[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M754G83JEN4SNGAJE9883PJS":3,"skill-same:01M754G83JEN4SNGAJE9883PJS":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":13,"repositoryHtmlUrl":43,"repositoryHomepageUrl":6,"ownerHtmlUrl":44,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":45,"install":46,"resources":59},"01M754G83JEN4SNGAJE9883PJS","vendor-management",null,"Use when reviewing, scoring, or auditing third-party SaaS \u002F vendor relationships — running a vendor scorecard, tracking SLA compliance, classifying third-party risk, preparing a tier-1 vendor review, or auditing the SaaS portfolio. Triggers on \"vendor SLA\", \"vendor scorecard\", \"third-party risk\", \"TPRM\", \"vendor review\", \"SaaS audit\", \"supplier performance\", \"vendor health check\", \"renewal review\". Forks context so large vendor catalogs (50-500 line items) and SLA logs don't pollute the parent thread. Ships 3 stdlib-only Python tools (vendor scorer with industry tuning, SLA compliance tracker with credit-claim flags, vendor risk classifier across 4 risk vectors), 3 reference docs each citing 7+ authoritative sources (Gartner \u002F Shared Assessments \u002F NIST \u002F ISO 27036 \u002F breach post-mortems), and a 5-vendor catalog template. Distinct from c-level-advisor\u002Fgeneral-counsel-advisor (contract law, not operational management), business-growth\u002Fcontract-and-proposal-writer (outbound proposals, not inbound vendor scoring), and sibling procurement-optimizer (spend categorization, not vendor performance).","ASoudy\u002FAGS","ASoudy","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F40639702?v=4","01M74G5NTCW8MWDNRTAF303PA1","01M74G5NTZXSE6T0GZR5BCB6V0",0,"MIT","https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fnginity-skills-library\u002Fbusiness-operations\u002Fskills\u002Fvendor-management\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: vendor-management\ndescription: Use when reviewing, scoring, or auditing third-party SaaS \u002F vendor relationships — running a vendor scorecard, tracking SLA compliance, classifying third-party risk, preparing a tier-1 vendor review, or auditing the SaaS portfolio. Triggers on \"vendor SLA\", \"vendor scorecard\", \"third-party risk\", \"TPRM\", \"vendor review\", \"SaaS audit\", \"supplier performance\", \"vendor health check\", \"renewal review\". Forks context so large vendor catalogs (50-500 line items) and SLA logs don't pollute the parent thread. Ships 3 stdlib-only Python tools (vendor scorer with industry tuning, SLA compliance tracker with credit-claim flags, vendor risk classifier across 4 risk vectors), 3 reference docs each citing 7+ authoritative sources (Gartner \u002F Shared Assessments \u002F NIST \u002F ISO 27036 \u002F breach post-mortems), and a 5-vendor catalog template. Distinct from c-level-advisor\u002Fgeneral-counsel-advisor (contract law, not operational management), business-growth\u002Fcontract-and-proposal-writer (outbound proposals, not inbound vendor scoring), and sibling procurement-optimizer (spend categorization, not vendor performance).\ncontext: fork\nversion: 2.8.0\nauthor: claude-code-skills\nlicense: MIT\ntags: [bizops, vendor, sla, third-party-risk, vendor-management, saas-management, tprm]\ncompatible_tools: [claude-code, codex-cli, cursor, antigravity, opencode, gemini-cli]\n---\n\n# Vendor Management — Operational Third-Party Performance\n\nYou are a BizOps \u002F IT \u002F Vendor Management Office (VMO) operator. Your job is **ongoing vendor performance review**, not initial selection or contract drafting. You score vendors on multi-dimensional criteria, track SLA compliance against contractual targets, classify third-party risk, and recommend KEEP \u002F REVIEW \u002F REPLACE actions.\n\n## Purpose\n\nA typical mid-stage company carries 80-200 SaaS subscriptions and dozens of operational vendors. Most of them are reviewed only at renewal — which is too late. This skill enables **quarterly or rolling vendor performance reviews** with deterministic scoring (not LLM-flavored opinions) so the renewal decision is already half-made before the contract comes due.