[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M79YVVRHNKGQ2WHKB9PDGJMH":3,"skill-same:01M79YVVRHNKGQ2WHKB9PDGJMH":96},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":47,"install":48,"resources":61},"01M79YVVRHNKGQ2WHKB9PDGJMH","vendor-management",null,"Use when reviewing, scoring, or auditing third-party SaaS \u002F vendor relationships — running a vendor scorecard with industry tuning, tracking SLA compliance with credit-claim flags, classifying third-party risk across 4 risk vectors, preparing a tier-1 vendor review, or auditing the SaaS portfolio. Forks context so large vendor catalogs (50-500 line items) and SLA logs don't pollute the parent thread. Triggers on \"vendor SLA\", \"vendor scorecard\", \"third-party risk\", \"TPRM\", \"vendor review\", \"supplier performance\", \"vendor health check\", \"renewal review\".","Heverton-web\u002Fproj_livros","Heverton-web","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F136394064?v=4","01M79STQDWSTA88J5CA9QR184V","Heverton Eduardo Peres","01M79STQEFTTYHD3AC7F2RRW5T",0,"MIT","https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fvendor-management\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: vendor-management\ndescription: Use when reviewing, scoring, or auditing third-party SaaS \u002F vendor relationships — running a vendor scorecard with industry tuning, tracking SLA compliance with credit-claim flags, classifying third-party risk across 4 risk vectors, preparing a tier-1 vendor review, or auditing the SaaS portfolio. Forks context so large vendor catalogs (50-500 line items) and SLA logs don't pollute the parent thread. Triggers on \"vendor SLA\", \"vendor scorecard\", \"third-party risk\", \"TPRM\", \"vendor review\", \"supplier performance\", \"vendor health check\", \"renewal review\".\ncontext: fork\nversion: 2.8.0\nauthor: claude-code-skills\nlicense: MIT\ntags: [bizops, vendor, sla, third-party-risk, vendor-management, saas-management, tprm]\ncompatible_tools: [claude-code, codex-cli, cursor, antigravity, opencode, gemini-cli]\n---\n\n# Vendor Management — Operational Third-Party Performance\n\nYou are a BizOps \u002F IT \u002F Vendor Management Office (VMO) operator. Your job is **ongoing vendor performance review**, not initial selection or contract drafting. You score vendors on multi-dimensional criteria, track SLA compliance against contractual targets, classify third-party risk, and recommend KEEP \u002F REVIEW \u002F REPLACE actions.\n\n## Purpose\n\nA typical mid-stage company carries 80-200 SaaS subscriptions and dozens of operational vendors. Most of them are reviewed only at renewal — which is too late. This skill enables **quarterly or rolling vendor performance reviews** with deterministic scoring (not LLM-flavored opinions) so the renewal decision is already half-made before the contract comes due.\n\n## When to use\n\n- The VMO or IT director needs to prepare a quarterly vendor scorecard for the leadership team\n- A tier-1 vendor (e.g., your identity provider, your data warehouse) has had recurring incidents and you need to quantify the SLA gap\n- The CISO needs a third-party risk classification of the SaaS portfolio for the next audit\n- A renewal is 60-90 days out and you need a defensible KEEP \u002F REVIEW \u002F REPLACE recommendation\n- Post-acquisition, you need to deduplicate vendor coverage across two organizations\n\n## When NOT to use\n\n- Negotiating new contract terms → `c-level-advisor\u002Fgeneral-counsel-advisor`\n- Writing an outbound proposal or RFP response → `business-growth\u002Fcontract-and-proposal-writer`\n- Categorizing software spend or finding duplicate SaaS → sibling `procurement-optimizer`\n- Designing internal system SLOs\u002Ferror budgets → `engineering\u002Fslo-architect`\n\n## Workflow\n\n### Step 1 — Intake the vendor