Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Vendor Security Questionnaire Skill · a5c-ai | DecimalAI

a5c-ai/vendor-security-questionnaire

SkillScore86Maintained

Automated vendor security assessment through questionnaire generation, response parsing, and risk scoring

Securityby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-vendor-security-questionnaire/SKILL.md

decimalai skills pull a5c-ai-vendor-security-questionnaire --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-vendor-security-questionnaire/SKILL.md https://app.decimal.ai/s/a5c-ai-vendor-security-questionnaire/SKILL.md

Raw file: /s/a5c-ai-vendor-security-questionnaire/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-vendor-security-questionnaire.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 7d ago

—+74% tokens0% turns86% of whole cases pass with skill (19/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	-5%	0%
case-02	✗→✓	▲ Improved	541%	0%
case-03	✗→✓	▲ Improved	102%	0%
case-07	✗→✓	▲ Improved	62%	0%
case-08	✗→✓	▲ Improved	167%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/security-compliance/skills/vendor-security-questionnaire/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

Vendor Security Questionnaire Skill

Purpose

Automate vendor security assessment through standardized questionnaire generation, response parsing, security posture scoring, and risk report generation for third-party risk management programs.

Capabilities

Questionnaire Generation

Generate industry-standard security questionnaires
Create SIG (Standardized Information Gathering) questionnaires
Build CAIQ (Consensus Assessment Initiative Questionnaire) forms
Generate custom questionnaires based on risk tier
Create vendor-type-specific assessments
Support multiple response formats

Response Parsing and Analysis

Parse questionnaire responses from various formats
Extract key security control information
Identify missing or incomplete responses
Flag concerning answers for review
Compare responses against requirements
Validate evidence attachments

Security Posture Scoring

Calculate vendor security scores
Weight scores by control importance
Compare against industry benchmarks
Track score trends over time
Generate risk-adjusted ratings
Identify score improvement areas

Assessment Status Tracking

Track assessment workflow status
Monitor response deadlines
Send automated reminders
Escalate overdue assessments
Maintain assessment history
Archive completed assessments

Risk Report Generation

Generate executive risk summaries
Create detailed technical reports
Produce comparison reports
Build risk heat maps
Generate board-level dashboards
Export data for GRC systems

Vendor Compliance Monitoring

Track vendor compliance commitments
Monitor remediation progress
Verify evidence of compliance
Alert on compliance drift
Schedule periodic reassessments
Maintain compliance documentation

Questionnaire Standards

| Standard | Use Case | Questions | |----------|----------|-----------| | SIG Lite | Low-risk vendors | ~100 | | SIG Core | Medium-risk vendors | ~300 | | SIG Full | High-risk vendors | ~800+ | | CAIQ | Cloud providers | ~300 | | VSAQ | General vendors | Variable | | Custom | Specific needs | Variable |

Assessment Domains

Information Security Management
Access Control
Data Protection
Network Security
Application Security
Physical Security
Business Continuity
Incident Response
Compliance and Legal
Third-Party Management

Integrations

OneTrust: Third-party risk management
ProcessUnity: Vendor risk management
SecurityScorecard: Security ratings
BitSight: Security ratings and benchmarks
Prevalent: Third-party risk intelligence
Shared Assessments: SIG questionnaire tools

Target Processes

Third-Party Vendor Security Assessment
Vendor Onboarding Security Review
Annual Vendor Reassessment
Vendor Risk Management

Input Schema

json
{
  "type": "object",
  "properties": {
    "operation": {
      "type": "string",
      "enum": ["generate", "parse", "score", "report", "track"],
      "description": "Questionnaire operation type"
    },
    "vendorInfo": {
      "type": "object",
      "properties": {
        "vendorName": { "type": "string" },
        "vendorId": { "type": "string" },
        "vendorType": { "type": "string" },
        "riskTier": { "type": "string", "enum": ["critical", "high", "medium", "low"] },
        "dataAccess": { "type": "array", "items": { "type": "string" } }
      }
    },
    "questionnaireType": {
      "type": "string",
      "enum": ["SIG-Lite", "SIG-Core", "SIG-Full", "CAIQ", "VSAQ", "custom"],
      "description": "Questionnaire standard to use"
    },
    "customDomains": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Specific domains to assess"
    },
    "responseFile": {
      "type": "string",
      "description": "Path to questionnaire response file"
    },
    "scoringCriteria": {
      "type": "object",
      "properties": {
        "minimumScore": { "type": "number" },
        "criticalControls": { "type": "array" },
        "weightings": { "type": "object" }
      }
    },
    "deadline": {
      "type": "string",
      "format": "date",
      "description": "Assessment completion deadline"
    }
  },
  "required": ["operation"]
}