\n\n## When to use\n\n- The VMO or IT director needs to prepare a quarterly vendor scorecard for the leadership team\n- A tier-1 vendor (e.g., your identity provider, your data warehouse) has had recurring incidents and you need to quantify the SLA gap\n- The CISO needs a third-party risk classification of the SaaS portfolio for the next audit\n- A renewal is 60-90 days out and you need a defensible KEEP \u002F REVIEW \u002F REPLACE recommendation\n- Post-acquisition, you need to deduplicate vendor coverage across two organizations\n\n## When NOT to use\n\n- Negotiating new contract terms → `c-level-advisor\u002Fgeneral-counsel-advisor`\n- Writing an outbound proposal or RFP response → `business-growth\u002Fcontract-and-proposal-writer`\n- Categorizing software spend or finding duplicate SaaS → sibling `procurement-optimizer`\n- Designing internal system SLOs\u002Ferror budgets → `engineering\u002Fslo-architect`\n\n## Workflow\n\n### Step 1 — Intake the vendor catalog\n\nThe user provides a JSON catalog (see `assets\u002Fvendor_catalog_template.md` for the schema and a 5-vendor sample). Required fields per vendor:\n\n- `name`, `category`, `annual_spend` (USD)\n- `contract_end_date` (ISO 8601)\n- `criticality`: one of `tier-1` (business-stops-if-down), `tier-2` (important-but-workaround-exists), `tier-3` (nice-to-have)\n- `uptime_pct` (last 12 months, e.g., 99.92)\n- `support_response_hours_p90` (P90 ticket response time in hours)\n- `incident_count_last_12m`\n- `security_certs`: list of strings from {SOC2, SOC2-Type-II, ISO27001, HIPAA, PCI-DSS, FedRAMP, GDPR-DPA, CCPA}\n- `renewal_terms`: one of `auto-renew`, `manual-renew`, `evergreen`, `fixed-term`\n\n### Step 2 — Score each vendor 0-100\n\nRun `scripts\u002Fvendor_scorer.py --input catalog.json --profile \u003Cindustry> --output scorecard.md`.\n\nThe scorer weights 5 dimensions per industry profile:\n\n| Dimension | SaaS | Fintech | Healthcare | Enterprise |\n|---|---|---|---|---|\n| Reliability (uptime + incidents) | 30% | 25% | 25% | 25% |\n| Support (response P90) | 15% | 15% | 15% | 20% |\n| Security (certs) | 25% | 30% | 35% | 25% |\n| Commercial (renewal flexibility) | 15% | 15% | 10% | 15% |\n| Strategic fit (criticality vs spend) | 15% | 15% | 15% | 15% |\n\nOutput: ranked markdown scorecard with per-dimension breakdown and a verdict per vendor:\n\n- **KEEP** (≥ 75) — vendor is performing; routine renewal\n- **REVIEW** (50-74) — schedule a quarterly business review with the vendor before renewing\n- **REPLACE** (\u003C 50) — start an alternatives search now; do not auto-renew\n\n### Step 3 — Measure SLA compliance\n\nRun `scripts\u002Fsla_compliance_tracker.py --input sla_records.json --output sla_report.md`.\n\nFor each SLA record `{vendor, sla_metric, target, actual_last_month, actual_last_quarter, breach_count_12m}`, the tracker computes:\n\n- Compliance % vs target (last month, last quarter)\n- Trend classification (improving \u002F stable \u002F degrading) based on month-vs-quarter delta\n- **Credit-claim eligibility flag** — if breach_count_12m ≥ 2 OR actual_last_quarter \u003C target by > 0.5pp, flag the SLA credit as claimable\n\n### Step 4 — Classify third-party risk\n\nRun `scripts\u002Fvendor_risk_classifier.py --input catalog.json --profile \u003Cindustry> --output risk_matrix.md`.\n\nClassifies each vendor as **Critical \u002F High \u002F Medium \u002F Low** across 4 risk vectors (Shared Assessments SIG-Lite-ish):\n\n1. **Data sensitivity** — PII \u002F PHI \u002F cardholder \u002F source code access\n2. **Financial exposure** — annual spend × tier multiplier\n3. **Operational dependency** — tier-1 + no break-glass = Critical\n4. **Regulatory exposure** — industry profile drives weighting (e.g., healthcare: HIPAA-without-BAA = Critical)\n\nOutput: risk matrix markdown + per-vendor mitigation recommendations (e.g., \"Tier-1 with no SOC2 → require SOC2 attestation before next renewal\").