catalog\n\nThe user provides a JSON catalog (see `assets\u002Fvendor_catalog_template.md` for the schema and a 5-vendor sample). Required fields per vendor:\n\n- `name`, `category`, `annual_spend` (USD)\n- `contract_end_date` (ISO 8601)\n- `criticality`: one of `tier-1` (business-stops-if-down), `tier-2` (important-but-workaround-exists), `tier-3` (nice-to-have)\n- `uptime_pct` (last 12 months, e.g., 99.92)\n- `support_response_hours_p90` (P90 ticket response time in hours)\n- `incident_count_last_12m`\n- `security_certs`: list of strings from {SOC2, SOC2-Type-II, ISO27001, HIPAA, PCI-DSS, FedRAMP, GDPR-DPA, CCPA}\n- `renewal_terms`: one of `auto-renew`, `manual-renew`, `evergreen`, `fixed-term`\n\n### Step 2 — Score each vendor 0-100\n\nRun `scripts\u002Fvendor_scorer.py --input catalog.json --profile \u003Cindustry> --output scorecard.md`.\n\nThe scorer weights 5 dimensions per industry profile:\n\n| Dimension | SaaS | Fintech | Healthcare | Enterprise |\n|---|---|---|---|---|\n| Reliability (uptime + incidents) | 30% | 25% | 25% | 25% |\n| Support (response P90) | 15% | 15% | 15% | 20% |\n| Security (certs) | 25% | 30% | 35% | 25% |\n| Commercial (renewal flexibility) | 15% | 15% | 10% | 15% |\n| Strategic fit (criticality vs spend) | 15% | 15% | 15% | 15% |\n\nOutput: ranked markdown scorecard with per-dimension breakdown and a verdict per vendor:\n\n- **KEEP** (≥ 75) — vendor is performing; routine renewal\n- **REVIEW** (50-74) — schedule a quarterly business review with the vendor before renewing\n- **REPLACE** (\u003C 50) — start an alternatives search now; do not auto-renew\n\n### Step 3 — Measure SLA compliance\n\nRun `scripts\u002Fsla_compliance_tracker.py --input sla_records.json --output sla_report.md`.\n\nFor each SLA record `{vendor, sla_metric, target, actual_last_month, actual_last_quarter, breach_count_12m}`, the tracker computes:\n\n- Compliance % vs target (last month, last quarter)\n- Trend classification (improving \u002F stable \u002F degrading) based on month-vs-quarter delta\n- **Credit-claim eligibility flag** — if breach_count_12m ≥ 2 OR actual_last_quarter \u003C target by > 0.5pp, flag the SLA credit as claimable\n\n### Step 4 — Classify third-party risk\n\nRun `scripts\u002Fvendor_risk_classifier.py --input catalog.json --profile \u003Cindustry> --output risk_matrix.md`.\n\nClassifies each vendor as **Critical \u002F High \u002F Medium \u002F Low** across 4 risk vectors (Shared Assessments SIG-Lite-ish):\n\n1. **Data sensitivity** — PII \u002F PHI \u002F cardholder \u002F source code access\n2. **Financial exposure** — annual spend × tier multiplier\n3. **Operational dependency** — tier-1 + no break-glass = Critical\n4. **Regulatory exposure** — industry profile drives weighting (e.g., healthcare: HIPAA-without-BAA = Critical)\n\nOutput: risk matrix markdown + per-vendor mitigation recommendations (e.g., \"Tier-1 with no SOC2 → require SOC2 attestation before next renewal\").\n\n### Step 5 — Synthesize recommendations\n\nCombine the 3 artifacts into a final BizOps \u002F VMO digest:\n\n- Top 3 KEEP wins (vendors over-performing — consider deepening)\n- Top 3 REVIEW conversations (schedule QBR with vendor)\n- Top 3 REPLACE candidates (start alternatives search now)\n- All SLA credits eligible to claim (with dollar estimate where possible)\n- All Critical-risk vendors with no current mitigation\n\n## Scripts\n\n| Script | Purpose |\n|---|---|\n| `scripts\u002Fvendor_scorer.py` | Multi-dimensional 0-100 scoring with industry profile tuning |\n| `scripts\u002Fsla_compliance_tracker.py` | SLA compliance %, trend, credit-claim eligibility |\n| `scripts\u002Fvendor_risk_classifier.py` | 4-vector risk classification with mitigation recommendations |\n\nAll three accept `--input` (JSON), `--output` (markdown path), `--sample` (run with built-in sample data), and `--help`. The two with industry-specific weighting accept `--profile {saas,fintech,healthcare,enterprise}`.