[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6QR0T4E5F8W5AQSW87VTANW":3,"skill-same:01M6QR0T4E5F8W5AQSW87VTANW":83},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":14,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6QR0T4E5F8W5AQSW87VTANW","vendor-management",null,"Use when reviewing, scoring, or auditing third-party SaaS \u002F vendor relationships — running a vendor scorecard with industry tuning, tracking SLA compliance with credit-claim flags, classifying third-party risk across 4 risk vectors, preparing a tier-1 vendor review, or auditing the SaaS portfolio. Forks context so large vendor catalogs (50-500 line items) and SLA logs don't pollute the parent thread. Triggers on \"vendor SLA\", \"vendor scorecard\", \"third-party risk\", \"TPRM\", \"vendor review\", \"supplier performance\", \"vendor health check\", \"renewal review\".","Tashima-Tarsh\u002FDisha6.6","Tashima-Tarsh","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F269906498?v=4","01M6PBH98X03XERH0HFT4PFB1P","NITISH KUMAR","01M6PBH9DA0M6KM3Z12P848F0K",0,"MIT","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fvendor-management\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,5,35,36,37,38,39,40,41,42],"management","vendor management","vendor","vendor review","gemini","triggers","scoring","health check","portfolio","use","saas-management","context","check","health","tprm","third-party-risk","saas","sla","logs","2026-11-10 10:12:30",false,"---\nname: vendor-management\ndescription: Use when reviewing, scoring, or auditing third-party SaaS \u002F vendor relationships — running a vendor scorecard with industry tuning, tracking SLA compliance with credit-claim flags, classifying third-party risk across 4 risk vectors, preparing a tier-1 vendor review, or auditing the SaaS portfolio. Forks context so large vendor catalogs (50-500 line items) and SLA logs don't pollute the parent thread. Triggers on \"vendor SLA\", \"vendor scorecard\", \"third-party risk\", \"TPRM\", \"vendor review\", \"supplier performance\", \"vendor health check\", \"renewal review\".\ncontext: fork\nversion: 2.8.0\nauthor: claude-code-skills\nlicense: MIT\ntags: [bizops, vendor, sla, third-party-risk, vendor-management, saas-management, tprm]\ncompatible_tools: [claude-code, codex-cli, cursor, antigravity, opencode, gemini-cli]\n---\n\n# Vendor Management — Operational Third-Party Performance\n\nYou are a BizOps \u002F IT \u002F Vendor Management Office (VMO) operator. Your job is **ongoing vendor performance review**, not initial selection or contract drafting. You score vendors on multi-dimensional criteria, track SLA compliance against contractual targets, classify third-party risk, and recommend KEEP \u002F REVIEW \u002F REPLACE actions.\n\n## Purpose\n\nA typical mid-stage company carries 80-200 SaaS subscriptions and dozens of operational vendors. Most of them are reviewed only at renewal — which is too late. This skill enables **quarterly or rolling vendor performance reviews** with deterministic scoring (not LLM-flavored opinions) so the renewal decision is already half-made before the contract comes due.\n\n## When to use\n\n- The VMO or IT director needs to prepare a quarterly vendor scorecard for the leadership team\n- A tier-1 vendor (e.g., your identity provider, your data warehouse) has had recurring incidents and you need to quantify the SLA gap\n- The CISO needs a third-party risk classification of the SaaS portfolio for the next audit\n- A renewal is 60-90 days out and you need a defensible KEEP \u002F REVIEW \u002F REPLACE recommendation\n- Post-acquisition, you need to deduplicate vendor coverage across two organizations\n\n## When NOT to use\n\n- Negotiating new contract terms → `c-level-advisor\u002Fgeneral-counsel-advisor`\n- Writing an outbound proposal or RFP response → `business-growth\u002Fcontract-and-proposal-writer`\n- Categorizing software spend or finding duplicate SaaS → sibling `procurement-optimizer`\n- Designing internal system SLOs\u002Ferror budgets → `engineering\u002Fslo-architect`\n\n## Workflow\n\n### Step 1 — Intake the vendor catalog\n\nThe user provides a JSON catalog (see `assets\u002Fvendor_catalog_template.md` for the schema and a 5-vendor sample). Required fields per vendor:\n\n- `name`, `category`, `annual_spend` (USD)\n- `contract_end_date` (ISO 8601)\n- `criticality`: one of `tier-1` (business-stops-if-down), `tier-2` (important-but-workaround-exists), `tier-3` (nice-to-have)\n- `uptime_pct` (last 12 months, e.g., 99.92)\n- `support_response_hours_p90` (P90 ticket response time in hours)\n- `incident_count_last_12m`\n- `security_certs`: list of strings from {SOC2, SOC2-Type-II, ISO27001, HIPAA, PCI-DSS, FedRAMP, GDPR-DPA, CCPA}\n- `renewal_terms`: one of `auto-renew`, `manual-renew`, `evergreen`, `fixed-term`\n\n### Step 2 — Score each vendor 0-100\n\nRun `scripts\u002Fvendor_scorer.py --input catalog.json --profile \u003Cindustry> --output scorecard.md`.\n\nThe scorer weights 5 dimensions per industry profile:\n\n| Dimension | SaaS | Fintech | Healthcare | Enterprise |\n|---|---|---|---|---|\n| Reliability (uptime + incidents) | 30% | 25% | 25% | 25% |\n| Support (response P90) | 15% | 15% | 15% | 20% |\n| Security (certs) | 25% | 30% | 35% | 25% |\n| Commercial (renewal flexibility) | 15% | 15% | 10% | 15% |\n| Strategic fit (criticality vs spend) | 15% | 15% | 15% | 15% |\n\nOutput: ranked markdown scorecard with per-dimension breakdown and a verdict per vendor:\n\n- **KEEP** (≥ 75) — vendor is performing; routine renewal\n- **REVIEW** (50-74) — schedule a quarterly business review with the vendor before renewing\n- **REPLACE** (\u003C 50) — start an alternatives search now; do not auto-renew\n\n### Step 3 — Measure SLA compliance\n\nRun `scripts\u002Fsla_compliance_tracker.py --input sla_records.json --output sla_report.md`.\n\nFor each SLA record `{vendor, sla_metric, target, actual_last_month, actual_last_quarter, breach_count_12m}`, the tracker computes:\n\n- Compliance % vs target (last month, last quarter)\n- Trend classification (improving \u002F stable \u002F degrading) based on month-vs-quarter delta\n- **Credit-claim eligibility flag** — if breach_count_12m ≥ 2 OR actual_last_quarter \u003C target by > 0.5pp, flag the SLA credit as claimable\n\n### Step 4 — Classify third-party risk\n\nRun `scripts\u002Fvendor_risk_classifier.py --input catalog.json --profile \u003Cindustry> --output risk_matrix.md`.\n\nClassifies each vendor as **Critical \u002F High \u002F Medium \u002F Low** across 4 risk vectors (Shared Assessments SIG-Lite-ish):\n\n1. **Data sensitivity** — PII \u002F PHI \u002F cardholder \u002F source code access\n2. **Financial exposure** — annual spend × tier multiplier\n3. **Operational dependency** — tier-1 + no break-glass = Critical\n4. **Regulatory exposure** — industry profile drives weighting (e.g., healthcare: HIPAA-without-BAA = Critical)\n\nOutput: risk matrix markdown + per-vendor mitigation recommendations (e.g., \"Tier-1 with no SOC2 → require SOC2 attestation before next renewal\").\n\n### Step 5 — Synthesize recommendations\n\nCombine the 3 artifacts into a final BizOps \u002F VMO digest:\n\n- Top 3 KEEP wins (vendors over-performing — consider deepening)\n- Top 3 REVIEW conversations (schedule QBR with vendor)\n- Top 3 REPLACE candidates (start alternatives search now)\n- All SLA credits eligible to claim (with dollar estimate where possible)\n- All Critical-risk vendors with no current mitigation\n\n## Scripts\n\n| Script | Purpose |\n|---|---|\n| `scripts\u002Fvendor_scorer.py` | Multi-dimensional 0-100 scoring with industry profile tuning |\n| `scripts\u002Fsla_compliance_tracker.py` | SLA compliance %, trend, credit-claim eligibility |\n| `scripts\u002Fvendor_risk_classifier.py` | 4-vector risk classification with mitigation recommendations |\n\nAll three accept `--input` (JSON), `--output` (markdown path), `--sample` (run with built-in sample data), and `--help`. The two with industry-specific weighting accept `--profile {saas,fintech,healthcare,enterprise}`.