\n\n### Step 5 — Synthesize recommendations\n\nCombine the 3 artifacts into a final BizOps \u002F VMO digest:\n\n- Top 3 KEEP wins (vendors over-performing — consider deepening)\n- Top 3 REVIEW conversations (schedule QBR with vendor)\n- Top 3 REPLACE candidates (start alternatives search now)\n- All SLA credits eligible to claim (with dollar estimate where possible)\n- All Critical-risk vendors with no current mitigation\n\n## Scripts\n\n| Script | Purpose |\n|---|---|\n| `scripts\u002Fvendor_scorer.py` | Multi-dimensional 0-100 scoring with industry profile tuning |\n| `scripts\u002Fsla_compliance_tracker.py` | SLA compliance %, trend, credit-claim eligibility |\n| `scripts\u002Fvendor_risk_classifier.py` | 4-vector risk classification with mitigation recommendations |\n\nAll three accept `--input` (JSON), `--output` (markdown path), `--sample` (run with built-in sample data), and `--help`. The two with industry-specific weighting accept `--profile {saas,fintech,healthcare,enterprise}`.\n\n## References\n\n- `references\u002Fvendor_management_canon.md` — Gartner \u002F Shared Assessments \u002F ISO 27036 \u002F NIST 800-161 \u002F Forrester \u002F ISACA \u002F Vendr industry reports\n- `references\u002Fsla_design_patterns.md` — Google SRE Workbook (SLI\u002FSLO\u002FSLA distinction), Atlassian, ITIL v4, Gartner SLA research, hyperscaler SLA documentation patterns\n- `references\u002Fvendor_risk_anti_patterns.md` — Real breach post-mortems: SolarWinds, Target\u002FHVAC, NotPetya\u002FM.E.Doc, Capital One, Verkada, Okta 2022, log4j\n\n## Assumptions\n\n1. The user has a vendor catalog or can construct one from procurement records, the SaaS management tool (Vendr \u002F Tropic \u002F Zylo), or a spend export.\n2. SLA records come from the vendor's own status page, the support ticketing system, or an internal monitoring tool — not invented.\n3. The user is operating on behalf of an organization with regulated data (most are) but the **profile flag** lets them dial security weighting up for healthcare\u002Ffintech or down for non-regulated B2B SaaS.\n4. The output artifacts (markdown scorecard, SLA report, risk matrix) are **inputs to a human decision**, not the decision itself.\n\n## Anti-patterns\n\n- **Treat all vendors at the same tier.** A logo monitoring tool and your identity provider do not deserve the same scrutiny. Use the tier field.\n- **Annual review is enough.** Tier-1 vendors should be reviewed quarterly. Tier-2 semi-annually. Tier-3 at renewal.\n- **Trust the security questionnaire without verification.** Ask for the SOC2 report, not a SIG checkbox. See `references\u002Fvendor_risk_anti_patterns.md`.\n- **No break-glass plan for a tier-1 vendor.** If the vendor disappears tomorrow, what is the 72-hour plan?\n- **Forget offboarding.** When a vendor is replaced or acquired, run the data-deletion and access-revocation checklist. SolarWinds and Okta both demonstrate why.\n- **Score by gut feel.** Use the deterministic tools. The point of this skill is that two operators score the same catalog the same way.\n\n## Distinct from\n\n- **`business-growth\u002Fcontract-and-proposal-writer`** — that's writing outbound proposals to win customers. This is scoring inbound vendors you already pay.\n- **`c-level-advisor\u002Fgeneral-counsel-advisor`** — that's contract law (indemnity, liquidated damages, IP). This is operational performance against an existing contract.\n- **Sibling `procurement-optimizer`** — that's spend categorization, supplier rationalization, finding duplicate SaaS. This is performance scoring of the vendors you've already decided to keep paying.\n- **`engineering\u002Fslo-architect`** — that's internal SLO\u002Ferror-budget discipline for systems you operate. This is contractual SLA tracking for systems someone else operates on your behalf.\n\n## Forcing-question library (Matt Pocock grill discipline)\n\nWalked one at a time by `\u002Fcs:grill-bizops` or the BizOps orchestrator. Recommended answer + canon citation per question. Never bundled.\n\n1. **\"What's your tier-1 criticality threshold — by spend ($X\u002Fyear) or by operational dependency (revenue-blocking if vendor fails)?\"**\n   Recommended: operational dependency.