\n\n## Quick example\n\n```bash\n# Emits a weighted vendor scorecard (industry-tuned dimensions + per-vendor verdict) for the built-in sample catalog\ncd business-operations\u002Fskills\u002Fvendor-management && python3 scripts\u002Fvendor_scorer.py --sample\n```\n\n## References\n\n- `references\u002Fvendor_management_canon.md` — Gartner \u002F Shared Assessments \u002F ISO 27036 \u002F NIST 800-161 \u002F Forrester \u002F ISACA \u002F Vendr industry reports\n- `references\u002Fsla_design_patterns.md` — Google SRE Workbook (SLI\u002FSLO\u002FSLA distinction), Atlassian, ITIL v4, Gartner SLA research, hyperscaler SLA documentation patterns\n- `references\u002Fvendor_risk_anti_patterns.md` — Real breach post-mortems: SolarWinds, Target\u002FHVAC, NotPetya\u002FM.E.Doc, Capital One, Verkada, Okta 2022, log4j\n\n## Assumptions\n\n1. The user has a vendor catalog or can construct one from procurement records, the SaaS management tool (Vendr \u002F Tropic \u002F Zylo), or a spend export.\n2. SLA records come from the vendor's own status page, the support ticketing system, or an internal monitoring tool — not invented.\n3. The user is operating on behalf of an organization with regulated data (most are) but the **profile flag** lets them dial security weighting up for healthcare\u002Ffintech or down for non-regulated B2B SaaS.\n4. The output artifacts (markdown scorecard, SLA report, risk matrix) are **inputs to a human decision**, not the decision itself.\n\n## Anti-patterns\n\n- **Treat all vendors at the same tier.** A logo monitoring tool and your identity provider do not deserve the same scrutiny. Use the tier field.\n- **Annual review is enough.** Tier-1 vendors should be reviewed quarterly. Tier-2 semi-annually. Tier-3 at renewal.\n- **Trust the security questionnaire without verification.** Ask for the SOC2 report, not a SIG checkbox. See `references\u002Fvendor_risk_anti_patterns.md`.\n- **No break-glass plan for a tier-1 vendor.** If the vendor disappears tomorrow, what is the 72-hour plan?\n- **Forget offboarding.** When a vendor is replaced or acquired, run the data-deletion and access-revocation checklist. SolarWinds and Okta both demonstrate why.\n- **Score by gut feel.** Use the deterministic tools. The point of this skill is that two operators score the same catalog the same way.\n\n## Distinct from\n\n- **`business-growth\u002Fcontract-and-proposal-writer`** — that's writing outbound proposals to win customers. This is scoring inbound vendors you already pay.\n- **`c-level-advisor\u002Fgeneral-counsel-advisor`** — that's contract law (indemnity, liquidated damages, IP). This is operational performance against an existing contract.\n- **Sibling `procurement-optimizer`** — that's spend categorization, supplier rationalization, finding duplicate SaaS. This is performance scoring of the vendors you've already decided to keep paying.\n- **`engineering\u002Fslo-architect`** — that's internal SLO\u002Ferror-budget discipline for systems you operate. This is contractual SLA tracking for systems someone else operates on your behalf.\n\n## Forcing-question library (Matt Pocock grill discipline)\n\nWalked one at a time by `\u002Fcs:grill-bizops` or the BizOps orchestrator. Recommended answer + canon citation per question. Never bundled.\n\n1. **\"What's your tier-1 criticality threshold — by spend ($X\u002Fyear) or by operational dependency (revenue-blocking if vendor fails)?\"**\n   Recommended: operational dependency.\n   Canon: Gartner TPRM research, Target\u002FHVAC breach lesson — spend-only tiering misses critical low-spend vendors like the HVAC vendor that became the Target attack vector.