vendor-risk — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vendor-risk (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Every new integration is a supply chain decision. No vendor gets access without assessment.
.compliance/vendors/VND-YYYY-NNN-slug.json — one file per assessmentprofile.json → suppliers[] — kept in sync after approvalOne JSON per vendor assessment. Created on first contact, updated through lifecycle.
{
"assessment_id": "VND-2026-001-hubspot",
"vendor_name": "HubSpot",
"status": "proposed | under-review | approved | conditional | rejected | offboarded",
"assessed_at": "ISO 8601",
"assessed_by": "agent | user",
"type": "saas | infra | service | library | api",
"data_shared": ["klantdata", "email", "contactgegevens"],
"criticality": "critical | important | standard",
"touches_critical_assets": ["Klant-administratiedata (CRM)"],
"checks": {
"dpa_signed": false,
"hosting_location": "EU (Ireland)",
"hosting_compliant": true,
"certification": "SOC2 Type II",
"access_scope": "API read/write to CRM contacts",
"least_privilege": true,
"exit_strategy": "CSV export available"
},
"decision": "approved | conditional | rejected",
"decision_reasoning": "Why this decision was made",
"conditions": ["DPA must be signed before go-live"],
"review_date": "ISO 8601 — next scheduled review",
"timeline": [
{ "timestamp": "ISO 8601", "action": "what happened", "actor": "who" }
]
}When the agent detects a new vendor (user mentions a tool, code imports a new SDK, API call to unknown service):
profile.suppliers — is this vendor already known?| Check | Question | Fail = |
|---|---|---|
| Data flow | What data does this vendor access or receive? | If it touches a critical asset → criticality = critical |
| DPA/processor agreement | Is a Data Processing Agreement (DPA) signed? | Required if personal data is shared (GDPR Art. 28) |
| Hosting location | Where is data stored/processed? | If org has data residency constraints → check compliance |
| Security posture | Does the vendor have ISO 27001, SOC2 Type II, or equivalent? | No certification for critical vendor = HIGH risk |
| Access scope | What systems/APIs does the vendor need access to? Least privilege? | Broader than necessary = flag |
| Exit strategy | Can you extract your data and switch vendors? | Vendor lock-in on critical asset = risk |
| Outcome | When | Action |
|---|---|---|
| Approve | All checks pass, DPA in place, hosting compliant | Add to profile.suppliers with status "approved" |
| Conditional | Minor gaps (e.g. DPA pending, certification in progress) | Approve with deadline for remediation, flag for follow-up |
| Reject | Fails data residency, no DPA possible, touches critical asset without security posture | Do not integrate. Log decision via audit-logging |
contract_review_date — review vendors annually at minimum, critical vendors every 6 monthsWhen a vendor relationship ends:
offboard_date and status: "offboarded"The agent flags a vendor risk event when:
pip install, npm install, new API client)contract_review_date is past dueprofile.suppliers. Unknown = create assessment record in .compliance/vendors/ and start the lifecycle.profile.critical_assets. Touches a critical asset = criticality=critical.profile.constraints. Flag hosting location violations.policy_ref: "NIS2 Art. 21(2)(d)").profile.suppliers and set review_date.review_date.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.