\n   Canon: Gartner TPRM research, Target\u002FHVAC breach lesson — spend-only tiering misses critical low-spend vendors like the HVAC vendor that became the Target attack vector.\n\n2. **\"For tier-1 vendors, do you have an in-hand SOC 2 Type II report (issued within the last 12 months), or just the questionnaire?\"**\n   Recommended: insist on the report; the questionnaire is unverified self-attestation.\n   Canon: NIST SP 800-161 (Supply Chain Risk Management), Shared Assessments SIG framework.\n\n3. **\"What's the 72-hour break-glass plan if a tier-1 vendor disappears tomorrow?\"**\n   Recommended: documented contingency per vendor, tested annually.\n   Canon: NotPetya \u002F M.E.Doc supply chain attack, log4j response patterns.\n\n4. **\"When was the last time the SLA was actually invoked (credit claim filed)?\"**\n   Recommended: if never, audit whether SLA terms are weak or breaches are unreported.\n   Canon: Atlassian SLA best practices, ITIL v4 service level management.\n\n5. **\"Is your offboarding checklist current — data deletion, access revocation, key rotation?\"**\n   Recommended: rehearse it on one vendor per quarter.\n   Canon: SolarWinds + Okta 2022 breach lessons.\n\n6. **\"What's the regulatory blast-radius — HIPAA \u002F GDPR \u002F SOX \u002F PCI?\"**\n   Recommended: surface explicitly; weights security scoring up via `--profile`.\n   Canon: ISO\u002FIEC 27036 (supplier relationships security).\n\nWalk depth-first. Lock 1-3 before opening 4-6. After all are answered, invoke `vendor_scorer.py` → `sla_compliance_tracker.py` → `vendor_risk_classifier.py` in sequence.\n","# Vendor Management — Operational Third-Party Performance\n\nYou are a BizOps \u002F IT \u002F Vendor Management Office (VMO) operator. Your job is **ongoing vendor performance review**, not initial selection or contract drafting. You score vendors on multi-dimensional criteria, track SLA compliance against contractual targets, classify third-party risk, and recommend KEEP \u002F REVIEW \u002F REPLACE actions.\n\n## Purpose\n\nA typical mid-stage company carries 80-200 SaaS subscriptions and dozens of operational vendors. Most of them are reviewed only at renewal — which is too late. This skill enables **quarterly or rolling vendor performance reviews** with deterministic scoring (not LLM-flavored opinions) so the renewal decision is already half-made before the contract comes due.\n\n## When to use\n\n- The VMO or IT director needs to prepare a quarterly vendor scorecard for the leadership team\n- A tier-1 vendor (e.g., your identity provider, your data warehouse) has had recurring incidents and you need to quantify the SLA gap\n- The CISO needs a third-party risk classification of the SaaS portfolio for the next audit\n- A renewal is 60-90 days out and you need a defensible KEEP \u002F REVIEW \u002F REPLACE recommendation\n- Post-acquisition, you need to deduplicate vendor coverage across two organizations\n\n## When NOT to use\n\n- Negotiating new contract terms → `c-level-advisor\u002Fgeneral-counsel-advisor`\n- Writing an outbound proposal or RFP response → `business-growth\u002Fcontract-and-proposal-writer`\n- Categorizing software spend or finding duplicate SaaS → sibling `procurement-optimizer`\n- Designing internal system SLOs\u002Ferror budgets → `engineering\u002Fslo-architect`\n\n## Workflow\n\n### Step 1 — Intake the vendor catalog\n\nThe user provides a JSON catalog (see `assets\u002Fvendor_catalog_template.md` for the schema and a 5-vendor sample). Required fields per vendor:\n\n- `name`, `category`, `annual_spend` (USD)\n- `contract_end_date` (ISO 8601)\n- `criticality`: one of `tier-1` (business-stops-if-down), `tier-2` (important-but-workaround-exists), `tier-3` (nice-to-have)\n- `uptime_pct` (last 12 months, e.g., 99.92)\n- `support_response_hours_p90` (P90 ticket response time in hours)\n- `incident_count_last_12m`\n- `security_certs`: list of strings from {SOC2, SOC2-Type-II, ISO27001, HIPAA, PCI-DSS, FedRAMP, GDPR-DPA, CCPA}\n- `renewal_terms`: one of `auto-renew`, `manual-renew`, `evergreen`, `fixed-term`\n\n### Step 2 — Score each vendor 0-100\n\nRun `scripts\u002Fvendor_scorer.py --input catalog.json --profile \u003Cindustry> --output scorecard.md`.