Guide · Agent skill
How to use the Vendor Management agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The vendor-management skill is a set of instructions and bundled Python scripts that lets an AI agent review a company's software and service vendors the way an operations or IT vendor-management office would. It is aimed at IT directors, vendor managers and security or compliance staff who review vendors on an ongoing basis. After this guide you will know what the skill does, how to install it, how to phrase a request that triggers it, and what inputs it needs.
Vendor Managementalirezarezvani/claude-skills · MIT Download the skill Quick start
- 1Download and unzip. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder.
- 2Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 3Install Python 3. The scripts need Python 3 only; they use the standard library.
- 4Prepare the catalog. Copy the schema from assets/vendor_catalog_template.md into a JSON file and replace the sample vendors with yours.
- 5Try the sample. Run the scorer with --sample from the skill folder to see the output.
- 6Ask for a review. Request a scorecard, SLA check or risk classification in plain language, naming your catalog file.
- 7Check the recommendations. Verify the KEEP, REVIEW or REPLACE calls against your contracts before acting on them.
What the vendor-management skill makes the agent do
Agent skills are folders of instructions and supporting files that an agent such as Claude loads when a task matches the skill's description. This one covers ongoing vendor performance review, not vendor selection or contract drafting.
Working from a JSON catalog of your vendors, the agent runs bundled Python scripts to score each vendor from 0 to 100 using industry-tuned weights, measure SLA compliance against contract targets and flag likely service-credit claims, and classify third-party risk across four risk vectors. For each vendor it recommends KEEP, REVIEW or REPLACE, with the aim of deciding renewals before contracts come due.
- Scores: 0-100 per vendor, weighted by industry profile (saas, fintech, healthcare or enterprise)
- SLA tracking: compliance percentage, trend, and a credit-claim eligibility flag
- Risk: Critical, High, Medium or Low across data sensitivity, financial exposure, operational dependency and regulatory exposure
- Verdicts: KEEP (75 and above), REVIEW (50-74), REPLACE (below 50)
Install the vendor-management skill
Download the ZIP from this page and unzip it. For a personal setup, place the folder in ~/.claude/skills/. To limit it to one project, place it in that project's .claude/skills/ folder.
If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills
Prepare your vendor catalog and SLA records
The skill needs a vendor catalog in JSON. Each vendor is one object in a top-level array. The required fields are name, category, annual_spend (USD), contract_end_date (ISO 8601), criticality (tier-1, tier-2 or tier-3), uptime_pct for the last 12 months, support_response_hours_p90, incident_count_last_12m, security_certs and renewal_terms.
The skill includes assets/vendor_catalog_template.md, which shows the schema and a five-vendor sample you can copy and replace. If you track SLAs, keep those records in a separate JSON file with vendor, sla_metric, target, actual_last_month, actual_last_quarter and breach_count_12m for each record.
- Allowed security_certs values include SOC2, SOC2-Type-II, ISO27001, HIPAA, PCI-DSS, FedRAMP, GDPR-DPA and CCPA
- Allowed renewal_terms values are auto-renew, manual-renew, evergreen and fixed-term
- Requires Python 3; the scripts use only the standard library
Run the scorer, SLA tracker and risk classifier
The skill ships three scripts. The scorer produces a ranked markdown scorecard. The SLA tracker computes compliance and credit-claim flags. The risk classifier produces a risk matrix with mitigation suggestions. All three accept --input, --output, --sample and --help. The scorer and classifier also accept --profile with saas, fintech, healthcare or enterprise.
To try the skill without your own data, run the scorer on the built-in sample catalog from the skill folder.
- Score: python3 scripts/vendor_scorer.py --input catalog.json --profile saas --output scorecard.md
- SLA: python3 scripts/sla_compliance_tracker.py --input sla_records.json --output sla_report.md
- Risk: python3 scripts/vendor_risk_classifier.py --input catalog.json --profile saas --output risk_matrix.md
cd business-operations/skills/vendor-management && python3 scripts/vendor_scorer.py --sampleTrigger the skill with natural requests
You do not need to name the skill. The skill's description lists trigger phrases, so ordinary requests about vendor work should load it. Say what you want reviewed and mention the catalog or SLA data.