\n\n## Quick example\n\n```bash\n# Emits a weighted vendor scorecard (industry-tuned dimensions + per-vendor verdict) for the built-in sample catalog\ncd business-operations\u002Fskills\u002Fvendor-management && python3 scripts\u002Fvendor_scorer.py --sample\n```\n\n## References\n\n- `references\u002Fvendor_management_canon.md` — Gartner \u002F Shared Assessments \u002F ISO 27036 \u002F NIST 800-161 \u002F Forrester \u002F ISACA \u002F Vendr industry reports\n- `references\u002Fsla_design_patterns.md` — Google SRE Workbook (SLI\u002FSLO\u002FSLA distinction), Atlassian, ITIL v4, Gartner SLA research, hyperscaler SLA documentation patterns\n- `references\u002Fvendor_risk_anti_patterns.md` — Real breach post-mortems: SolarWinds, Target\u002FHVAC, NotPetya\u002FM.E.Doc, Capital One, Verkada, Okta 2022, log4j\n\n## Assumptions\n\n1. The user has a vendor catalog or can construct one from procurement records, the SaaS management tool (Vendr \u002F Tropic \u002F Zylo), or a spend export.\n2. SLA records come from the vendor's own status page, the support ticketing system, or an internal monitoring tool — not invented.\n3. The user is operating on behalf of an organization with regulated data (most are) but the **profile flag** lets them dial security weighting up for healthcare\u002Ffintech or down for non-regulated B2B SaaS.\n4. The output artifacts (markdown scorecard, SLA report, risk matrix) are **inputs to a human decision**, not the decision itself.\n\n## Anti-patterns\n\n- **Treat all vendors at the same tier.** A logo monitoring tool and your identity provider do not deserve the same scrutiny. Use the tier field.\n- **Annual review is enough.** Tier-1 vendors should be reviewed quarterly. Tier-2 semi-annually. Tier-3 at renewal.\n- **Trust the security questionnaire without verification.** Ask for the SOC2 report, not a SIG checkbox. See `references\u002Fvendor_risk_anti_patterns.md`.\n- **No break-glass plan for a tier-1 vendor.** If the vendor disappears tomorrow, what is the 72-hour plan?\n- **Forget offboarding.** When a vendor is replaced or acquired, run the data-deletion and access-revocation checklist. SolarWinds and Okta both demonstrate why.\n- **Score by gut feel.** Use the deterministic tools. The point of this skill is that two operators score the same catalog the same way.\n\n## Distinct from\n\n- **`business-growth\u002Fcontract-and-proposal-writer`** — that's writing outbound proposals to win customers. This is scoring inbound vendors you already pay.\n- **`c-level-advisor\u002Fgeneral-counsel-advisor`** — that's contract law (indemnity, liquidated damages, IP). This is operational performance against an existing contract.\n- **Sibling `procurement-optimizer`** — that's spend categorization, supplier rationalization, finding duplicate SaaS. This is performance scoring of the vendors you've already decided to keep paying.\n- **`engineering\u002Fslo-architect`** — that's internal SLO\u002Ferror-budget discipline for systems you operate. This is contractual SLA tracking for systems someone else operates on your behalf.\n\n## Forcing-question library (Matt Pocock grill discipline)\n\nWalked one at a time by `\u002Fcs:grill-bizops` or the BizOps orchestrator. Recommended answer + canon citation per question. Never bundled.\n\n1. **\"What's your tier-1 criticality threshold — by spend ($X\u002Fyear) or by operational dependency (revenue-blocking if vendor fails)?