Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Vendor Risk Monitor Skill · a5c-ai | DecimalAI

a5c-ai/vendor-risk-monitor

NewSkillScoreMaintained

Continuous vendor security monitoring for security ratings, breach notifications, and risk change detection

Securityby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-vendor-risk-monitor/SKILL.md

decimalai skills pull a5c-ai-vendor-risk-monitor --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-vendor-risk-monitor/SKILL.md https://app.decimal.ai/s/a5c-ai-vendor-risk-monitor/SKILL.md

Raw file: /s/a5c-ai-vendor-risk-monitor/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-vendor-risk-monitor.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 7d ago

No — -100% lift+81% tokens0% turns82% of whole cases pass with skill (18/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✓→✗	▼ Worse	60%	0%
case-02	✓→✓	＝ Same ✓	40%	0%
case-03	✓→✓	＝ Same ✓	69%	0%
case-07	✓→✓	＝ Same ✓	83%	0%
case-08	✓→✓	＝ Same ✓	91%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/security-compliance/skills/vendor-risk-monitor/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

Vendor Risk Monitor Skill

Purpose

Provide continuous vendor security monitoring by tracking security ratings, monitoring breach notifications, detecting certificate issues, and alerting on risk changes for proactive third-party risk management.

Capabilities

Security Rating Monitoring

Track vendor security ratings from rating services
Monitor rating changes and trends
Compare ratings against thresholds
Analyze rating factor changes
Generate rating trend reports
Alert on rating downgrades

Breach Notification Tracking

Monitor public breach databases
Track vendor-disclosed incidents
Correlate breaches with vendor inventory
Assess breach impact on data
Generate breach impact reports
Trigger incident response workflows

Certificate Status Checking

Monitor vendor SSL/TLS certificates
Track certificate expiration dates
Detect certificate issues
Verify certificate chain validity
Alert on upcoming expirations
Check certificate transparency logs

Dark Web Monitoring

Monitor dark web for vendor exposures
Detect leaked credentials
Identify data for sale
Track threat actor mentions
Correlate with vendor risk profiles
Generate exposure reports

Risk Change Alerting

Detect significant risk changes
Correlate multiple risk signals
Generate risk change notifications
Escalate critical changes
Update vendor risk profiles
Trigger reassessment workflows

Monitoring Report Generation

Generate continuous monitoring reports
Create executive dashboards
Produce trend analysis
Build risk heat maps
Export data for GRC systems
Support board reporting

Monitoring Sources

| Source Type | Examples | Data Type | |-------------|----------|-----------| | Security Ratings | BitSight, SecurityScorecard | Posture scores | | Breach Databases | HaveIBeenPwned, DataBreaches.net | Incident data | | Certificate Monitors | SSL Labs, crt.sh | Certificate status | | Dark Web | Various feeds | Exposure data | | News/Alerts | Security news feeds | Incident reports | | Regulatory | SEC filings, regulatory actions | Compliance events |

Risk Signals Monitored

Security rating changes
New vulnerability disclosures
Data breach announcements
Certificate issues
Domain security problems
DNS configuration issues
Email security posture
Network security indicators
Patching cadence
Open ports and services

Integrations

BitSight: Security ratings platform
SecurityScorecard: Security ratings and benchmarks
RiskRecon: Third-party risk monitoring
Black Kite: Cyber risk ratings
UpGuard: Third-party risk monitoring
Recorded Future: Threat intelligence

Target Processes

Third-Party Vendor Security Assessment
Continuous Compliance Monitoring
Vendor Risk Management
Supply Chain Security

Input Schema

json
{
  "type": "object",
  "properties": {
    "operation": {
      "type": "string",
      "enum": ["monitor", "check-ratings", "check-breaches", "check-certificates", "generate-report", "configure-alerts"],
      "description": "Monitoring operation type"
    },
    "vendors": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "vendorId": { "type": "string" },
          "vendorName": { "type": "string" },
          "domain": { "type": "string" },
          "riskTier": { "type": "string" }
        }
      },
      "description": "Vendors to monitor"
    },
    "monitoringScope": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["ratings", "breaches", "certificates", "dark-web", "news", "regulatory"]
      }
    },
    "alertThresholds": {
      "type": "object",
      "properties": {
        "ratingDropThreshold": { "type": "number" },
        "minimumRating": { "type": "number" },
        "certificateExpiryDays": { "type": "integer" }
      }
    },
    "reportingPeriod": {
      "type": "object",
      "properties": {
        "startDate": { "type": "string", "format": "date" },
        "endDate": { "type": "string", "format": "date" }
      }
    },
    "notificationChannels": {
      "type": "array",
      "items": { "type": "string" }
    }
  },
  "required": ["operation"]
}