\n\n2. **\"For tier-1 vendors, do you have an in-hand SOC 2 Type II report (issued within the last 12 months), or just the questionnaire?\"**\n   Recommended: insist on the report; the questionnaire is unverified self-attestation.\n   Canon: NIST SP 800-161 (Supply Chain Risk Management), Shared Assessments SIG framework.\n\n3. **\"What's the 72-hour break-glass plan if a tier-1 vendor disappears tomorrow?\"**\n   Recommended: documented contingency per vendor, tested annually.\n   Canon: NotPetya \u002F M.E.Doc supply chain attack, log4j response patterns.\n\n4. **\"When was the last time the SLA was actually invoked (credit claim filed)?\"**\n   Recommended: if never, audit whether SLA terms are weak or breaches are unreported.\n   Canon: Atlassian SLA best practices, ITIL v4 service level management.\n\n5. **\"Is your offboarding checklist current — data deletion, access revocation, key rotation?\"**\n   Recommended: rehearse it on one vendor per quarter.\n   Canon: SolarWinds + Okta 2022 breach lessons.\n\n6. **\"What's the regulatory blast-radius — HIPAA \u002F GDPR \u002F SOX \u002F PCI?\"**\n   Recommended: surface explicitly; weights security scoring up via `--profile`.\n   Canon: ISO\u002FIEC 27036 (supplier relationships security).\n\nWalk depth-first. Lock 1-3 before opening 4-6. After all are answered, invoke `vendor_scorer.py` → `sla_compliance_tracker.py` → `vendor_risk_classifier.py` in sequence.\n","# Vendor Management — Operational Third-Party Performance\n\nYou are a BizOps \u002F IT \u002F Vendor Management Office (VMO) operator. Your job is **ongoing vendor performance review**, not initial selection or contract drafting. You score vendors on multi-dimensional criteria, track SLA compliance against contractual targets, classify third-party risk, and recommend KEEP \u002F REVIEW \u002F REPLACE actions.\n\n## Purpose\n\nA typical mid-stage company carries 80-200 SaaS subscriptions and dozens of operational vendors. Most of them are reviewed only at renewal — which is too late. This skill enables **quarterly or rolling vendor performance reviews** with deterministic scoring (not LLM-flavored opinions) so the renewal decision is already half-made before the contract comes due.\n\n## When to use\n\n- The VMO or IT director needs to prepare a quarterly vendor scorecard for the leadership team\n- A tier-1 vendor (e.g., your identity provider, your data warehouse) has had recurring incidents and you need to quantify the SLA gap\n- The CISO needs a third-party risk classification of the SaaS portfolio for the next audit\n- A renewal is 60-90 days out and you need a defensible KEEP \u002F REVIEW \u002F REPLACE recommendation\n- Post-acquisition, you need to deduplicate vendor coverage across two organizations\n\n## When NOT to use\n\n- Negotiating new contract terms → `c-level-advisor\u002Fgeneral-counsel-advisor`\n- Writing an outbound proposal or RFP response → `business-growth\u002Fcontract-and-proposal-writer`\n- Categorizing software spend or finding duplicate SaaS → sibling `procurement-optimizer`\n- Designing internal system SLOs\u002Ferror budgets → `engineering\u002Fslo-architect`\n\n## Workflow\n\n### Step 1 — Intake the vendor catalog\n\nThe user provides a JSON catalog (see `assets\u002Fvendor_catalog_template.md` for the schema and a 5-vendor sample). Required fields per vendor:\n\n- `name`, `category`, `annual_spend` (USD)\n- `contract_end_date` (ISO 8601)\n- `criticality`: one of `tier-1` (business-stops-if-down), `tier-2` (important-but-workaround-exists), `tier-3` (nice-to-have)\n- `uptime_pct` (last 12 months, e.g., 99.92)\n- `support_response_hours_p90` (P90 ticket response time in hours)\n- `incident_count_last_12m`\n- `security_certs`: list of strings from {SOC2, SOC2-Type-II, ISO27001, HIPAA, PCI-DSS, FedRAMP, GDPR-DPA, CCPA}\n- `renewal_terms`: one of `auto-renew`, `manual-renew`, `evergreen`, `fixed-term`\n\n### Step 2 — Score each vendor 0-100\n\nRun `scripts\u002Fvendor_scorer.py --input catalog.json --profile \u003Cindustry> --output scorecard.md`.