Agent skill · business finance · borghei
vendor-due-diligence
Assess IT vendors and third-party partners with multi-factor risk scoring and regulatory compliance checklists. Use when evaluating technology vendors.
Why this skill is useful
Adds 2 executable scripts for vendor risk scoring and comparison that automate complex assessments not easily inferred by the AI.
What it needs
Requires python installed locally. About 6k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
⚠️ EXPERIMENTAL — This skill is provided for educational and informational purposes only. It does NOT constitute legal advice. All responsibility for usage rests with the user. Consult qualified legal professionals before acting on any output. Vendor Due Diligence Skill Overview Production-ready framework for assessing IT service providers, technology vendors, and third-party partners. Provides a Three-Phase Assessment (Initial Screening, Detailed Assessment, Final Evaluation), Multi-Factor Risk Scoring across 6 dimensions with critical-service weighting, regulatory compliance checklists for 8 frameworks, vendor comparison matrices, and ongoing monitoring with Early Warning Indicators. Designed for procurement teams, legal counsel, IT security, and compliance officers evaluating technology vendors. Table of Contents Tools Reference Guides Workflows Troubleshooting Success Criteria Scope & Limitations Anti-Patterns Tool Reference Clarify First Before scoring the vendor, confirm these inputs. If any is unknown or vague, ASK — do not assume: [ ] Is the service critical/essential — the --critical flag applies a 2x weight to security and compliance, which can flip the composite score and the Approve/Reject recommendation [ ] Applicable regulatory frameworks — GDPR, DORA, NIS2, SOX, PCI DSS, ISO 27001/SOC 2, HIPAA, FedRAMP — selects which compliance checklists run [ ] Questionnaire responses + independent evidence — the 6-dimension scores; self-reported-only data inflates scores, so confirm whether SOC 2 / pen-test / financial evidence backs them Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the assessment. Tools 1. Vendor Risk Scorer (scripts/vendorriskscorer.py) Scores a vendor across 6 risk dimensions based on questionnaire responses. Calculates weighted composite score with 2x multiplier for critical services. Generates risk heat map and overall recommendation. 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/vendor-due-diligence