New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Enterprise Risk

by cbrock84 in cbrock84/headcount

Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, and preparing for audit.

MITAuto-check passedLegal & Compliance

Install Enterprise Risk

skills CLI
$ npx skills add cbrock84/headcount --skill enterprise-risk -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install cbrock84/headcount enterprise-risk --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/cbrock84/headcount.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/legal-risk/skills/enterprise-risk .claude/skills/enterprise-risk && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
enterprise-risk
GitHub stars
2k
Token cost
~947 tokens
SKILL.md length
521 words
Files
2 (incl. references)
Skills in repo
178
Repo updated
First seen
Licence
MIT

At a glance

Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, and preparing for audit.

  • Tasks that involve Legal risk assessment
  • SKILL.md covers The register is the artifact, Treatment is a decision with…, Scoring honestly and Audit readiness, plus 4 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Tasks that involve Meeting notes and agendas

What it does

Enterprise Risk is an agent skill from cbrock84/headcount. Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, and preparing for audit. Use this to stand up a risk program, assess the risk in a decision or initiative, prepare for a certification or audit, decide whether a risk should be accepted, mitigated, transferred, or avoided, or report risk posture to leadership.

Its SKILL.md is about 950 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/sources.md`).

It sits in Legal & Compliance, covering Legal risk assessment and Meeting notes and agendas. The repository describes itself as: An agent organization structured as a company — 15+ departments, 125+ skills, each independently installable, citing the standards and regulators that settle the question. Runs… The licence is MIT.

When your agent uses it

  • Tasks that involve Legal risk assessment
  • Tasks that involve Meeting notes and agendas

Example prompts

  • “/enterprise-risk”

What it can do on your machine

Read from SKILL.md and the folder at commit 98d1c17. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Enterprise Risk loads about 947 tokens when it runs, and up to ~1.2k if it reads all its reference files. Until then it costs about 106 tokens; SKILL.md has 521 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~106
When it runs · the whole SKILL.md, loaded when a task matches
~947
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from cbrock84/headcount at commit 98d1c17, republished under its MIT licence (© cbrock84). 521 words, ~947 tokens.

Download SKILL.mdSave it as .claude/skills/enterprise-risk/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
enterprise-risk
description
Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, and preparing for audit. Use this to stand up a risk program, assess the risk in a decision or initiative, prepare for a certification or audit, decide whether a risk should be accepted, mitigated, transferred, or avoided, or report risk posture to leadership.

Enterprise risk

The register is the artifact

A risk that is not written down with an owner is not managed. Each entry carries:

  • The risk stated as a cause and consequence — "if X happens, then Y." "Cybersecurity" is a category, not a risk. "If an employee's credentials are phished, an attacker reaches customer records" is a risk you can do something about.
  • Likelihood and impact, on a stated scale, with the reasoning. The reasoning matters more than the score.
  • Current controls and an honest view of whether they work.
  • Residual risk after those controls — the number that actually matters and the one most often omitted.
  • A named owner. A person, not a department.
  • Treatment and a date.

Treatment is a decision with four options

Mitigate (reduce it), transfer (insure or contract it away), avoid (do not do the thing), or accept. Accepting is legitimate and often correct — but acceptance must be explicit, at the right level of authority, and recorded. Risk accepted by silence is risk nobody owns.

Anything above the threshold that only the chief executive can accept goes to them. Never let an unacceptable risk be quietly downgraded to fit an existing authority.

Scoring honestly

Two failure modes, both common:

  • Everything is high. The register stops discriminating and gets ignored.
  • Scores drift downward as items age without the underlying exposure changing.

Re-assess on a schedule and require evidence for any reduction. A control's existence is not evidence it works; a test of the control is.

Audit readiness

Continuous, not a project. What auditors need: documented policies, evidence they are followed, records of exceptions and approvals, and a clear line from the framework's requirement to your control to the evidence.

Collect evidence as work happens. Assembling a year of it retrospectively is expensive, and gaps found then cannot be fixed retroactively.

Show full SKILL.md (219 more words)Show less

Reporting

Leadership needs the few risks whose residual exposure is above appetite, what is being done, and what needs a decision. Not the whole register. A risk report that requires reading forty rows to find the three that matter will not be read.

Sources

references/sources.md in this skill lists the outside authorities that settle the questions here — what each one is authoritative for, and what you may do with it. Check them before answering on anything they cover, and cite what you used. Most are free to read and not free to reproduce; the use note on each is binding.

Tooling

A risk register is a table, and for most organizations a spreadsheet or a database in Notion, Airtable, or Confluence is the honest answer. Dedicated platforms — LogicGate, AuditBoard, Riskonnect, ServiceNow IRM, and similar — earn their place when the register has to reconcile with audit findings and control testing in one system.

Compliance automation tools cover control evidence, not enterprise risk. Do not let one stand in for the other.

Never

  • Score residual risk on controls that are planned rather than operating.
  • Accept a risk without naming who accepted it and when it is reviewed again.
  • Keep a register with no review cadence. That is documentation, not risk management.
  • Close a risk because the project that raised it ended.

© cbrock84, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in plugins/legal-risk/skills/enterprise-risk of cbrock84/headcount.

