assess-patch-risk — Codex skill: patch review and installation
This skill examines a fixed patch artifact to assess its program impact, regression exposure, and case for automatic merging. Use it when reviewing proposed changes.
npx skills add openai/plugins --skill assess-patch-risk -a codexWhat assess-patch-risk does
The skill accepts a fixed patch file, a provider’s final pull-request comparison, or a commit range with defined endpoints. It traces affected runtime paths, contracts, and state, then separates the potential damage of a defect from the chance of one occurring. Its assessment also covers test protection, recovery options, and how complete the available evidence is.
Before rating risk or merge eligibility, it consults a risk rubric. The review checks relevant boundaries such as authorization, data handling, and migrations, and considers what tests actually cover. It returns a recommendation to merge, revise, reject, take no action, or gather more evidence. The skill is read-only: it will not apply or push changes. It requires a fixed artifact rather than a changing working tree.
What it helps with
- trace a patch’s effect on live application paths
- separate regression probability from potential damage
- check whether tests cover the changed behavior
- assess rollback options and automatic-merge eligibility
Example prompts for the agent
- Review this fixed patch and trace its impact through the application.
- Assess the pull-request diff for regression risk, test coverage, and automatic-merge eligibility.
- Analyze this commit range using the supplied base and head, then recommend whether to merge.
How to install assess-patch-risk
1Skills CLI (Vercel)
npx skills add openai/plugins --skill assess-patch-risk -a codex2Manually: put the files in place
.agents/skills/assess-patch-risk/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add openai/plugins --skill assess-patch-risk -a claude-code2Manually: put the files in place
~/.claude/skills/assess-patch-risk/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/assess-patch-risk/
Manually: put the files in place
.cursor/skills/assess-patch-risk/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install openai/plugins assess-patch-risk2Manually: put the files in place
.github/skills/assess-patch-risk/SKILL.mdPlatform CLI
gemini skills install https://github.com/openai/plugins --path plugins/codex-security/skills/assess-patch-riskManually: put the files in place
.devin/skills/assess-patch-risk/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: Codex skills: how to install, where they live, how to call them
Questions about assess-patch-risk
How do I install assess-patch-risk in Codex?
Run npx skills add openai/plugins --skill assess-patch-risk -a codex. The skill is installed at .agents/skills/assess-patch-risk/SKILL.md.
What does assess-patch-risk do?
It examines a fixed patch, traces affected program paths, and evaluates regression exposure, test safeguards, recovery options, and whether the evidence supports merging.
What patch input does the skill accept?
It can review a fixed patch file, a provider’s final pull-request comparison, or a commit range with established base and head. It does not directly assess a changing working tree.