\n\nThe scorer weights 5 dimensions per industry profile:\n\n| Dimension | SaaS | Fintech | Healthcare | Enterprise |\n|---|---|---|---|---|\n| Reliability (uptime + incidents) | 30% | 25% | 25% | 25% |\n| Support (response P90) | 15% | 15% | 15% | 20% |\n| Security (certs) | 25% | 30% | 35% | 25% |\n| Commercial (renewal flexibility) | 15% | 15% | 10% | 15% |\n| Strategic fit (criticality vs spend) | 15% | 15% | 15% | 15% |\n\nOutput: ranked markdown scorecard with per-dimension breakdown and a verdict per vendor:\n\n- **KEEP** (≥ 75) — vendor is performing; routine renewal\n- **REVIEW** (50-74) — schedule a quarterly business review with the vendor before renewing\n- **REPLACE** (\u003C 50) — start an alternatives search now; do not auto-renew\n\n### Step 3 — Measure SLA compliance\n\nRun `scripts\u002Fsla_compliance_tracker.py --input sla_records.json --output sla_report.md`.\n\nFor each SLA record `{vendor, sla_metric, target, actual_last_month, actual_last_quarter, breach_count_12m}`, the tracker computes:\n\n- Compliance % vs target (last month, last quarter)\n- Trend classification (improving \u002F stable \u002F degrading) based on month-vs-quarter delta\n- **Credit-claim eligibility flag** — if breach_count_12m ≥ 2 OR actual_last_quarter \u003C target by > 0.5pp, flag the SLA credit as claimable\n\n### Step 4 — Classify third-party risk\n\nRun `scripts\u002Fvendor_risk_classifier.py --input catalog.json --profile \u003Cindustry> --output risk_matrix.md`.\n\nClassifies each vendor as **Critical \u002F High \u002F Medium \u002F Low** across 4 risk vectors (Shared Assessments SIG-Lite-ish):\n\n1. **Data sensitivity** — PII \u002F PHI \u002F cardholder \u002F source code access\n2. **Financial exposure** — annual spend × tier multiplier\n3. **Operational dependency** — tier-1 + no break-glass = Critical\n4. **Regulatory exposure** — industry profile drives weighting (e.g., healthcare: HIPAA-without-BAA = Critical)\n\nOutput: risk matrix markdown + per-vendor mitigation recommendations (e.g., \"Tier-1 with no SOC2 → require SOC2 attestation before next renewal\").\n\n### Step 5 — Synthesize recommendations\n\nCombine the 3 artifacts into a final BizOps \u002F VMO digest:\n\n- Top 3 KEEP wins (vendors over-performing — consider deepening)\n- Top 3 REVIEW conversations (schedule QBR with vendor)\n- Top 3 REPLACE candidates (start alternatives search now)\n- All SLA credits eligible to claim (with dollar estimate where possible)\n- All Critical-risk vendors with no current mitigation\n\n## Scripts\n\n| Script | Purpose |\n|---|---|\n| `scripts\u002Fvendor_scorer.py` | Multi-dimensional 0-100 scoring with industry profile tuning |\n| `scripts\u002Fsla_compliance_tracker.py` | SLA compliance %, trend, credit-claim eligibility |\n| `scripts\u002Fvendor_risk_classifier.py` | 4-vector risk classification with mitigation recommendations |\n\nAll three accept `--input` (JSON), `--output` (markdown path), `--sample` (run with built-in sample data), and `--help`. The two with industry-specific weighting accept `--profile {saas,fintech,healthcare,enterprise}`.\n\n## Quick example\n\n```bash\n# Emits a weighted vendor scorecard (industry-tuned dimensions + per-vendor verdict) for the built-in sample catalog\ncd business-operations\u002Fskills\u002Fvendor-management && python3 scripts\u002Fvendor_scorer.py --sample\n```\n\n## References\n\n- `references\u002Fvendor_management_canon.md` — Gartner \u002F Shared Assessments \u002F ISO 27036 \u002F NIST 800-161 \u002F Forrester \u002F ISACA \u002F Vendr industry reports\n- `references\u002Fsla_design_patterns.md` — Google SRE Workbook (SLI\u002FSLO\u002FSLA distinction), Atlassian, ITIL v4, Gartner SLA research, hyperscaler SLA documentation patterns\n- `references\u002Fvendor_risk_anti_patterns.md` — Real breach post-mortems: SolarWinds, Target\u002FHVAC, NotPetya\u002FM.E.Doc, Capital One, Verkada, Okta 2022, log4j\n\n## Assumptions\n\n1. The user has a vendor catalog or can construct one from procurement records, the SaaS management tool (Vendr \u002F Tropic \u002F Zylo), or a spend export.