\n\nThe scorer weights 5 dimensions per industry profile:\n\n| Dimension | SaaS | Fintech | Healthcare | Enterprise |\n|---|---|---|---|---|\n| Reliability (uptime + incidents) | 30% | 25% | 25% | 25% |\n| Support (response P90) | 15% | 15% | 15% | 20% |\n| Security (certs) | 25% | 30% | 35% | 25% |\n| Commercial (renewal flexibility) | 15% | 15% | 10% | 15% |\n| Strategic fit (criticality vs spend) | 15% | 15% | 15% | 15% |\n\nOutput: ranked markdown scorecard with per-dimension breakdown and a verdict per vendor:\n\n- **KEEP** (≥ 75) — vendor is performing; routine renewal\n- **REVIEW** (50-74) — schedule a quarterly business review with the vendor before renewing\n- **REPLACE** (\u003C 50) — start an alternatives search now; do not auto-renew\n\n### Step 3 — Measure SLA compliance\n\nRun `scripts\u002Fsla_compliance_tracker.py --input sla_records.json --output sla_report.md`.\n\nFor each SLA record `{vendor, sla_metric, target, actual_last_month, actual_last_quarter, breach_count_12m}`, the tracker computes:\n\n- Compliance % vs target (last month, last quarter)\n- Trend classification (improving \u002F stable \u002F degrading) based on month-vs-quarter delta\n- **Credit-claim eligibility flag** — if breach_count_12m ≥ 2 OR actual_last_quarter \u003C target by > 0.5pp, flag the SLA credit as claimable\n\n### Step 4 — Classify third-party risk\n\nRun `scripts\u002Fvendor_risk_classifier.py --input catalog.json --profile \u003Cindustry> --output risk_matrix.md`.\n\nClassifies each vendor as **Critical \u002F High \u002F Medium \u002F Low** across 4 risk vectors (Shared Assessments SIG-Lite-ish):\n\n1. **Data sensitivity** — PII \u002F PHI \u002F cardholder \u002F source code access\n2. **Financial exposure** — annual spend × tier multiplier\n3. **Operational dependency** — tier-1 + no break-glass = Critical\n4. **Regulatory exposure** — industry profile drives weighting (e.g., healthcare: HIPAA-without-BAA = Critical)\n\nOutput: risk matrix markdown + per-vendor mitigation recommendations (e.g., \"Tier-1 with no SOC2 → require SOC2 attestation before next renewal\").\n\n### Step 5 — Synthesize recommendations\n\nCombine the 3 artifacts into a final BizOps \u002F VMO digest:\n\n- Top 3 KEEP wins (vendors over-performing — consider deepening)\n- Top 3 REVIEW conversations (schedule QBR with vendor)\n- Top 3 REPLACE candidates (start alternatives search now)\n- All SLA credits eligible to claim (with dollar estimate where possible)\n- All Critical-risk vendors with no current mitigation\n\n## Scripts\n\n| Script | Purpose |\n|---|---|\n| `scripts\u002Fvendor_scorer.py` | Multi-dimensional 0-100 scoring with industry profile tuning |\n| `scripts\u002Fsla_compliance_tracker.py` | SLA compliance %, trend, credit-claim eligibility |\n| `scripts\u002Fvendor_risk_classifier.py` | 4-vector risk classification with mitigation recommendations |\n\nAll three accept `--input` (JSON), `--output` (markdown path), `--sample` (run with built-in sample data), and `--help`. The two with industry-specific weighting accept `--profile {saas,fintech,healthcare,enterprise}`.\n\n## References\n\n- `references\u002Fvendor_management_canon.md` — Gartner \u002F Shared Assessments \u002F ISO 27036 \u002F NIST 800-161 \u002F Forrester \u002F ISACA \u002F Vendr industry reports\n- `references\u002Fsla_design_patterns.md` — Google SRE Workbook (SLI\u002FSLO\u002FSLA distinction), Atlassian, ITIL v4, Gartner SLA research, hyperscaler SLA documentation patterns\n- `references\u002Fvendor_risk_anti_patterns.md` — Real breach post-mortems: SolarWinds, Target\u002FHVAC, NotPetya\u002FM.E.Doc, Capital One, Verkada, Okta 2022, log4j\n\n## Assumptions\n\n1. The user has a vendor catalog or can construct one from procurement records, the SaaS management tool (Vendr \u002F Tropic \u002F Zylo), or a spend export.\n2. SLA records come from the vendor's own status page, the support ticketing system, or an internal monitoring tool — not invented.