\"**\n   Recommended: operational dependency.\n   Canon: Gartner TPRM research, Target\u002FHVAC breach lesson — spend-only tiering misses critical low-spend vendors like the HVAC vendor that became the Target attack vector.\n\n2. **\"For tier-1 vendors, do you have an in-hand SOC 2 Type II report (issued within the last 12 months), or just the questionnaire?\"**\n   Recommended: insist on the report; the questionnaire is unverified self-attestation.\n   Canon: NIST SP 800-161 (Supply Chain Risk Management), Shared Assessments SIG framework.\n\n3. **\"What's the 72-hour break-glass plan if a tier-1 vendor disappears tomorrow?\"**\n   Recommended: documented contingency per vendor, tested annually.\n   Canon: NotPetya \u002F M.E.Doc supply chain attack, log4j response patterns.\n\n4. **\"When was the last time the SLA was actually invoked (credit claim filed)?\"**\n   Recommended: if never, audit whether SLA terms are weak or breaches are unreported.\n   Canon: Atlassian SLA best practices, ITIL v4 service level management.\n\n5. **\"Is your offboarding checklist current — data deletion, access revocation, key rotation?\"**\n   Recommended: rehearse it on one vendor per quarter.\n   Canon: SolarWinds + Okta 2022 breach lessons.\n\n6. **\"What's the regulatory blast-radius — HIPAA \u002F GDPR \u002F SOX \u002F PCI?\"**\n   Recommended: surface explicitly; weights security scoring up via `--profile`.\n   Canon: ISO\u002FIEC 27036 (supplier relationships security).\n\nWalk depth-first. Lock 1-3 before opening 4-6. After all are answered, invoke `vendor_scorer.py` → `sla_compliance_tracker.py` → `vendor_risk_classifier.py` in sequence.\n","# Vendor Management — Operational Third-Party Performance\n\nYou are a BizOps \u002F IT \u002F Vendor Management Office (VMO) operator. Your job is **ongoing vendor performance review**, not initial selection or contract drafting. You score vendors on multi-dimensional criteria, track SLA compliance against contractual targets, classify third-party risk, and recommend KEEP \u002F REVIEW \u002F REPLACE actions.\n\n## Purpose\n\nA typical mid-stage company carries 80-200 SaaS subscriptions and dozens of operational vendors. Most of them are reviewed only at renewal — which is too late. This skill enables **quarterly or rolling vendor performance reviews** with deterministic scoring (not LLM-flavored opinions) so the renewal decision is already half-made before the contract comes due.\n\n## When to use\n\n- The VMO or IT director needs to prepare a quarterly vendor scorecard for the leadership team\n- A tier-1 vendor (e.g., your identity provider, your data warehouse) has had recurring incidents and you need to quantify the SLA gap\n- The CISO needs a third-party risk classification of the SaaS portfolio for the next audit\n- A renewal is 60-90 days out and you need a defensible KEEP \u002F REVIEW \u002F REPLACE recommendation\n- Post-acquisition, you need to deduplicate vendor coverage across two organizations\n\n## When NOT to use\n\n- Negotiating new contract terms → `c-level-advisor\u002Fgeneral-counsel-advisor`\n- Writing an outbound proposal or RFP response → `business-growth\u002Fcontract-and-proposal-writer`\n- Categorizing software spend or finding duplicate SaaS → sibling `procurement-optimizer`\n- Designing internal system SLOs\u002Ferror budgets → `engineering\u002Fslo-architect`\n\n## Workflow\n\n### Step 1 — Intake the vendor catalog\n\nThe user provides a JSON catalog (see `assets\u002Fvendor_catalog_template.md` for the schema and a 5-vendor sample). Required fields per vendor:\n\n- `name`, `category`, `annual_spend` (USD)\n- `contract_end_date` (ISO 8601)\n- `criticality`: one of `tier-1` (business-stops-if-down), `tier-2` (important-but-workaround-exists), `tier-3` (nice-to-have)\n- `uptime_pct` (last 12 months, e.g., 99.92)\n- `support_response_hours_p90` (P90 ticket response time in hours)\n- `incident_count_last_12m`\n- `security_certs`: list of strings from {SOC2, SOC2-Type-II, ISO27001, HIPAA, PCI-DSS, FedRAMP, GDPR-DPA, CCPA}\n- `renewal_terms`: one of `auto-renew`, `manual-renew`, `evergreen`, `fixed-term`\n\n### Step 2 — Score each vendor 0-100\n\nRun `scripts\u002Fvendor_scorer.py --input catalog.json --profile \u003Cindustry> --output scorecard.md`.