Strong triggers include the phrases vendor SLA, vendor scorecard, third-party risk, TPRM, vendor review, supplier performance, vendor health check and renewal review.
- "Run a vendor scorecard for our SaaS catalog in catalog.json using the saas profile."
- "Check our SLA records for compliance and tell me which service credits we can claim."
- "We have a renewal in 75 days for our data warehouse. Give me a keep, review or replace recommendation."
- "Prepare a third-party risk classification for next quarter's audit."
Understand the outputs and their limits
The outputs are markdown files: a scorecard, an SLA report and a risk matrix. The skill treats them as inputs to a human decision, not the decision itself. The scores come from fixed weights and your input data, so they can be wrong if the catalog is incomplete or stale.
The skill is not meant for negotiating contract terms or drafting RFPs. Its own guidance points to other skills for those tasks.
- Good for: quarterly vendor scorecards, renewals due within 60-90 days, third-party risk classification for an audit
- Not for: contract negotiation, RFPs, or final renewal or legal decisions without human review
Safety notes: scripts and network access
This skill runs scripts. The listed files are Python scripts in the scripts/ folder, and the skill is documented as not using the network. Read the scripts before running them on sensitive vendor data, since your catalog may contain spend and security information.
Vendor catalogs can hold commercially sensitive figures and details about security certifications. Keep the input and output files in a location you control.
- Runs scripts: yes
- Uses network: no
- Review scripts/vendor_scorer.py, scripts/sla_compliance_tracker.py and scripts/vendor_risk_classifier.py before use
Tips for better results
Use the criticality field honestly. The skill's guidance is that tier-1 vendors such as your identity provider should get more scrutiny than a logo monitoring tool. Review tier-1 vendors quarterly, tier-2 semi-annually and tier-3 at renewal, as the skill's anti-patterns section recommends.
Keep the uptime, incident and certification data current. Stale inputs produce stale verdicts. Choose the profile that matches your regulatory situation, since it changes how security is weighted.
- Start with --sample to see the output format before using real data
- Match --profile to your industry: saas, fintech, healthcare or enterprise
- Treat any REPLACE verdict as a prompt to start an alternatives search, not an automatic cancellation
What people use it for
- Preparing a quarterly vendor scorecard for the leadership team
- Deciding keep, review or replace for a vendor renewing in the next 60-90 days
- Quantifying the SLA gap for a tier-1 vendor with recurring incidents
- Classifying third-party risk for a SaaS portfolio before an audit
- Reviewing a SaaS catalog after two organizations merge to spot overlapping vendor coverage
Frequently asked questions
How do I install the vendor management agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder to limit it to that project. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.
What do I need to run the vendor-management skill?
You need Python 3, since the scripts use only the standard library, and a vendor catalog in JSON with fields such as uptime, incidents, certifications and contract dates. SLA records in JSON are needed only if you use SLA tracking.
Is the vendor-management skill free?
The skill is published under the MIT licence, as stated on this page. Check the licence file in the download for the full terms.
Does the vendor-management skill use the internet?
No. The skill is documented as not using the network, but it does run Python scripts, so review them before running on sensitive data.
Can the skill draft contracts or RFPs?
No. The skill is for ongoing performance review, not selection or legal work. Its guidance points to other skills for contract negotiation and RFP writing.
How is the vendor score calculated?
The scorer weights five dimensions (reliability, support, security, commercial and strategic fit) differently for each industry profile, producing a 0-100 score. Scores of 75 or above map to KEEP, 50-74 to REVIEW, and below 50 to REPLACE.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits IT directors, vendor managers and compliance staff who need a repeatable, documented way to review vendors before renewals and audits. It is a poor fit for contract negotiation, RFP writing or final legal decisions, and its scores are only as good as the catalog data you feed it.
Download the skill