/risk-to-jira-transformer

name: risk-to-jira-transformer
description: Converts unstructured risk assessments into structured Jira tickets. Extracts Likelihood, Impact, Mitigation from natural language and generates JSON formatted for Jira API with clear Definition of Done criteria.
allowed-tools: Bash, Read, Glob, Write, Edit

Risk-to-Jira Transformer

Converts unstructured risk assessments into structured engineering tickets. Turns "Risk Management" into "Task Management."

Quick Commands

**Transform a risk assessment:**

node plugins/grc-engineer/scripts/transform-risk.js "Vulnerability in authentication service discovered during pen test. High likelihood, critical impact. Mitigation: Implement OAuth2 with PKCE." SEC

**Transform with custom project:**

node plugins/grc-engineer/scripts/transform-risk.js "<risk description>" INFRA

Input Format

Accepts natural language risk descriptions. Automatically extracts:

• **Risk Description** - What is the risk?
• **Likelihood** - How likely is it to occur? (Low/Medium/High/Critical)
• **Impact** - What is the impact? (Low/Medium/High/Critical)
• **Mitigation** - How to address it?
• **Affected Systems** - Which systems are impacted?

Output Format

Generates JSON formatted for Jira API:

{
  "fields": {
    "project": { "key": "SEC" },
    "summary": "Implement OAuth2 with PKCE for authentication service",
    "description": "...",
    "issuetype": { "name": "Security Task" },
    "priority": { "name": "Critical" },
    "labels": ["security", "authentication", "risk-mitigation"],
    "customfield_10001": "High",  // Likelihood
    "customfield_10002": "Critical",  // Impact
    "customfield_10003": "Implement OAuth2 with PKCE"  // Mitigation
  }
}

Jira Fields Generated

• **Summary** - Concise risk title
• **Description** - Full risk assessment with context
• **Priority** - Based on Likelihood × Impact matrix
• **Labels** - Auto-tagged with relevant categories
• **Issue Type** - Security Task, Bug, Story, etc.
• **Definition of Done** - Clear acceptance criteria
• **Custom Fields** - Likelihood, Impact, Mitigation (if configured)

Risk Scoring

Automatically calculates risk score:

• **Critical** - High/Critical Likelihood × High/Critical Impact
• **High** - Medium Likelihood × High Impact, or High Likelihood × Medium Impact
• **Medium** - Other combinations
• **Low** - Low Likelihood × Low Impact

Example Inputs

• "SQL injection vulnerability found in user input validation. High likelihood of exploitation, critical impact on data integrity. Mitigation: Implement parameterized queries and input sanitization."
• "Missing encryption on database backups. Medium likelihood of data breach, high impact. Mitigation: Enable encryption at rest for all backup storage."
• "Unauthorized access possible due to weak password policy. High likelihood, medium impact. Mitigation: Enforce strong password requirements and MFA."

Prerequisites

• Risk description (natural language)
• Optional: Jira project key (defaults to SEC)
• Optional: Jira API credentials (for direct posting)