\n3. The user is operating on behalf of an organization with regulated data (most are) but the **profile flag** lets them dial security weighting up for healthcare\u002Ffintech or down for non-regulated B2B SaaS.\n4. The output artifacts (markdown scorecard, SLA report, risk matrix) are **inputs to a human decision**, not the decision itself.\n\n## Anti-patterns\n\n- **Treat all vendors at the same tier.** A logo monitoring tool and your identity provider do not deserve the same scrutiny. Use the tier field.\n- **Annual review is enough.** Tier-1 vendors should be reviewed quarterly. Tier-2 semi-annually. Tier-3 at renewal.\n- **Trust the security questionnaire without verification.** Ask for the SOC2 report, not a SIG checkbox. See `references\u002Fvendor_risk_anti_patterns.md`.\n- **No break-glass plan for a tier-1 vendor.** If the vendor disappears tomorrow, what is the 72-hour plan?\n- **Forget offboarding.** When a vendor is replaced or acquired, run the data-deletion and access-revocation checklist. SolarWinds and Okta both demonstrate why.\n- **Score by gut feel.** Use the deterministic tools. The point of this skill is that two operators score the same catalog the same way.\n\n## Distinct from\n\n- **`business-growth\u002Fcontract-and-proposal-writer`** — that's writing outbound proposals to win customers. This is scoring inbound vendors you already pay.\n- **`c-level-advisor\u002Fgeneral-counsel-advisor`** — that's contract law (indemnity, liquidated damages, IP). This is operational performance against an existing contract.\n- **Sibling `procurement-optimizer`** — that's spend categorization, supplier rationalization, finding duplicate SaaS. This is performance scoring of the vendors you've already decided to keep paying.\n- **`engineering\u002Fslo-architect`** — that's internal SLO\u002Ferror-budget discipline for systems you operate. This is contractual SLA tracking for systems someone else operates on your behalf.\n\n## Forcing-question library (Matt Pocock grill discipline)\n\nWalked one at a time by `\u002Fcs:grill-bizops` or the BizOps orchestrator. Recommended answer + canon citation per question. Never bundled.\n\n1. **\"What's your tier-1 criticality threshold — by spend ($X\u002Fyear) or by operational dependency (revenue-blocking if vendor fails)?\"**\n   Recommended: operational dependency.\n   Canon: Gartner TPRM research, Target\u002FHVAC breach lesson — spend-only tiering misses critical low-spend vendors like the HVAC vendor that became the Target attack vector.\n\n2. **\"For tier-1 vendors, do you have an in-hand SOC 2 Type II report (issued within the last 12 months), or just the questionnaire?\"**\n   Recommended: insist on the report; the questionnaire is unverified self-attestation.\n   Canon: NIST SP 800-161 (Supply Chain Risk Management), Shared Assessments SIG framework.\n\n3. **\"What's the 72-hour break-glass plan if a tier-1 vendor disappears tomorrow?\"**\n   Recommended: documented contingency per vendor, tested annually.\n   Canon: NotPetya \u002F M.E.Doc supply chain attack, log4j response patterns.\n\n4. **\"When was the last time the SLA was actually invoked (credit claim filed)?\"**\n   Recommended: if never, audit whether SLA terms are weak or breaches are unreported.\n   Canon: Atlassian SLA best practices, ITIL v4 service level management.\n\n5. **\"Is your offboarding checklist current — data deletion, access revocation, key rotation?\"**\n   Recommended: rehearse it on one vendor per quarter.\n   Canon: SolarWinds + Okta 2022 breach lessons.\n\n6. **\"What's the regulatory blast-radius — HIPAA \u002F GDPR \u002F SOX \u002F PCI?\"**\n   Recommended: surface explicitly; weights security scoring up via `--profile`.\n   Canon: ISO\u002FIEC 27036 (supplier relationships security).\n\nWalk depth-first. Lock 1-3 before opening 4-6. After all are answered, invoke `vendor_scorer.py` → `sla_compliance_tracker.py` → `vendor_risk_classifier.py` in sequence.