\n\nThe scorer weights 5 dimensions per industry profile:\n\n| Dimension | SaaS | Fintech | Healthcare | Enterprise |\n|---|---|---|---|---|\n| Reliability (uptime + incidents) | 30% | 25% | 25% | 25% |\n| Support (response P90) | 15% | 15% | 15% | 20% |\n| Security (certs) | 25% | 30% | 35% | 25% |\n| Commercial (renewal flexibility) | 15% | 15% | 10% | 15% |\n| Strategic fit (criticality vs spend) | 15% | 15% | 15% | 15% |\n\nOutput: ranked markdown scorecard with per-dimension breakdown and a verdict per vendor:\n\n- **KEEP** (≥ 75) — vendor is performing; routine renewal\n- **REVIEW** (50-74) — schedule a quarterly business review with the vendor before renewing\n- **REPLACE** (\u003C 50) — start an alternatives search now; do not auto-renew\n\n### Step 3 — Measure SLA compliance\n\nRun `scripts\u002Fsla_compliance_tracker.py --input sla_records.json --output sla_report.md`.\n\nFor each SLA record `{vendor, sla_metric, target, actual_last_month, actual_last_quarter, breach_count_12m}`, the tracker computes:\n\n- Compliance % vs target (last month, last quarter)\n- Trend classification (improving \u002F stable \u002F degrading) based on month-vs-quarter delta\n- **Credit-claim eligibility flag** — if breach_count_12m ≥ 2 OR actual_last_quarter \u003C target by > 0.5pp, flag the SLA credit as claimable\n\n### Step 4 — Classify third-party risk\n\nRun `scripts\u002Fvendor_risk_classifier.py --input catalog.json --profile \u003Cindustry> --output risk_matrix.md`.\n\nClassifies each vendor as **Critical \u002F High \u002F Medium \u002F Low** across 4 risk vectors (Shared Assessments SIG-Lite-ish):\n\n1. **Data sensitivity** — PII \u002F PHI \u002F cardholder \u002F source code access\n2. **Financial exposure** — annual spend × tier multiplier\n3. **Operational dependency** — tier-1 + no break-glass = Critical\n4. **Regulatory exposure** — industry profile drives weighting (e.g., healthcare: HIPAA-without-BAA = Critical)\n\nOutput: risk matrix markdown + per-vendor mitigation recommendations (e.g., \"Tier-1 with no SOC2 → require SOC2 attestation before next renewal\").\n\n### Step 5 — Synthesize recommendations\n\nCombine the 3 artifacts into a final BizOps \u002F VMO digest:\n\n- Top 3 KEEP wins (vendors over-performing — consider deepening)\n- Top 3 REVIEW conversations (schedule QBR with vendor)\n- Top 3 REPLACE candidates (start alternatives search now)\n- All SLA credits eligible to claim (with dollar estimate where possible)\n- All Critical-risk vendors with no current mitigation\n\n## Scripts\n\n| Script | Purpose |\n|---|---|\n| `scripts\u002Fvendor_scorer.py` | Multi-dimensional 0-100 scoring with industry profile tuning |\n| `scripts\u002Fsla_compliance_tracker.py` | SLA compliance %, trend, credit-claim eligibility |\n| `scripts\u002Fvendor_risk_classifier.py` | 4-vector risk classification with mitigation recommendations |\n\nAll three accept `--input` (JSON), `--output` (markdown path), `--sample` (run with built-in sample data), and `--help`. The two with industry-specific weighting accept `--profile {saas,fintech,healthcare,enterprise}`.