Risk audit (risk)

Sweep local agent logs for actions that are expensive to reverse or reach outside this machine. The scanner only reads local files and never sends anything; secret-looking strings are masked before they reach any output file.

Language rule: write every user-facing output in the language the user is speaking with you. Verification rule: a finding goes in the report only after you have looked at the surrounding transcript context and can say what actually happened. A regex match is a lead, not a conclusion.

Step 0 — Scope

Default window is 7 days, all agents. Widen or narrow from what the user said ("bu ay", "sadece codex", "şu proje"). Read ${CLAUDE_PLUGIN_ROOT}/skills/risk/references/rules.md before triaging — it says what each rule id means and how to tell a real hit from noise.

Step 1 — Scan

Create the output directory if missing (expand the home directory yourself; never pass a literal ~ to the script), then:

node "${CLAUDE_PLUGIN_ROOT}/scripts/blackbox.mjs" --scan --days 7 --limit 40 \
  --out "<home>/.agentlens/blackbox/risk-raw.json"

Use --agent <id> to narrow, --ignore <rule1,rule2> to drop rules the user has already accepted. Requires Node.js 18+. Read the JSON. If window.unreadable > 0, that count goes in the report's source note — never hide a log you could not parse.

Step 2 — Verify before you report

Take the findings in severity order. For each high finding, and for any medium one you intend to surface, open the session it came from:

node "${CLAUDE_PLUGIN_ROOT}/scripts/blackbox.mjs" --session <id> --md

Then decide, from the surrounding turn:

• What was the target? rm -rf ./build is housekeeping; rm -rf ~/projects is not. The path decides, not the command.
• Did it run? The sonuç/outcome column says çalıştı, hata verdi, reddedildi or sonuç yok. A denied call is a good sign — report it as friction, not as damage.
• Was it asked for? A force-push the user explicitly requested is a note; one the agent decided on its own is a finding.
• Is it still reversible? If files are involved, check --undo --session <id>.

Drop anything you cannot substantiate. Say how many you dropped and why — a shrinking list is the point of this step, not a failure of it.

Step 3 — Rank by consequence, not by count

Sort what survives by what it would cost if it were wrong, in this order:

1. Data or history that is already gone (deleted files, hard resets, dropped tables)
2. Secrets that reached disk or left the machine
3. Security controls left switched off
4. Outward-facing actions (published, pushed, deployed, messaged)
5. Everything else

A rule that fires 40 times in one loop is one finding with a count, not 40 findings.

Step 4 — Write

Save ~/.agentlens/blackbox/risk-<YYYY-MM-DD>.md in this order:

1. Title + source note: window, how many sessions scanned, which agents, how many logs were unreadable, and the raw risk score with its level
2. Three-sentence verdict — the honest one, including "nothing alarming" when that is true
3. Findings table: severity, rule, session, count, what it actually did, whether it ran
4. One block per surviving finding: what happened · which session and event · why it matters here (not in general) · what to do now · whether it is still reversible
5. Accepted risks — hits you deliberately dropped, so the next run does not re-raise them; include the --ignore line the user can paste
6. Behaviour signals worth acting on (error storms, repeated denials, unverified changes)

Step 5 — Reply

6–10 lines: the verdict, the two or three findings that actually need action, the single most useful habit change, and the file path. If a secret reached a transcript, that goes first and the reply says plainly: rotate the key, then delete that transcript file. If the sweep is clean, say so in one line and do not invent concerns to fill the report.