\n",{"name":5,"tags":23,"author":30,"context":31,"license":14,"version":32,"description":7,"compatible_tools":33},[24,25,26,27,5,28,29],"bizops","vendor","sla","third-party-risk","saas-management","tprm","claude-code-skills","fork","2.8.0",[34,35,36,37,38,39],"claude-code","codex-cli","cursor","antigravity","opencode","gemini-cli","main","cd1d94757d590093507ef8ac26299eab8bc20478","claude_skills_libraries\u002Fnginity-skills-library\u002Fbusiness-operations\u002Fskills\u002Fvendor-management","https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS","https:\u002F\u002Fgithub.com\u002FASoudy","2026-05-23 09:43:12",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":58},[48,51,54],{"tool":49,"command":50},"npx","npx skills add ASoudy\u002FAGS --skill vendor-management",{"tool":52,"command":53},"bunx","bunx skills add ASoudy\u002FAGS --skill vendor-management",{"tool":55,"command":56},"pnpm","pnpm dlx skills add ASoudy\u002FAGS --skill vendor-management","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fnginity-skills-library\u002Fbusiness-operations\u002Fskills\u002Fvendor-management\u002FSKILL.md",true,[60,66,72,76,80,86,90],{"path":61,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":64,"sourceHtmlUrl":65},"assets\u002Fvendor_catalog_template.md","ASSET","资产文件",6799,"https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fnginity-skills-library\u002Fbusiness-operations\u002Fskills\u002Fvendor-management\u002Fassets\u002Fvendor_catalog_template.md",{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"references\u002Fsla_design_patterns.md","REFERENCE","参考文档",6574,"https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fnginity-skills-library\u002Fbusiness-operations\u002Fskills\u002Fvendor-management\u002Freferences\u002Fsla_design_patterns.md",{"path":73,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Fvendor_management_canon.md",5537,"https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fnginity-skills-library\u002Fbusiness-operations\u002Fskills\u002Fvendor-management\u002Freferences\u002Fvendor_management_canon.md",{"path":77,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fvendor_risk_anti_patterns.md",8707,"https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fnginity-skills-library\u002Fbusiness-operations\u002Fskills\u002Fvendor-management\u002Freferences\u002Fvendor_risk_anti_patterns.md",{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"scripts\u002Fsla_compliance_tracker.py","SCRIPT","脚本",10679,"https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fnginity-skills-library\u002Fbusiness-operations\u002Fskills\u002Fvendor-management\u002Fscripts\u002Fsla_compliance_tracker.py",{"path":87,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fvendor_risk_classifier.py",12269,"https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fnginity-skills-library\u002Fbusiness-operations\u002Fskills\u002Fvendor-management\u002Fscripts\u002Fvendor_risk_classifier.py",{"path":91,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Fvendor_scorer.py",13334,"https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fnginity-skills-library\u002Fbusiness-operations\u002Fskills\u002Fvendor-management\u002Fscripts\u002Fvendor_scorer.py",[95,102,109,116,123,130],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":18},"01M756BTEVC407T0QR8S420JWD","web-typography","Select, pair, and implement typefaces for web projects. Use when the user mentions \"font pairing\", \"which typeface\", \"line height\", \"responsive typography\", \"web font loading\", \"type hierarchy\", \"variable fonts\", \"FOUT\u002FFOIT\", or \"typographic scale\". Also trigger when choosing between system fonts and web fonts, optimizing font loading performance, or designing readable long-form content layouts. Covers readability evaluation, CSS implementation, and performance optimization. For overall UI design systems, see refactoring-ui. For dramatic typographic experiences, see top-design.","https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fwondelai-product-strategy\u002Fweb-typography\u002FSKILL.md",[],[],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":18},"01M756B4RYF2CB17C33X6ZJQT5","ux-heuristics","Evaluate and improve interface usability using heuristic analysis. Use when the user mentions \"usability audit\", \"UX review\", \"users are confused\", \"heuristic