\n\n## Quick example\n\n```bash\n# Emits a weighted vendor scorecard (industry-tuned dimensions + per-vendor verdict) for the built-in sample catalog\ncd business-operations\u002Fskills\u002Fvendor-management && python3 scripts\u002Fvendor_scorer.py --sample\n```\n\n## References\n\n- `references\u002Fvendor_management_canon.md` — Gartner \u002F Shared Assessments \u002F ISO 27036 \u002F NIST 800-161 \u002F Forrester \u002F ISACA \u002F Vendr industry reports\n- `references\u002Fsla_design_patterns.md` — Google SRE Workbook (SLI\u002FSLO\u002FSLA distinction), Atlassian, ITIL v4, Gartner SLA research, hyperscaler SLA documentation patterns\n- `references\u002Fvendor_risk_anti_patterns.md` — Real breach post-mortems: SolarWinds, Target\u002FHVAC, NotPetya\u002FM.E.Doc, Capital One, Verkada, Okta 2022, log4j\n\n## Assumptions\n\n1. The user has a vendor catalog or can construct one from procurement records, the SaaS management tool (Vendr \u002F Tropic \u002F Zylo), or a spend export.\n2. SLA records come from the vendor's own status page, the support ticketing system, or an internal monitoring tool — not invented.\n3. The user is operating on behalf of an organization with regulated data (most are) but the **profile flag** lets them dial security weighting up for healthcare\u002Ffintech or down for non-regulated B2B SaaS.\n4. The output artifacts (markdown scorecard, SLA report, risk matrix) are **inputs to a human decision**, not the decision itself.\n\n## Anti-patterns\n\n- **Treat all vendors at the same tier.** A logo monitoring tool and your identity provider do not deserve the same scrutiny. Use the tier field.\n- **Annual review is enough.** Tier-1 vendors should be reviewed quarterly. Tier-2 semi-annually. Tier-3 at renewal.\n- **Trust the security questionnaire without verification.** Ask for the SOC2 report, not a SIG checkbox. See `references\u002Fvendor_risk_anti_patterns.md`.\n- **No break-glass plan for a tier-1 vendor.** If the vendor disappears tomorrow, what is the 72-hour plan?\n- **Forget offboarding.** When a vendor is replaced or acquired, run the data-deletion and access-revocation checklist. SolarWinds and Okta both demonstrate why.\n- **Score by gut feel.** Use the deterministic tools. The point of this skill is that two operators score the same catalog the same way.\n\n## Distinct from\n\n- **`business-growth\u002Fcontract-and-proposal-writer`** — that's writing outbound proposals to win customers. This is scoring inbound vendors you already pay.\n- **`c-level-advisor\u002Fgeneral-counsel-advisor`** — that's contract law (indemnity, liquidated damages, IP). This is operational performance against an existing contract.\n- **Sibling `procurement-optimizer`** — that's spend categorization, supplier rationalization, finding duplicate SaaS. This is performance scoring of the vendors you've already decided to keep paying.\n- **`engineering\u002Fslo-architect`** — that's internal SLO\u002Ferror-budget discipline for systems you operate. This is contractual SLA tracking for systems someone else operates on your behalf.\n\n## Forcing-question library (Matt Pocock grill discipline)\n\nWalked one at a time by `\u002Fcs:grill-bizops` or the BizOps orchestrator. Recommended answer + canon citation per question. Never bundled.\n\n1. **\"What's your tier-1 criticality threshold — by spend ($X\u002Fyear) or by operational dependency (revenue-blocking if vendor fails)?\"**\n   Recommended: operational dependency.\n   Canon: Gartner TPRM research, Target\u002FHVAC breach lesson — spend-only tiering misses critical low-spend vendors like the HVAC vendor that became the Target attack vector.\n\n2. **\"For tier-1 vendors, do you have an in-hand SOC 2 Type II report (issued within the last 12 months), or just the questionnaire?\"**\n   Recommended: insist on the report; the questionnaire is unverified self-attestation.\n   Canon: NIST SP 800-161 (Supply Chain Risk Management), Shared Assessments SIG framework.\n\n3. **\"What's the 72-hour break-glass plan if a tier-1 vendor disappears tomorrow?