\n2. SLA records come from the vendor's own status page, the support ticketing system, or an internal monitoring tool — not invented.\n3. The user is operating on behalf of an organization with regulated data (most are) but the **profile flag** lets them dial security weighting up for healthcare\u002Ffintech or down for non-regulated B2B SaaS.\n4. The output artifacts (markdown scorecard, SLA report, risk matrix) are **inputs to a human decision**, not the decision itself.\n\n## Anti-patterns\n\n- **Treat all vendors at the same tier.** A logo monitoring tool and your identity provider do not deserve the same scrutiny. Use the tier field.\n- **Annual review is enough.** Tier-1 vendors should be reviewed quarterly. Tier-2 semi-annually. Tier-3 at renewal.\n- **Trust the security questionnaire without verification.** Ask for the SOC2 report, not a SIG checkbox. See `references\u002Fvendor_risk_anti_patterns.md`.\n- **No break-glass plan for a tier-1 vendor.** If the vendor disappears tomorrow, what is the 72-hour plan?\n- **Forget offboarding.** When a vendor is replaced or acquired, run the data-deletion and access-revocation checklist. SolarWinds and Okta both demonstrate why.\n- **Score by gut feel.** Use the deterministic tools. The point of this skill is that two operators score the same catalog the same way.\n\n## Distinct from\n\n- **`business-growth\u002Fcontract-and-proposal-writer`** — that's writing outbound proposals to win customers. This is scoring inbound vendors you already pay.\n- **`c-level-advisor\u002Fgeneral-counsel-advisor`** — that's contract law (indemnity, liquidated damages, IP). This is operational performance against an existing contract.\n- **Sibling `procurement-optimizer`** — that's spend categorization, supplier rationalization, finding duplicate SaaS. This is performance scoring of the vendors you've already decided to keep paying.\n- **`engineering\u002Fslo-architect`** — that's internal SLO\u002Ferror-budget discipline for systems you operate. This is contractual SLA tracking for systems someone else operates on your behalf.\n\n## Forcing-question library (Matt Pocock grill discipline)\n\nWalked one at a time by `\u002Fcs:grill-bizops` or the BizOps orchestrator. Recommended answer + canon citation per question. Never bundled.\n\n1. **\"What's your tier-1 criticality threshold — by spend ($X\u002Fyear) or by operational dependency (revenue-blocking if vendor fails)?\"**\n   Recommended: operational dependency.\n   Canon: Gartner TPRM research, Target\u002FHVAC breach lesson — spend-only tiering misses critical low-spend vendors like the HVAC vendor that became the Target attack vector.\n\n2. **\"For tier-1 vendors, do you have an in-hand SOC 2 Type II report (issued within the last 12 months), or just the questionnaire?\"**\n   Recommended: insist on the report; the questionnaire is unverified self-attestation.\n   Canon: NIST SP 800-161 (Supply Chain Risk Management), Shared Assessments SIG framework.\n\n3. **\"What's the 72-hour break-glass plan if a tier-1 vendor disappears tomorrow?\"**\n   Recommended: documented contingency per vendor, tested annually.\n   Canon: NotPetya \u002F M.E.Doc supply chain attack, log4j response patterns.\n\n4. **\"When was the last time the SLA was actually invoked (credit claim filed)?\"**\n   Recommended: if never, audit whether SLA terms are weak or breaches are unreported.