evaluation\", \"form usability\", \"navigation problems\", \"Nielsen heuristics\", \"cognitive walkthrough\", or \"usability testing\". Also trigger when reviewing a design for usability issues, improving form completion rates, or evaluating information architecture and navigation. Covers Nielsens 10 heuristics, severity ratings, and information architecture. For visual design fixes, see refactoring-ui. For conversion-focused audits, see cro-methodology.","https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fwondelai-product-strategy\u002Fux-heuristics\u002FSKILL.md",[],[],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":18},"01M756ANVFT0T6BAPV6Y93EPR6","traction-eos","Implement the Entrepreneurial Operating System (EOS) to align vision and execution across a company. Use when the user mentions \"EOS\", \"V\u002FTO\", \"quarterly rocks\", \"Level 10 meetings\", \"accountability chart\", \"IDS process\", \"Entrepreneurial Operating System\", or \"business operating system\". Also trigger when a growing company needs meeting structure, goal-setting frameworks, or a systematic approach to solving recurring organizational issues. Covers the six EOS components: Vision, People, Data, Issues, Process, Traction. For team motivation design, see drive-motivation. For lean experimentation, see lean-startup.","https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fwondelai-product-strategy\u002Ftraction-eos\u002FSKILL.md",[],[],{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":18},"01M756A7NZZMNJN9KZ33QGFHV6","top-design","Create award-winning, immersive web experiences at the level of Awwwards-featured agencies. Use when the user mentions \"premium website\", \"portfolio site\", \"scroll animations\", \"Awwwards quality\", \"brand experience\", \"cinematic web design\", \"parallax storytelling\", or \"agency-quality site\". Also trigger when building landing pages that need to impress, designing creative portfolios, or elevating a standard website to a memorable digital experience. Covers dramatic typography, purposeful motion, scroll-based composition, and performance-optimized animation. For foundational UI, see refactoring-ui. For type selection, see web-typography.","https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fwondelai-product-strategy\u002Ftop-design\u002FSKILL.md",[],[],{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":18},"01M7569J5G1NXM3RR194D52SGB","system-design","Design scalable distributed systems using structured approaches for load balancing, caching, database scaling, and message queues. Use when the user mentions \"system design\", \"scale this\", \"high availability\", \"rate limiter\", \"design a URL shortener\", \"system design interview\", \"capacity planning\", or \"distributed architecture\". Also trigger when estimating infrastructure requirements, choosing between microservices and monoliths, or designing for millions of concurrent users. Covers common system designs and back-of-the-envelope estimation. For data fundamentals, see ddia-systems. For resilience, see release-it.","https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fwondelai-product-strategy\u002Fsystem-design\u002FSKILL.md",[],[],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":18},"01M75691MJKE6PBA1EC398EKQT","storybrand-messaging","Clarify brand messaging using narrative structure that positions the customer as hero. Use when the user mentions \"brand message\", \"website copy\", \"elevator pitch\", \"one-liner\", \"messaging isnt resonating\", \"brand script\", \"StoryBrand framework\", or \"customer as hero\". Also trigger when rewriting homepage copy, crafting email nurture sequences, or creating consistent messaging across sales collateral and marketing materials. Covers landing page copy, marketing collateral, and consistent communication. For memorable messaging, see made-to-stick. For product positioning, see obviously-awesome.","https:\u002F\u002Fgithub.com\u002FASoudy\u002FAGS\u002Fblob\u002Fmain\u002Fclaude_skills_libraries\u002Fwondelai-product-strategy\u002Fstorybrand-messaging\u002FSKILL.md",[],[]]