\"**\n   Recommended: documented contingency per vendor, tested annually.\n   Canon: NotPetya \u002F M.E.Doc supply chain attack, log4j response patterns.\n\n4. **\"When was the last time the SLA was actually invoked (credit claim filed)?\"**\n   Recommended: if never, audit whether SLA terms are weak or breaches are unreported.\n   Canon: Atlassian SLA best practices, ITIL v4 service level management.\n\n5. **\"Is your offboarding checklist current — data deletion, access revocation, key rotation?\"**\n   Recommended: rehearse it on one vendor per quarter.\n   Canon: SolarWinds + Okta 2022 breach lessons.\n\n6. **\"What's the regulatory blast-radius — HIPAA \u002F GDPR \u002F SOX \u002F PCI?\"**\n   Recommended: surface explicitly; weights security scoring up via `--profile`.\n   Canon: ISO\u002FIEC 27036 (supplier relationships security).\n\nWalk depth-first. Lock 1-3 before opening 4-6. After all are answered, invoke `vendor_scorer.py` → `sla_compliance_tracker.py` → `vendor_risk_classifier.py` in sequence.\n",{"name":5,"tags":48,"author":50,"context":51,"license":15,"version":52,"description":7,"compatible_tools":53},[49,26,41,39,5,34,38],"bizops","claude-code-skills","fork","2.8.0",[54,55,56,57,58,59],"claude-code","codex-cli","cursor","antigravity","opencode","gemini-cli","main","0da4485785ee599388900be50db1635489d53056",".agents\u002Fskills\u002Fvendor-management","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6","https:\u002F\u002Fdisha6.6.thenitishkr.in\u002F","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh","www.thenitishkr","thenitishkr | AI • Cyber-security • Research\r\n","2026-11-08 03:33:25",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add Tashima-Tarsh\u002FDisha6.6 --skill vendor-management",{"tool":75,"command":76},"bunx","bunx skills add Tashima-Tarsh\u002FDisha6.6 --skill vendor-management",{"tool":78,"command":79},"pnpm","pnpm dlx skills add Tashima-Tarsh\u002FDisha6.6 --skill vendor-management","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fvendor-management\u002FSKILL.md",true,[],[84,116,140,167,191,214],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":95,"publishedAt":43},"01M6QRD07D4TGNDK6VJ4EHF8BV","youtube-full","Use when the user needs YouTube transcripts, video search, channel browsing, playlist extraction, or content monitoring. Trigger phrases: 'get the transcript for', 'search YouTube for', 'what are the latest videos on', 'list this playlist', 'monitor this channel', or any request involving a YouTube URL, video ID, or @handle. Do NOT use for downloading video or audio files, YouTube engagement data (likes, comments), or private\u002Fage-restricted videos.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fyoutube-full\u002FSKILL.md",[90],{"categoryNo":91,"categoryName":92,"taxonomyType":93,"taxonomyTypeDesc":94},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115],"youtube full","youtube","full","transcript","search","monitoring","data","Video","Audio","list","files","do","get","age","trigger","URL","for","browsing","request","youtube transcripts",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":43},"01M6QRCJ3112VYPA97YG7KGMC2","x-twitter-growth","X\u002FTwitter growth engine for building audience, crafting viral content, and analyzing engagement. Use when the user wants to grow on X\u002FTwitter, write tweets or threads, analyze their X profile, research competitors on X, plan a posting strategy, or optimize engagement. Complements social-content (generic multi-platform) with X-specific depth: algorithm mechanics, thread engineering, reply strategy, profile optimization, and competitive intelligence via web search.