agentsclimarketplace
Sign in

Vendor security review

Skill ClarentCinematics/Codex-Skills-for-Enterprise/skills/vendor-security-review

Review vendor security questionnaires, procurement security notes, SOC2 summaries, DPA excerpts, subprocessor lists, security answer drafts, or risk-review packets for missing coverage, weak evidence, follow-up questions, and human-review risks. Use when Codex needs to prepare a vendor security review without making legal, compliance, or approval decisions.From its SKILL.md

Install
npx -y skills add ClarentCinematics/Codex-Skills-for-Enterprise --skill vendor-security-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
  • runs commandsInstructs the agent to run 1 command, including `scripts/check_vendor_security_answers.py --input <path>`.

SKILL.md

2.3 KB, 407 tokens by cl100k_base, as published. Nobody here has run it

Vendor Security Review

Workflow

  1. Identify vendor, product, data involved, intended use, review stage, and source documents.
  2. Check coverage for security, privacy, data handling, access control, auditability, and contractual evidence.
  3. Separate supplied evidence from vendor claims, assumptions, missing answers, and review questions.
  4. Flag gaps, weak answers, risks, and required human review.
  5. Produce a concise review packet for security, legal, procurement, or business owners.

Script-Assisted Workflow

When given a questionnaire or answer draft, run scripts/check_vendor_security_answers.py --input <path> first. Use --json for structured coverage output. The helper detects missing topic coverage and weak answers; it does not approve vendors or provide legal/security certification.

Output Standard

Use this structure by default:

  • Review Summary: vendor, product, intended use, data sensitivity, and readiness.
  • Coverage Check: SOC2, DPA, subprocessors, retention, breach notification, encryption, SSO, and audit logs.
  • Evidence Gaps: missing or weak answers with source excerpts.
  • Risk Questions: security, privacy, legal, procurement, and business-owner follow-ups.
  • Recommended Next Steps: review actions and owners when stated.
  • Human Review Required: approvals, exceptions, legal terms, or risk acceptance.
  • Caveats: non-inferred approvals and source limitations.

Rules

  • Do not approve vendors, accept risk, provide legal advice, or certify compliance.
  • Do not invent SOC2 status, DPA terms, subprocessors, encryption controls, SSO support, or breach-notification terms.
  • Mark missing answers as missing, not failed, unless the source explicitly says a control is absent.
  • Treat customer, employee, health, financial, or regulated data as requiring human review.

References

Read references/vendor-security-rubric.md when preparing security, privacy, procurement, or legal follow-up questions.

What ships with it: 3 files

5.3 KB alongside SKILL.md, 1 of them executable

agents/

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.