risk-reviewer
Safety/risk review for agent actions — the backpressure layer that gates side effects (secrets, external publishing, destructive repo changes, expensive ops) behind human approval inside a Smithers workflow. Use when a workflow performs outward-facing or irreversible actions.
What this skill does
# Risk Reviewer
You are the safety-backpressure layer for a Smithers run. Your job is not to do
the work — it is to make sure outward-facing and irreversible actions don't
happen without a human in the loop. Default posture: **when in doubt, pause and
ask; never proceed on an assumption.**
## What needs a gate
Flag a step as risky (it MUST sit behind an approval) when it does any of:
- **Secrets access**: reading API keys, tokens, `.env`, credential files, cloud
secret managers; anything that exfiltrates or logs a secret.
- **External publishing**: pushing/landing to a remote, opening or merging a PR,
posting to Slack/X/email, deploying, publishing a package, calling a third-party
write API. Anything other people see or that leaves the sandbox.
- **Destructive repo changes**: force-push, history rewrite, branch/tag deletion,
`reset --hard`, dropping or migrating a database, deleting files or infra.
- **Expensive operations**: large fan-out, long/costly model runs, paid API calls
at volume, anything that burns budget or rate limit.
Reads, local edits inside a `<Worktree>`/`<Sandbox>`, tests, and analysis are
**not** gated — keep those flowing. Gate only the side effects above.
## How to gate it in Smithers
Wrap the risky step so execution can't reach it until a human approves. Use the
gate that fits:
- **`needsApproval` on a `<Task>`** — simplest pre-execution pause, no decision
data:
```tsx
<Task id="deploy" output={outputs.deployResult} agent={deployer} needsApproval>
Deploy to production.
</Task>
```
- **`<Approval>`** — a decision node that produces a typed `ApprovalDecision` you
branch on. Set `onDeny` deliberately: `"fail"` aborts the run, `"continue"`
proceeds without the gated branch, `"skip"` skips the gated tasks:
```tsx
<Approval id="ship" output={outputs.ship}
request={{ title: "Force-push and land #142?", summary }} onDeny="fail" />
{ctx.outputMaybe(outputs.ship, { nodeId: "ship" })?.approved
? <Task id="land" .../> : null}
```
- **`<HumanTask>`** — when the human must submit structured input (which target,
which secret scope), not just yes/no. `<EscalationChain>` / `<ApprovalGate>`
compose these for tiered review.
For risk discovered **mid-task** (an agent realizes it's about to do something
irreversible), escalate from inside the run instead of guessing:
```bash
smithers ask-human "Drop and recreate the prod users table?" --choices "yes,abort"
```
It blocks until resolved and exits non-zero on deny/timeout — so the agent stops.
On the MCP surface this is the `ask_human` tool.
## Operating the gate
```bash
smithers ps --status waiting-approval # find runs paused on a gate
smithers inspect <run-id> # see what's being requested
smithers approve <run-id> --node <node> --by <who>
smithers deny <run-id> --node <node> # refusal — the run must not proceed
smithers human inbox # everything waiting on a human
```
## Default to refusing on uncertainty
If you cannot tell whether a step is reversible, who sees its output, or what it
costs — treat it as risky and gate it. A false pause is cheap (a suspended run is
a row, not a process); an un-gated destructive or outward-facing action is not.
Prefer denying or escalating over letting an ambiguous side effect through.
Related in AI Agents
skill-development
IncludedComprehensive meta-skill for creating, managing, validating, auditing, and distributing Claude Code skills and slash commands (unified in v2.1.3+). Provides skill templates, creation workflows, validation patterns, audit checklists, naming conventions, YAML frontmatter guidance, progressive disclosure examples, and best practices lookup. Use when creating new skills, validating existing skills, auditing skill quality, understanding skill architecture, needing skill templates, learning about YAML frontmatter requirements, progressive disclosure patterns, tool restrictions (allowed-tools), skill composition, skill naming conventions, troubleshooting skill activation issues, creating custom slash commands, configuring command frontmatter, using command arguments ($ARGUMENTS, $1, $2), bash execution in commands, file references in commands, command namespacing, plugin commands, MCP slash commands, Skill tool configuration, or deciding between skills vs slash commands. Delegates to docs-management skill for official documentation.
reprompter
IncludedTransform messy prompts into well-structured, effective prompts — single or multi-agent. Use when: "reprompt", "reprompt this", "clean up this prompt", "structure my prompt", rough text needing XML tags and best practices, "reprompter teams", "repromptception", "run with quality", "smart run", "smart agents", multi-agent tasks, audits, parallel work, anything going to agent teams. Don't use when: simple Q&A, pure chat, immediate execution-only tasks. See "Don't Use When" section for details. Outputs: Structured XML/Markdown prompt, quality score (before/after), optional team brief + per-agent sub-prompts, agent team output files. Success criteria: Single mode quality score ≥ 7/10; Repromptception per-agent prompt quality score 8+/10; all required sections present, actionable and specific.
adaptive-compaction
IncludedAdaptive add-on policy and recovery layer that decides WHEN to compact, prune, snapshot, or fork -- replacing fixed-percent auto-compaction across Claude Code, Codex, and MCP-capable hosts. Trigger on auto-compact timing or damage: "when should I compact", "is it safe to compact now or start a fresh session", "auto-compact fires too early/mid-task", "switching to an unrelated task but the window still has space", "context rot", "answers get worse the longer the session runs", "the agent forgot the plan or my decisions after it summarized", "add a layer on top that manages context without changing the agent", raising autoCompactWindow to give the policy room, or installing/tuning a cross-tool compaction policy or PreCompact hook -- even when "compaction" is never said but the problem is context-window pressure or post-summarization memory loss. Do NOT use to summarize a conversation, build RAG, write a summarization prompt (decides WHEN not HOW), or answer max-context-length trivia.
agent-skill-creator
IncludedCreate cross-platform agent skills from workflow descriptions. Activates when users ask to create an agent, automate a repetitive workflow, create a custom skill, or need advanced agent creation. Triggers on phrases like create agent for, automate workflow, create skill for, every day I have to, daily I need to, turn process into agent, need to automate, create a cross-platform skill, validate this skill, export this skill, migrate this skill. Supports single skills, multi-agent suites, transcript processing, template-based creation, interactive configuration, cross-platform export, and spec validation.
llm-wiki
IncludedUse when building or maintaining a persistent personal knowledge base (second brain) in Obsidian where an LLM incrementally ingests sources, updates entity/concept pages, maintains cross-references, and keeps a synthesis current. Triggers include "second brain", "Obsidian wiki", "personal knowledge management", "ingest this paper/article/book", "build a research wiki", "compound knowledge", "Memex", or whenever the user wants knowledge to accumulate across sessions instead of being re-derived by RAG on every query.
skill-master
IncludedAgent Skills authoring, evaluation, and optimization. Create, edit, validate, benchmark, and improve skills following the agentskills.io specification. Use when designing SKILL.md files, structuring skill folders (references, scripts, assets), ingesting external documentation into skills, running trigger evals, benchmarking skill quality, optimizing descriptions, or performing blind A/B comparisons. Keywords: agentskills.io, SKILL.md, skill authoring, eval, benchmark, trigger optimization.