---

name: risk-to-jira-transformer description: Converts unstructured risk assessments into structured Jira tickets. Extracts Likelihood, Impact, Mitigation from natural language and generates JSON formatted for Jira API with clear Definition of Done criteria. allowed-tools: Bash, Read, Glob, Write, Edit

Risk-to-Jira Transformer

Converts unstructured risk assessments into structured engineering tickets. Turns "Risk Management" into "Task Management."

Quick Commands

Transform a risk assessment:

node plugins/grc-engineer/scripts/transform-risk.js "Vulnerability in authentication service discovered during pen test. High likelihood, critical impact. Mitigation: Implement OAuth2 with PKCE." SEC

Transform with custom project:

node plugins/grc-engineer/scripts/transform-risk.js "<risk description>" INFRA

Input Format

Accepts natural language risk descriptions. Automatically extracts:

• Risk Description - What is the risk?
• Likelihood - How likely is it to occur? (Low/Medium/High/Critical)
• Impact - What is the impact? (Low/Medium/High/Critical)
• Mitigation - How to address it?
• Affected Systems - Which systems are impacted?

Output Format

Generates JSON formatted for Jira API:

{
  "fields": {
    "project": { "key": "SEC" },
    "summary": "Implement OAuth2 with PKCE for authentication service",
    "description": "...",
    "issuetype": { "name": "Security Task" },
    "priority": { "name": "Critical" },
    "labels": ["security", "authentication", "risk-mitigation"],
    "customfield_10001": "High",  // Likelihood
    "customfield_10002": "Critical",  // Impact
    "customfield_10003": "Implement OAuth2 with PKCE"  // Mitigation
  }
}

Jira Fields Generated

• Summary - Concise risk title
• Description - Full risk assessment with context
• Priority - Based on Likelihood × Impact matrix
• Labels - Auto-tagged with relevant categories
• Issue Type - Security Task, Bug, Story, etc.
• Definition of Done - Clear acceptance criteria
• Custom Fields - Likelihood, Impact, Mitigation (if configured)

Risk Scoring

Automatically calculates risk score:

• Critical - High/Critical Likelihood × High/Critical Impact
• High - Medium Likelihood × High Impact, or High Likelihood × Medium Impact
• Medium - Other combinations
• Low - Low Likelihood × Low Impact

Example Inputs

• "SQL injection vulnerability found in user input validation. High likelihood of exploitation, critical impact on data integrity. Mitigation: Implement parameterized queries and input sanitization."
• "Missing encryption on database backups. Medium likelihood of data breach, high impact. Mitigation: Enable encryption at rest for all backup storage."
• "Unauthorized access possible due to weak password policy. High likelihood, medium impact. Mitigation: Enforce strong password requirements and MFA."

Prerequisites

• Risk description (natural language)
• Optional: Jira project key (defaults to SEC)
• Optional: Jira API credentials (for direct posting)