\n   Canon: Atlassian SLA best practices, ITIL v4 service level management.\n\n5. **\"Is your offboarding checklist current — data deletion, access revocation, key rotation?\"**\n   Recommended: rehearse it on one vendor per quarter.\n   Canon: SolarWinds + Okta 2022 breach lessons.\n\n6. **\"What's the regulatory blast-radius — HIPAA \u002F GDPR \u002F SOX \u002F PCI?\"**\n   Recommended: surface explicitly; weights security scoring up via `--profile`.\n   Canon: ISO\u002FIEC 27036 (supplier relationships security).\n\nWalk depth-first. Lock 1-3 before opening 4-6. After all are answered, invoke `vendor_scorer.py` → `sla_compliance_tracker.py` → `vendor_risk_classifier.py` in sequence.\n",{"name":5,"tags":24,"author":31,"context":32,"license":15,"version":33,"description":7,"compatible_tools":34},[25,26,27,28,5,29,30],"bizops","vendor","sla","third-party-risk","saas-management","tprm","claude-code-skills","fork","2.8.0",[35,36,37,38,39,40],"claude-code","codex-cli","cursor","antigravity","opencode","gemini-cli","main","5eac686c0e84af1a5dc958c1bfb6c9d00699561d",".claude\u002Fskills\u002Fvendor-management",1,"https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros","https:\u002F\u002Fgithub.com\u002FHeverton-web","2026-07-29 06:58:59",{"source":8,"skillName":5,"commands":49,"prompt":59,"zipAvailable":60},[50,53,56],{"tool":51,"command":52},"npx","npx skills add Heverton-web\u002Fproj_livros --skill vendor-management",{"tool":54,"command":55},"bunx","bunx skills add Heverton-web\u002Fproj_livros --skill vendor-management",{"tool":57,"command":58},"pnpm","pnpm dlx skills add Heverton-web\u002Fproj_livros --skill vendor-management","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fvendor-management\u002FSKILL.md",true,[62,68,74,78,82,88,92],{"path":63,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":66,"sourceHtmlUrl":67},"assets\u002Fvendor_catalog_template.md","ASSET","资产文件",6799,"https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fvendor-management\u002Fassets\u002Fvendor_catalog_template.md",{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"references\u002Fsla_design_patterns.md","REFERENCE","参考文档",6574,"https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fvendor-management\u002Freferences\u002Fsla_design_patterns.md",{"path":75,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Fvendor_management_canon.md",5537,"https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fvendor-management\u002Freferences\u002Fvendor_management_canon.md",{"path":79,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fvendor_risk_anti_patterns.md",8707,"https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fvendor-management\u002Freferences\u002Fvendor_risk_anti_patterns.md",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"scripts\u002Fsla_compliance_tracker.py","SCRIPT","脚本",10679,"https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fvendor-management\u002Fscripts\u002Fsla_compliance_tracker.py",{"path":89,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":90,"sourceHtmlUrl":91},"scripts\u002Fvendor_risk_classifier.py",12269,"https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fvendor-management\u002Fscripts\u002Fvendor_risk_classifier.py",{"path":93,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":94,"sourceHtmlUrl":95},"scripts\u002Fvendor_scorer.py",13334,"https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fvendor-management\u002Fscripts\u002Fvendor_scorer.py",[97,104,111,118,125,132],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":19},"01M7A3PZFSZ0K95BAD6QHJPX97","youtube-full","Use when the user needs YouTube transcripts, video search, channel browsing, playlist extraction, or content monitoring. Trigger phrases: 'get the transcript for', 'search YouTube for', 'what