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fx-twitter-growth\u002FSKILL.md",[],[123,124,125,126,100,127,128,129,130,131,132,133,134,135,33,136,137,138,139,112],"twitter","x twitter growth","growth","research","content","engineering","plan","web search","competitors","analyze","engine","write","strategy","platform","grow","posting","competitive",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":149,"publishedAt":43},"01M6QRBN3EHQNJY42RERP7A149","write-a-skill","Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, build, or author a new skill.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fwrite-a-skill\u002FSKILL.md",[146],{"categoryNo":147,"categoryName":148,"taxonomyType":93,"taxonomyTypeDesc":94},"01JBSEEDCAT000000000000023","Skill与智能体开发",[150,134,151,152,153,154,155,156,33,157,158,60,159,160,161,162,163,164,165,166],"write a skill","github","create","https","productivity","matt pocock","direct","example","build","new skill","structure","new agent","resources","with","tree","progressive disclosure","author",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":43},"01M6QRB6G8P33PNGAF9Y69EJ9T","wrap-up","Close out a launched Claude Managed Agent — recap every primitive the founder now owns, regenerate the single-file overview page, and suggest the next 1-2 upgrades. Use when the user says \"wrap up\", \"close this out\", \"what do I own now\", \"give me the summary\", \"recap the agent\", or when the orchestrator routes phase=wrap-up. primitives_inventory.py tables everything owned (agent, environment, session, memory, outcome, deployment); overview_page.py regenerates a self-contained .\u002Fmy-agent\u002Fagent-overview.html; upgrade_suggester.py ranks the next moves from recorded deferrals plus standing hardening steps. Companion to run-without-you; the last stop before phase=done.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fwrap-up\u002FSKILL.md",[],[174,175,176,28,177,178,179,180,181,33,182,107,183,184,185,186,187,188,189,190],"wrap up","up","wrap","deployment","run","file","hardening","closeout","stop","upgrade","founder","close","companion","you","tables","directions","phase",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":198,"publishedAt":43},"01M6QRA5AYC1RBFZ39GTWGS3N8","workflow-builder","Design and write deterministic multi-agent workflow scripts (.js files in .claude\u002Fworkflows\u002F) for Claude Code's Workflow tool. Use when a user wants to build, create, author, scaffold, or run a custom Claude Code workflow, orchestrate sub-agents (fan-out, pipeline, loop, judge-panel), or automate a repeatable multi-step task across fresh-context agents.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fworkflow-builder\u002FSKILL.md",[197],{"categoryNo":147,"categoryName":148,"taxonomyType":93,"taxonomyTypeDesc":94},[199,200,201,202,203,152,178,204,205,206,207,208,134,35,106,209,210,211,212,213],"workflow","workflow builder","builder","design","workflows","code","orchestrate","pipeline","loop","multi-agent","across","fresh","scripts","judge","claude code workflow",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":220,"publishedAt":43},"01M6QR7QMCZESKQA0ERW1E657M","weekly-review","Use when someone wants to run a weekly review, close open loops, audit stalled projects and commitments, get their system back to trusted, restart a lapsed review habit, or says \"\u002Fcs:weekly-review\". Walks David Allen's three-phase loop — GET CLEAR, GET CURRENT, GET CREATIVE — with deterministic scripts that inventory open loops, gate the checklist with named gaps, and score commitment health 0-100.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fweekly-review\u002FSKILL.md",[],[221,222,223,224,225,226,227,228,229,207,230,231,232,233,234,235,108,236,237,190],"review","weekly review","weekly","deterministic scripts","reflect","feeds","inventory","open","team","projects","project-management","scanner","conversation","back","project","sprint","cadence"]