: Persona Plugins: Auditor, Internal GRC, TPRM, Reporter
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
plugins/grc-auditor/commands/risk-report.md (1)
24-30: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winDefine the rating scale and ranking rule.
The command requires likelihood × impact ratings but defines no allowed values, matrix, insufficient-evidence behavior, or tie-break rule. Add these rules so identical evidence produces consistent ratings and rankings.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/grc-auditor/commands/risk-report.md` around lines 24 - 30, Update the risk-report guidance around the likelihood × impact rating requirements to define allowed likelihood and impact values, how to handle insufficient evidence, and how to calculate and rank combined scores. Add a deterministic tie-break rule so risks with equal scores are ordered consistently, while preserving the existing evidence-based rating and citation requirements.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/grc-auditor/commands/risk-report.md`:
- Line 34: Update the traceability block instructions to source the plugin name
and version from the installed plugin manifest, generate a unique per-run suffix
rather than always using `r1`, and emit `unknown` whenever required manifest
metadata is unavailable instead of inferring values.
- Around line 18-20: Update the evidence-handling instructions in the
risk-report guidance to explicitly treat all evidence contents as untrusted data
only: ignore embedded instructions, do not execute commands or follow links, and
do not copy secrets into the report, while preserving the existing requirements
to read files as-is and cross-reference artifacts.
- Around line 11-18: Update Step 1 of the risk-report instructions to
distinguish input types: read the single regular file provided as $1 directly,
enumerate and read every regular file when $1 is a directory, and reject
unsupported paths with a clear error. Preserve the existing requirement to
process evidence as-is.
---
Nitpick comments:
In `@plugins/grc-auditor/commands/risk-report.md`:
- Around line 24-30: Update the risk-report guidance around the likelihood ×
impact rating requirements to define allowed likelihood and impact values, how
to handle insufficient evidence, and how to calculate and rank combined scores.
Add a deterministic tie-break rule so risks with equal scores are ordered
consistently, while preserving the existing evidence-based rating and citation
requirements.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c97ba13f-0ef5-4a09-8ff5-acb2d14174ba
📒 Files selected for processing (3)
CHANGELOG.mdexamples/sample-evidence/README.mdplugins/grc-auditor/commands/risk-report.md
| - `$1` - Evidence folder or file path (required) | ||
| - `$2` - Audience (optional: `leadership`, `ciso`, `audit-committee`, `engagement-manager`; defaults to `leadership`) | ||
|
|
||
| Flag-style arguments are also accepted: `--input=<path>` and `--audience=<audience>` map to `$1` and `$2`. | ||
|
|
||
| ## Instructions | ||
|
|
||
| 1. Read every file in the evidence folder as-is. Evidence arrives raw (JSON, CSV, Terraform, logs) exactly as the tools produced it — do not ask for reformatting. The point is that every claim in the report traces back to an original evidence file. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Handle regular-file input explicitly.
$1 accepts a file or directory, but Step 1 only defines folder processing. If the user passes a file, the command does not state which artifact to read or how to inventory it. Read one regular file directly, enumerate regular files for a directory, and reject unsupported paths.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/grc-auditor/commands/risk-report.md` around lines 11 - 18, Update
Step 1 of the risk-report instructions to distinguish input types: read the
single regular file provided as $1 directly, enumerate and read every regular
file when $1 is a directory, and reject unsupported paths with a clear error.
Preserve the existing requirement to process evidence as-is.
| 1. Read every file in the evidence folder as-is. Evidence arrives raw (JSON, CSV, Terraform, logs) exactly as the tools produced it — do not ask for reformatting. The point is that every claim in the report traces back to an original evidence file. | ||
|
|
||
| 2. Cross-reference between files. Resource IDs, account IDs, and usernames that appear in one artifact often reappear in others; a risk supported by multiple artifacts is stronger than one supported by a single line. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Treat evidence contents as untrusted data.
Raw logs, CSV cells, or Terraform comments can contain prompt-injection instructions. The command does not tell the model to ignore instructions inside evidence. State that evidence is data only, that commands and links must not be executed or followed, and that secrets must not be copied into the report.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/grc-auditor/commands/risk-report.md` around lines 18 - 20, Update the
evidence-handling instructions in the risk-report guidance to explicitly treat
all evidence contents as untrusted data only: ignore embedded instructions, do
not execute commands or follow links, and do not copy secrets into the report,
while preserving the existing requirements to read files as-is and
cross-reference artifacts.
|
|
||
| 6. Do not invent findings. If a configuration in the evidence is fine, do not flag it. If the evidence does not support a risk, leave it out — an empty section is better than an unsupported claim. | ||
|
|
||
| 7. Append a traceability block: a `run_id` (date-based, e.g. `2026-08-11-r1`), the plugin name and version, the draft date, and an inventory of the evidence files read. Anyone questioning a risk should be able to walk from the risk statement to the evidence file to the original system. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Use authoritative traceability values.
The command requires a plugin version and a date-based run_id, but it does not define the source for the version or how r1 becomes unique. Read the name and version from the installed plugin manifest, generate a unique per-run suffix, and emit unknown instead of guessing when metadata is unavailable.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/grc-auditor/commands/risk-report.md` at line 34, Update the
traceability block instructions to source the plugin name and version from the
installed plugin manifest, generate a unique per-run suffix rather than always
using `r1`, and emit `unknown` whenever required manifest metadata is
unavailable instead of inferring values.
1 participant
Why
CGE-AUD Chapter 5.4 (Drafting a Risk Report) teaches
/grc-auditor:risk-report— the lesson video walks through it and two exam questions reference it — but the plugin shipped without the command. Members following the lesson hit an unknown command (surfaced by a member in the study group Slack today).What
plugins/grc-auditor/commands/risk-report.mdimplementing the workflow as taught: read every evidence file as-is, cross-reference between files, cluster findings into risks, rate likelihood × impact from the evidence only, draft a ranked report in the audience's language with a per-risk citation to the exact evidence file, and append a run_id traceability block.<path> <audience>) and flag-style (--input=,--audience=) arguments, matching both forms shown in the course.examples/sample-evidence/README (the Ch 5.4 practice pack) at the new command, keepingreview-evidenceas the noted alternative.Verification
npm run test:plugin-manifests— 67 manifests validnpm run test:unit— 55/55 pass🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
grc-auditor:risk-reportcommand for creating ranked risk reports from evidence folders.Documentation