Output Schema

json
{
  "type": "object",
  "properties": {
    "monitoringId": {
      "type": "string"
    },
    "operation": {
      "type": "string"
    },
    "timestamp": {
      "type": "string",
      "format": "date-time"
    },
    "vendorsMonitored": {
      "type": "integer"
    },
    "ratingsSummary": {
      "type": "object",
      "properties": {
        "vendorsWithRatings": { "type": "integer" },
        "averageRating": { "type": "number" },
        "belowThreshold": { "type": "integer" },
        "ratingChanges": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "vendorId": { "type": "string" },
              "previousRating": { "type": "number" },
              "currentRating": { "type": "number" },
              "change": { "type": "number" },
              "changeDate": { "type": "string" }
            }
          }
        }
      }
    },
    "breachAlerts": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "vendorId": { "type": "string" },
          "vendorName": { "type": "string" },
          "breachDate": { "type": "string" },
          "description": { "type": "string" },
          "dataTypes": { "type": "array" },
          "recordsAffected": { "type": "integer" },
          "source": { "type": "string" }
        }
      }
    },
    "certificateAlerts": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "vendorId": { "type": "string" },
          "domain": { "type": "string" },
          "issue": { "type": "string" },
          "expirationDate": { "type": "string" },
          "daysUntilExpiry": { "type": "integer" }
        }
      }
    },
    "darkWebFindings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "vendorId": { "type": "string" },
          "findingType": { "type": "string" },
          "description": { "type": "string" },
          "discoveryDate": { "type": "string" },
          "severity": { "type": "string" }
        }
      }
    },
    "riskChanges": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "vendorId": { "type": "string" },
          "vendorName": { "type": "string" },
          "previousRiskLevel": { "type": "string" },
          "currentRiskLevel": { "type": "string" },
          "triggers": { "type": "array" },
          "recommendedAction": { "type": "string" }
        }
      }
    },
    "alertsSent": {
      "type": "integer"
    },
    "recommendations": {
      "type": "array",
      "items": { "type": "string" }
    },
    "reportPath": {
      "type": "string"
    }
  }
}

Usage Example

javascript
skill: {
  name: 'vendor-risk-monitor',
  context: {
    operation: 'monitor',
    vendors: [
      { vendorId: 'v001', vendorName: 'Cloud Provider', domain: 'cloudprovider.com', riskTier: 'critical' }
    ],
    monitoringScope: ['ratings', 'breaches', 'certificates'],
    alertThresholds: {
      ratingDropThreshold: 10,
      minimumRating: 700,
      certificateExpiryDays: 30
    }
  }
}

Want to see if a5c-ai/vendor-risk-monitor would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 09:45 UTC · 22 cases