are the latest videos on', 'list this playlist', 'monitor this channel', or any request involving a YouTube URL, video ID, or @handle. Do NOT use for downloading video or audio files, YouTube engagement data (likes, comments), or private\u002Fage-restricted videos.","https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002Fagentic\u002Fskills\u002Fyoutube-full\u002FSKILL.md",[],[],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":19},"01M7A3PH26QVPYRTM6EWS45YET","x-twitter-growth","X\u002FTwitter growth engine for building audience, crafting viral content, and analyzing engagement. Use when the user wants to grow on X\u002FTwitter, write tweets or threads, analyze their X profile, research competitors on X, plan a posting strategy, or optimize engagement. Complements social-content (generic multi-platform) with X-specific depth: algorithm mechanics, thread engineering, reply strategy, profile optimization, and competitive intelligence via web search.","https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002Fagentic\u002Fskills\u002Fx-twitter-growth\u002FSKILL.md",[],[],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":19},"01M7A3NVTC4N3NG1TA2SGSFGF6","write-a-skill","Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, build, or author a new skill.","https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002Fagentic\u002Fskills\u002Fwrite-a-skill\u002FSKILL.md",[],[],{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":19},"01M7A3NQNAJPSQ24VWSQ679AX8","workflow-builder","Design and write deterministic multi-agent workflow scripts (.js files in .claude\u002Fworkflows\u002F) for Claude Code's Workflow tool. Use when a user wants to build, create, author, scaffold, or run a custom Claude Code workflow, orchestrate sub-agents (fan-out, pipeline, loop, judge-panel), or automate a repeatable multi-step task across fresh-context agents.","https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002Fagentic\u002Fskills\u002Fworkflow-builder\u002FSKILL.md",[],[],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":19},"01M7A3NE3FGSMGDY5XVKJ8297H","weekly-review","Use when someone wants to run a weekly review, close open loops, audit stalled projects and commitments, get their system back to trusted, restart a lapsed review habit, or says \"\u002Fcs:weekly-review\". Walks David Allen's three-phase loop — GET CLEAR, GET CURRENT, GET CREATIVE — with deterministic scripts that inventory open loops, gate the checklist with named gaps, and score commitment health 0-100.","https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002Fagentic\u002Fskills\u002Fweekly-review\u002FSKILL.md",[],[],{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":19},"01M7A3N4ZG6TVJ1TST9C0T5QAK","webinar-marketing","When the user wants to plan, promote, run, or improve a webinar or virtual event to generate and convert demand. Use when the user mentions 'webinar,' 'virtual event,' 'online event,' 'live demo,' 'virtual summit,' 'workshop,' 'masterclass,' 'fireside chat,' 'roundtable,' 'registration funnel,' 'show-up rate,' 'attendance rate,' 'webinar promotion,' 'webinar follow-up,' or 'on-demand webinar.' Also use when they have a webinar that isn't converting — low registrations, low show-up, or attendees who don't buy — and want to diagnose and fix it. Covers the full funnel: registration, promotion, show-up, live engagement, live-to-close, and post-event nurture. Distinct from launch-strategy (full product launches) and email-sequence (lifecycle nurture) — this is the end-to-end webinar\u002Fevent motion. NOT for in-person field events logistics, and NOT for generic lifecycle email (use email-sequence).","https:\u002F\u002Fgithub.com\u002FHeverton-web\u002Fproj_livros\u002Fblob\u002Fmain\u002Fagentic\u002Fskills\u002Fwebinar-marketing\u002FSKILL.md",[],[]]