  • SKILL.md
  • references/sources.md

Open the folder on GitHubat commit 98d1c17

Compare with similar skills

Enterprise Risk next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Enterprise Risk compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Enterprise Risk this skillcbrock84/headcount2k—~947Automated safety check: PassMIT
Product Launch Legal Reviewanthropics/claude-for-legal9.6k2 repos~5kAutomated safety check: PassApache-2.0
Legal Risk Visualizationzh-xx/legal-assistant-skills174—~2.4kAutomated safety check: PassApache-2.0
Contract Renewal Trackeranthropics/claude-for-legal9.6k2 repos~3.1kAutomated safety check: PassApache-2.0
Deep Risk Analysiszubair-trabzada/ai-legal-claude1.8k—~1.9kAutomated safety check: PassNone
Canghe Tianyanchafreestylefly/canghe-skills461—~2.4kAutomated safety check: PassNone

Similar skills

  • Product Launch Legal Review

    anthropics/claude-for-legal

    Official

    Runs a category-by-category legal review of a product launch from a PRD or tracker ticket, calibrated to your team's framework, and writes a review memo in house format.

    9.6k GitHub starsUsed in 2 repos~5k tokens
    Legal & ComplianceAuto-check passed

  • Legal Risk Visualization

    zh-xx/legal-assistant-skills

    法律风险结构化分析与可视化。基于法律分析文本，执行五步风险抽取模型， 生成四层可视化输出（雷达图数据、风险矩阵、影响路径图、决策树）。

    174 GitHub stars~2.4k tokensUpdated 5 mo ago
    Legal & ComplianceAuto-check passed

  • Contract Renewal Tracker

    anthropics/claude-for-legal

    Official

    Shows which contracts renew soon and when notice must be sent by, working from a maintained renewal register, and warns about missed cancellation windows.

    9.6k GitHub starsUsed in 2 repos~3.1k tokens
    Legal & ComplianceAuto-check passed

  • Deep Risk Analysis

    zubair-trabzada/ai-legal-claude

    Clause-by-clause contract risk analysis with severity scoring, financial exposure estimates, and prioritized remediation guidance

    1.8k GitHub stars~1.9k tokensUpdated 6 mo ago
    Legal & ComplianceAuto-check passed

  • Canghe Tianyancha

    freestylefly/canghe-skills

    Generates Tianyancha-style company and industry insight dashboards from researched enterprise data.

    461 GitHub stars~2.4k tokensUpdated 4 mo ago
    Legal & ComplianceAuto-check passed

  • EU AI Act System Inventory

    anthropics/claude-for-legal

    Official

    Maintains a register of AI systems under the EU AI Act, recording each system's role and risk tier separately, because both can differ from one system to the next.

    9.6k GitHub starsUsed in 3 repos~2.8k tokens
    Legal & ComplianceAuto-check passed

More from cbrock84/headcount

All 178 skills in this repo

  • Agent Hierarchy

    cbrock84/headcount

    Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a…

    2k GitHub stars~1.2k tokensUpdated 23 days ago
    Auto-check passed

  • Access And Identity

    cbrock84/headcount

    Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process.

    2k GitHub stars~1.1k tokensUpdated 23 days ago
    Auto-check passed

  • Account Based Marketing

    cbrock84/headcount

    Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, building the account list and the buying group…

    2k GitHub stars~1.2k tokensUpdated 23 days ago
    Auto-check passed

  • Activation

    cbrock84/headcount

    Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone becomes a user or a lapsed account.

    2k GitHub stars~865 tokensUpdated 23 days ago
    Auto-check passed

  • AI ML Governance

    cbrock84/headcount

    Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or retire.

    2k GitHub stars~1k tokensUpdated 23 days ago
    Auto-check passed

  • AI Research Analyst

    cbrock84/headcount

    Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with the confidence in each claim made explicit.

    2k GitHub stars~916 tokensUpdated 23 days ago
    Auto-check passed

Categories

Questions about Enterprise Risk

What does Enterprise Risk do?

Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, and preparing for audit. Enterprise Risk is an agent skill from cbrock84/headcount. Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, and preparing for audit.

When should I use Enterprise Risk?

Enterprise Risk fits situations like: tasks that involve Legal risk assessment; tasks that involve Meeting notes and agendas.

How do I install Enterprise Risk in Claude Code?

Run `npx skills add cbrock84/headcount --skill enterprise-risk -a claude-code`. Or copy the skill folder (plugins/legal-risk/skills/enterprise-risk in cbrock84/headcount) into .claude/skills/enterprise-risk in your project. Claude Code loads it when a task matches its description.

How do I install Enterprise Risk in Codex?

Run `npx skills add cbrock84/headcount --skill enterprise-risk -a codex`. Or copy the skill folder (plugins/legal-risk/skills/enterprise-risk in cbrock84/headcount) into .agents/skills/enterprise-risk in your project. Codex loads it when a task matches its description.

Can I use Enterprise Risk in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cbrock84/headcount --skill enterprise-risk -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/enterprise-risk, .gemini/skills/enterprise-risk, .github/skills/enterprise-risk and .opencode/skills/enterprise-risk in your project.

What does Enterprise Risk need to run?

SKILL.md names no scripts, command-line tools or credentials: Enterprise Risk is instructions for the agent only.

Does Enterprise Risk access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Enterprise Risk safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Enterprise Risk use?

Enterprise Risk is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Enterprise Risk use?

About 947 tokens (SKILL.md is roughly 3.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 227 tokens, read only when the agent opens those files.

What are the alternatives to Enterprise Risk?

Skills that share tags, products or a category with Enterprise Risk: Product Launch Legal Review (anthropics/claude-for-legal, 9.6k stars), Legal Risk Visualization (zh-xx/legal-assistant-skills, 174 stars), Contract Renewal Tracker (anthropics/claude-for-legal, 9.6k stars) and Deep Risk Analysis (zubair-trabzada/ai-legal-claude, 1.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Enterprise Risk?

cbrock84 (a GitHub user) maintains it in cbrock84/headcount, which has 2,022 GitHub stars. The repository holds 178 skills in this directory. The repository was last updated on September 17, 2026.

Source: cbrock84/headcount on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.