Lift

-100%

0% vs 100%

Agent turns

0%

1.0 vs 1.0

Tokens

+81%

4,096.91 vs 2,262.64

pass → pass · 18fail → fail · 3pass → fail · 1

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We need to run a continuous security risk check on our primary cloud service supplier, 'Acme Cloud Services' (domain: acme-cloud.io, vendor ID: v-882, risk tier: critical). Please check ratings, breach feeds, and certificate health. Output the response strictly as a JSON object containing monitoringId, timestamp, vendorsMonitored, ratingsSummary (with ratingChanges), breachAlerts, certificateAlerts, riskChanges, and recommendations.	pass→fail	17,632	16,543	-6%	1	1	0%	2,895	4,619	+60%	0	0	—
case-02 Please run a targeted security evaluation covering dark web findings and SSL/TLS certificates for our logistics software vendor 'Global Freight' (domain: g-freight.com, vendor ID: v-409). Provide the results in JSON format structured with operation, darkWebFindings (including discoveryDate and severity), certificateAlerts (listing issue descriptions and daysUntilExpiry), riskChanges, and alertsSent count.	pass→pass	22,011	18,545	-16%	1	1	0%	2,806	3,916	+40%	0	0	—
case-03 Generate a comprehensive third-party risk report for 'DataVault Systems' (vendorId: v-101) and 'PayCore Solutions' (vendorId: v-102) for the reporting period from 2023-07-01 to 2023-09-30, monitoring ratings, breaches, news, and regulatory signals. Return the result in JSON including monitoringId, vendorsMonitored, ratingsSummary (showing averageRating and belowThreshold), breachAlerts, riskChanges (with previousRiskLevel, currentRiskLevel, and triggers), and reportPath.	pass→pass	17,664	13,186	-25%	1	1	0%	2,844	4,803	+69%	0	0	—
case-04 Perform a static application security testing (SAST) review on our internal Node.js repository 'auth-service' located at GitHub repo internal/auth-service. Scrutinize the codebase for SQL injection, hardcoded JWT secrets, and insecure direct object references. Format your findings as a SAST report detailing file paths and line numbers.	fail→fail	16,973	14,960	-12%	1	1	0%	1,295	3,084	+138%	0	0	—
case-05 Configure iptables and AWS Security Group inbound rules for our internal microservices cluster in VPC vpc-0a1b2c. Block external access on port 22 and restrict port 5432 to the subnet 10.0.1.0/24. Output the configuration commands in bash script format.	fail→fail	12,974	19,178	+48%	1	1	0%	2,891	4,374	+51%	0	0	—
case-06 Draft Section 12 (Indemnification and Limitation of Liability) for our master services agreement with FinTech Corp. Ensure FinTech Corp agrees to indemnify us up to $5,000,000 for third-party IP infringement claims and gross negligence. Provide legal contract text in markdown.	fail→fail	13,089	14,323	+9%	1	1	0%	2,398	3,721	+55%	0	0	—
case-07 Our primary cloud CRM vendor 'SalesEdge' (v-501) had their BitSight security rating drop from 760 to 710 over the past two weeks due to patching delays on external servers. Our procurement manager suggests ignoring this drop because the score is still above 700. Is ignoring a 50-point rating drop compliant with standard vendor security monitoring protocols, or should this trigger an automatic risk review?	pass→pass	18,050	12,585	-30%	1	1	0%	2,220	4,070	+83%	0	0	—
case-08 A key payroll software vendor 'PayRollDirect' is issuing a new 2-year (730-day) SSL/TLS certificate for their API endpoint api.payrolldirect.com. Their IT director claims 2-year TLS certificates are fully compliant with modern browser and CA/Browser Forum standards. Should our automated vendor certificate check approve this 730-day certificate as valid and compliant?	pass→pass	16,661	10,121	-39%	1	1	0%	2,007	3,836	+91%	0	0	—
case-09 During vendor onboarding, 'CloudStorage Inc' provided a SOC 2 Type I report dated last month. Our compliance officer asserts that a SOC 2 Type I report provides sufficient proof that the vendor's security controls operated effectively throughout the entire previous year. Is this assertion accurate for critical third-party risk assessment?	pass→pass	14,433	11,397	-21%	1	1	0%	1,607	3,874	+141%	0	0	—
case-10 A dark web intelligence scan detected a database dump containing active corporate email addresses and plain-text domain administrator passwords for our payment processing vendor 'PayFast'. The vendor's CISO claims this is a Low severity finding because the dump was found on an unindexed dark web forum rather than a public social media site. How should this dark web credential exposure be classified?	pass→pass	12,817	20,136	+57%	1	1	0%	2,126	4,507	+112%	0	0	—
case-11 A HaveIBeenPwned breach check revealed that vendor 'DataAnalytics Corp' suffered a data breach exposing 100,000 user records containing credit card numbers, CVVs, and hashed passwords. The vendor claims this breach has Minimal impact because customer names were excluded from the exposed dataset. Does this data breach represent a critical third-party risk?	pass→pass	11,874	17,600	+48%	1	1	0%	2,008	4,068	+103%	0	0	—
