Vanta workspace

Skill Elnora-AI/elnora-vanta/skills/vanta-workspace

Read-only Vanta compliance CLI — frameworks, tests, controls, documents, vulnerabilities, risks, people, integrations, policies, vendors, groups, computers. Agent-friendly JSON output, strictly HTTP GET. Use when: checking compliance status, failing tests, missing evidence, vulnerability SLAs, risk register, audit prep, or any Vanta query. TRIGGERS: "vanta", "compliance", "soc 2", "iso 27001", "failing tests", "compliance tests", "controls", "evidence", "vulnerabilities", "vulns", "SLA", "risk register", "audit", "security posture"From its SKILL.md

Install

npx -y skills add Elnora-AI/elnora-vanta --skill vanta-workspace

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

5.8 KB, as published. Nobody here has run it

Vanta Workspace Skill

Read-only access to the Vanta compliance platform from the command line.

The elnora-vanta binary must be on your PATH (npm install -g @elnora-ai/vanta). Verify with elnora-vanta frameworks list. If that fails, see INSTALL_FOR_AGENTS.md.

Note: the binary is elnora-vanta, not vanta — we don't shadow other tools that claim the vanta name.

Read-only guarantee: the CLI issues HTTP GET requests only. This is enforced in code, by a PreToolUse hook, and by the OAuth scope (vanta-api.all:read). Nothing here can modify your Vanta tenant.

Auth

OAuth client-credentials. Credential resolution order: VANTA_CLIENT_ID / VANTA_CLIENT_SECRET from the environment, then ~/.config/elnora-vanta/.env (or $VANTA_CONFIG_DIR/.env), then a .env next to the CLI. Create the OAuth client in the Vanta dashboard at https://app.vanta.com/settings/api with the client_credentials grant and only the vanta-api.all:read scope. Tokens are auto-cached at ~/.config/elnora-vanta/token.json (mode 0600).

Default API base is https://api.vanta.com. EU or AUS tenants set VANTA_API_BASE_URL=https://api.eu.vanta.com or https://api.aus.vanta.com (the CLI pins requests to these three hosts).

Routing Table

Query	Command
Framework status / completion	`elnora-vanta frameworks list`
Failing tests / test status	`elnora-vanta tests list --status NEEDS_ATTENTION`
Test entities / resources	`elnora-vanta tests entities <id>`
Security controls	`elnora-vanta controls list --framework <id>`
Control tests	`elnora-vanta controls tests <id>`
Control evidence documents	`elnora-vanta controls documents <id>`
Missing documents / evidence	`elnora-vanta documents list --status "Needs document"`
Document files	`elnora-vanta documents files <id>`
Document links	`elnora-vanta documents links <id>`
Vulnerabilities / CVEs	`elnora-vanta vulns list [--severity HIGH] [--overdue] [--cve <id>] [--search <query>]`
Vulnerable assets	`elnora-vanta vuln-assets list`
Remediation tracking	`elnora-vanta vuln-remediations list`
Risk register	`elnora-vanta risks list`
People / personnel	`elnora-vanta people list [--task-status OVERDUE]`
User groups	`elnora-vanta groups list`
Connected integrations	`elnora-vanta integrations list`
Compliance policies	`elnora-vanta policies list [--framework <id>]`
Third-party vendors	`elnora-vanta vendors list`
Monitored computers / endpoints	`elnora-vanta computers list`
Shell completions	`elnora-vanta completion <bash\|zsh\|fish\|powershell>`

Framework ids are discovered per org — run elnora-vanta frameworks list and use the ids it returns (e.g. soc2, iso27001 — examples only, your tenant's ids may differ). Never assume a framework is enrolled.

Quick Dashboard

For a quick compliance overview, run these 3 commands in parallel:

elnora-vanta tests list --status NEEDS_ATTENTION
elnora-vanta documents list --status "Needs document"
elnora-vanta vulns list --overdue

Common Options

Global flags on every command:

--compact — token-efficient output
--output json|table|csv — output format (default: json)
--fields <list> — select specific fields
--page-size <n> — API page size
--limit <n> — cap results on list commands (default: all pages)
--no-color — disable ANSI colors

Filters:

--framework <id> — filter by framework id (discover with frameworks list)
--status <status> — tests: OK, NEEDS_ATTENTION, DEACTIVATED, IN_PROGRESS, INVALID, NOT_APPLICABLE; documents: case-insensitive text (e.g. "Needs document")
--severity <level> — vulns: CRITICAL, HIGH, MEDIUM, LOW
--overdue — only SLA-overdue vulnerabilities
--cve <id> — filter vulns by CVE ID
--search <query> — search vulns by name, description, or package identifier
--integration <id> — filter tests or vulns by integration ID
--task-status <status> — people: COMPLETE, DUE_SOON, OVERDUE, NONE

Cached References

Before hitting the API for posture context, check the cached reference files in $VANTA_REFERENCES_DIR (or ${CLAUDE_PLUGIN_ROOT}/references/ if unset):

vanta-tests.md — failing tests summary
vanta-documents.md — all documents with status
vanta-controls.md — controls grouped by framework
vanta-vulns.md — vulnerabilities with SLA dates

The repo ships these as *.template.md placeholders with fake rows; run /vanta-sync to generate the real ones from your tenant. Generated files contain your org's live compliance posture — they are gitignored and must never be committed.

Read the cache first for context. Use the CLI for live data when freshness matters.

Slash Commands

/vanta-status — quick compliance dashboard (failing tests, missing docs, overdue vulns)
/vanta-sync — refresh cached reference files from the live API
/vanta-vulns — vulnerability dashboard with SLA tracking
/vanta-report — generate a full compliance report

Output Format

All commands print JSON to stdout:

{ "<data_key>": [...], "count": N }

Errors go to stderr:

{ "error": "message", "suggestion": "how to fix" }