Output Schema

json
{
  "type": "object",
  "properties": {
    "assessmentId": {
      "type": "string"
    },
    "operation": {
      "type": "string"
    },
    "timestamp": {
      "type": "string",
      "format": "date-time"
    },
    "vendorInfo": {
      "type": "object"
    },
    "questionnaire": {
      "type": "object",
      "properties": {
        "type": { "type": "string" },
        "totalQuestions": { "type": "integer" },
        "domains": { "type": "array" },
        "filePath": { "type": "string" }
      }
    },
    "responseAnalysis": {
      "type": "object",
      "properties": {
        "questionsAnswered": { "type": "integer" },
        "questionsSkipped": { "type": "integer" },
        "evidenceProvided": { "type": "integer" },
        "concerningResponses": { "type": "array" },
        "missingInformation": { "type": "array" }
      }
    },
    "securityScore": {
      "type": "object",
      "properties": {
        "overallScore": { "type": "number" },
        "riskRating": { "type": "string", "enum": ["low", "medium", "high", "critical"] },
        "domainScores": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "domain": { "type": "string" },
              "score": { "type": "number" },
              "findings": { "type": "array" }
            }
          }
        },
        "benchmarkComparison": { "type": "object" },
        "scoreHistory": { "type": "array" }
      }
    },
    "riskFindings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "findingId": { "type": "string" },
          "domain": { "type": "string" },
          "severity": { "type": "string" },
          "description": { "type": "string" },
          "recommendation": { "type": "string" }
        }
      }
    },
    "assessmentStatus": {
      "type": "object",
      "properties": {
        "status": { "type": "string" },
        "deadline": { "type": "string" },
        "daysRemaining": { "type": "integer" },
        "remindersent": { "type": "boolean" }
      }
    },
    "recommendations": {
      "type": "array",
      "items": { "type": "string" }
    },
    "reportPath": {
      "type": "string"
    }
  }
}

Usage Example

javascript
skill: {
  name: 'vendor-security-questionnaire',
  context: {
    operation: 'generate',
    vendorInfo: {
      vendorName: 'Cloud SaaS Provider',
      riskTier: 'high',
      dataAccess: ['PII', 'financial']
    },
    questionnaireType: 'SIG-Core',
    deadline: '2024-03-15'
  }
}

Want to see if a5c-ai/vendor-security-questionnaire would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 09:32 UTC · 22 cases