case-12 An automated transport security scan of vendor 'LogisticsNet' shows their primary gateway supports TLS 1.0, TLS 1.1, and TLS 1.2. The vendor argues that maintaining TLS 1.0 support is recommended best practice to ensure maximum backward compatibility. Should our third-party risk evaluation pass TLS 1.0 support as secure?	pass→pass	17,111	10,491	-39%	1	1	0%	2,110	3,904	+85%	0	0	—
case-13 Vendor 'HRCloud Services' hosts sensitive employee PII (SSNs, bank details) and has direct single sign-on integration with our active directory, but they only have 15 employees. Our procurement team suggests assigning them a Low Risk tier due to their small company headcount. Under NIST SP 800-161 supply chain risk management, is company headcount the primary factor for risk tiering?	pass→pass	17,808	15,897	-11%	1	1	0%	2,212	3,779	+71%	0	0	—
case-14 Our security team currently conducts vendor risk management solely by sending an annual 200-question spreadsheet questionnaire to critical SaaS suppliers. The vendor management team proposes eliminating continuous automated monitoring (rating feeds, breach monitoring, cert checks) to save budget. Is relying exclusively on annual static questionnaires considered adequate for critical tier vendors?	pass→pass	20,869	20,418	-2%	1	1	0%	2,481	4,440	+79%	0	0	—
case-15 A brand protection scan identified five newly registered domain names (e.g., acme-c1oud.com, acmecloud-support.net) imitating our primary cloud vendor 'AcmeCloud'. The vendor claims that lookalike domain registrations by unknown external parties do not pose any third-party risk to our organization. How should these lookalike domains be evaluated in vendor risk management?	pass→pass	21,774	22,971	+5%	1	1	0%	2,738	5,039	+84%	0	0	—
case-16 We are terminating our contract with cloud backup vendor 'VaultData'. The vendor management team suggests that simply disabling our user login accounts on the vendor's portal is sufficient to complete technical offboarding. Does disabling portal accounts meet standard vendor offboarding and data destruction requirements?	pass→pass	17,322	18,693	+8%	1	1	0%	2,063	4,111	+99%	0	0	—
case-17 Our critical vendor 'DocuSigner' delegates core cryptographic signing operations to a third-party cloud hosting provider 'SubCloud'. Our risk analyst claims we do not need to evaluate SubCloud's security posture because our contract is strictly with DocuSigner. Does fourth-party sub-processor risk need to be assessed under third-party risk frameworks?	pass→pass	19,054	14,354	-25%	1	1	0%	2,358	4,545	+93%	0	0	—
case-18 A vulnerability check on vendor 'DevOpsHub' flagged an unpatched Remote Code Execution (RCE) flaw with a CVSS v3.1 base score of 9.8 on their public API gateway. The vendor's support team classified this flaw as Medium severity because no active exploit has been published yet. Is classifying a CVSS 9.8 flaw as Medium severity consistent with CVSS v3.1 standards?	pass→pass	18,848	13,790	-27%	1	1	0%	2,425	4,366	+80%	0	0	—
case-19 Vendor 'FinTechAPI' added a security.txt file (RFC 9116) to their web server root. Their VP of Engineering claims that publishing security.txt guarantees the vendor's infrastructure is free of unpatched vulnerabilities. Does having a valid security.txt file confirm zero vulnerability exposure?	pass→pass	15,212	13,881	-9%	1	1	0%	1,760	3,493	+98%	0	0	—
case-20 Our automated monitoring system flagged an SSL certificate for vendor 'PayGate' expiring in 10 days. The vendor's lead engineer asked to suppress all certificate alerts until 24 hours before expiration, claiming 1 day notice is sufficient lead time for enterprise TLS certificate renewals. What is the standard alert lead time for vendor TLS certificate renewals?	pass→pass	17,766	14,509	-18%	1	1	0%	1,958	3,440	+76%	0	0	—
case-21 Vendor 'HealthData' stores customer electronic health records (ePHI) in an AWS S3 bucket. They claim that relying solely on physical data center security provided by AWS fulfills data encryption requirements without enabling S3 server-side encryption or KMS key management. Does physical security satisfy regulatory data encryption at rest requirements?	pass→pass	20,662	18,100	-12%	1	1	0%	2,675	4,216	+58%	0	0	—
case-22 Vendor 'NetAdmin' provides managed IT infrastructure services with direct administrative access to our internal network. They request an exemption from mandatory Multi-Factor Authentication (MFA) for their remote engineers to speed up emergency incident response. Should a third-party risk assessment allow MFA exemptions for vendor remote administrative access?	pass→pass	12,406	12,301	-1%	1	1	0%	1,901	3,927	+107%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of -100 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 100%
Pass rate with the skill: 0%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/30/2026, 09:45 UTC

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+85% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested 6 days ago

Other measured skills in the registry, with their headline benchmark lift.