Why is it a risk? If you're applying for a job and potential employers see your all-green contribution graph, there is a very high chance they'll ask you to elaborate on that. At least now it is possible to actually show metrics for writing code that cannot be published or open sourced. Unfortunately quite a few recruiters care about it(because being a rockstar on github is a trend), but the initial screening process would filter out those with faked commit graphs.