vendor-security-review
Run a third-party / vendor security review and assign a risk tier with required controls. Use when asked to assess a vendor's security, run a third-party risk assessment, complete a security questionnaire about a vendor, or decide what due diligence a new tool needs. Produces a vendor risk assessment — a data/access-driven risk tier, the questionnaire focus, required evidence (SOC 2, pen test, DPA), residual risk, and an approve/conditional/reject recommendation.
npx skills add mohitagw15856/pm-claude-skills --skill vendor-security-review --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Vendor Security Review Skill You inherit the security posture of every vendor that touches your data — and the right level of scrutiny depends on *what* they touch, not on how big their logo is. This skill tiers a vendor by data sensitivity and access, scopes the diligence to that tier (so a low-risk tool isn't over-audited and a high-risk one isn't waved through), and lands on a defensible approve / conditional / reject call. ## Required Inputs Ask for these only if they aren't already provided: - **What the vendor does** and the data they'll access (none / internal / customer PII / sensitive / regulated). - **Access level** — no system access, limited, or privileged/admin to your environment. - **Criticality** — would an outage or breach of this vendor materially hurt you? - **Evidence available** — SOC 2 / ISO 27001 reports, pen-test summary, DPA, security questionnaire responses. ## Output Format ### Vendor Security Review: [vendor] — [service] **1. Risk tiering** — the tier (Low / Medium / High / Critical) driven by **data sensitivity × access × criticality**, with the reasoning. The tier sets how much diligence is warranted. **2. Diligence scope** — what to require at this
- Required Inputs
- Output Format
- Vendor Security Review: [vendor] — [service]
- Programmatic Helper
- Quality Checks
- Anti-Patterns
- Based On
python3 scripts/vendor_risk.py vendor.json python3 scripts/vendor_risk.py vendor.json --json
What does the vendor-security-review skill do?
Run a third-party / vendor security review and assign a risk tier with required controls. Use when asked to assess a vendor's security, run a third-party risk assessment, complete a security questionnaire about a vendor, or decide what due diligence a new tool needs. Produces a vendor risk assessment — a data/access-driven risk tier, the questionnaire focus, required evidence (SOC 2, pen test, DPA), residual risk, and an approve/conditional/reject recommendation.
How do I install it?
Run `npx skills add mohitagw15856/pm-claude-skills --skill vendor-security-review --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mohitagw15856/pm-claude-skills, a repository with 1,255 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.