Measured on 20 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+55%

86% vs 32%

Agent turns

0%

1.0 vs 1.0

Tokens

+74%

2,811.1 vs 1,614.55

fail → pass · 12pass → pass · 7fail → fail · 3

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We are onboarding a new cloud database vendor, DataVault Systems, which will handle customer PII and operational logs under a high risk classification. Please generate a SIG-Core security questionnaire for them with a response deadline of 2025-04-30. Provide a structured result that includes the assessmentId, timestamp, vendor profile details, evaluated domain list, question count, and output file path.	fail→pass	18,878	13,377	-29%	1	1	0%	3,643	3,479	-5%	0	0	—
case-02 Please analyze the completed vendor survey file at '/assessments/2025/fintech_solutions_caiq.json' for Fintech Solutions Inc. Evaluate their responses, surface any unanswered items or flagged issues lacking evidence, calculate domain scores, and output a JSON result containing the overall securityScore, responseAnalysis details, identified risk findings with severity ratings, and actionable recommendations.	fail→pass	13,727	24,677	+80%	1	1	0%	893	5,723	+541%	0	0	—
case-03 Perform a status tracking and risk report workflow for our annual security evaluation of LogiChain Logistics (vendor ID VEND-8821, risk tier medium) with a target date of 2025-05-15. Deliver an output object containing the assessmentStatus, days remaining until due, reminder delivery state, benchmark comparison, overall risk score, and saved report path.	fail→pass	21,656	19,171	-11%	1	1	0%	2,410	4,867	+102%	0	0	—
case-04 Draft a legal Data Protection Addendum (DPA) clause for our Master Services Agreement with a cloud analytics vendor, covering GDPR liability limits, breach notification timelines, and EU standard contractual clauses.	fail→fail	19,381	15,087	-22%	1	1	0%	3,399	4,479	+32%	0	0	—
case-05 Generate an AWS IAM trust policy JSON to grant our third-party monitoring vendor's AWS account access to our CloudWatch metrics via cross-account role assumption.	fail→fail	6,797	12,661	+86%	1	1	0%	1,325	3,208	+142%	0	0	—
case-06 Execute an automated OWASP ZAP dynamic application security test scan against vendor API endpoint https://api.vendor-analytics.io/v1/health and output the vulnerability scan result.	fail→fail	10,984	13,717	+25%	1	1	0%	429	2,597	+505%	0	0	—
case-07 We are evaluating a low-risk vendor, OfficeSnacks Co., who delivers pantry supplies without system access. We want a brief questionnaire standard. Our team thinks a SIG Lite questionnaire contains under 50 questions; specify the correct standard question volume for SIG Lite.	fail→pass	15,186	5,476	-64%	1	1	0%	1,744	2,820	+62%	0	0	—
case-08 We are conducting an in-depth security evaluation for a high-risk financial processing partner. Our compliance lead assumes a SIG Full questionnaire contains around 300 questions. Specify the correct standard question volume for SIG Full.	fail→pass	22,753	6,535	-71%	1	1	0%	1,050	2,800	+167%	0	0	—
case-09 We need to assess a SaaS infrastructure provider hosting our microservices. A team member suggested using VSAQ, but we prefer the consensus standard specifically designed for cloud service providers. Which questionnaire standard should be selected?	pass→pass	5,988	9,932	+66%	1	1	0%	984	2,713	+176%	0	0	—
case-10 We are preparing a custom questionnaire request for vendor Acme HR Solutions (risk tier high). We only want to evaluate Access Control and Data Protection. Construct an input JSON payload where operation is generate and custom domains are specified.	fail→pass	4,065	3,749	-8%	1	1	0%	824	2,581	+213%	0	0	—
case-11 An automated TPRM script sends an input payload with the operation property set to 'evaluate_vendor'. Validate this operation against standard schema enums.	fail→pass	15,324	5,306	-65%	1	1	0%	2,116	2,766	+31%	0	0	—
case-12 Construct an input JSON payload for vendor SecureStorage Inc with a risk level classified as 'extreme'. Is 'extreme' an allowed value in the vendor riskTier schema enum?	pass→pass	10,795	9,907	-8%	1	1	0%	1,562	2,768	+77%	0	0	—
case-13 When returning parsed questionnaire responses for vendor CloudScale Inc, what exact field name inside responseAnalysis stores unanswered or incomplete items?	fail→pass	12,605	3,371	-73%	1	1	0%	2,146	2,428	+13%	0	0	—
case-14 Calculate the security score object for vendor FinData LLC whose overall score calculated to 85 out of 100, which qualifies as low risk. What value should be populated in securityScore.riskRating?	pass→pass	8,669	8,637	-0%	1	1	0%	641	2,569	+301%	0	0	—
case-15 Format the domainScores array inside securityScore when returning evaluations across Network Security and Incident Response domains for vendor NetShield Tech.	fail→pass	11,881	11,005	-7%	1	1	0%	1,411	2,961	+110%	0	0	—
case-16 Construct a risk finding item in riskFindings for vendor DataSync Corp regarding unencrypted database backups. What key provides the remediation advice?	pass→pass	10,297	8,806	-14%	1	1	0%	986	2,472	+151%	0	0	—
case-17 In an assessment tracking object for vendor LogiCorp, what property name inside assessmentStatus indicates whether an automated reminder notice was sent?	fail→pass	13,105	1,856	-86%	1	1	0%	1,428	2,100	+47%	0	0	—
case-18 Define the scoringCriteria object in an input JSON payload when configuring an assessment with a minimum passing threshold of 75.	fail→pass	7,748	9,832	+27%	1	1	0%	1,452	2,743	+89%	0	0	—
case-19 Our vendor risk management program incorporates external security rating benchmarks. Name a supported integration platform for third-party security ratings.	pass→pass	8,800	7,973	-9%	1	1	0%	635	2,075	+227%	0	0	—
case-20 During vendor security evaluations, is Business Continuity listed as a standard assessment domain?	pass→pass	14,117	7,248	-49%	1	1	0%	1,527	2,153	+41%	0	0	—
case-21 When an assessment report is compiled and saved to disk at '/reports/2025/vendor_eval_99.pdf', what top-level output schema property holds this path?	fail→pass	14,658	7,152	-51%	1	1	0%	1,691	2,242	+33%	0	0	—
case-22 Which questionnaire standard is specified for general vendor assessments with variable question lengths when SIG or CAIQ standard forms are not required?	pass→pass	16,866	7,441	-56%	1	1	0%	1,938	2,201	+14%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 20 counted toward the lift figure. The other 2 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +55 percentage points is the difference between those two pass rates over the 20 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 31.8%
Pass rate with the skill: 86.4%
Cases attempted: 22
Cases counted toward lift: 20
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 09:32 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

We are onboarding a new cloud database vendor, DataVault Systems, which will handle customer PII and operational logs under a high risk classification. Please generate a SIG-Core security questionnaire for them with a response deadline of 2025-04-30. Provide a structured result that includes the assessmentId, timestamp, vendor profile details, evaluated domain list, question count, and output file path.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run86

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+105% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 6 days ago

Other measured skills in the registry, with their headline benchmark lift.