Vendor Risk Brief
v1.0.0对外部 SaaS/API 形成风险摘要，聚焦集成影响、权限、数据流向和替代方案。；use for vendor-risk, saas, security workflows；do not use for 冒充安全认证结论, 替代正式法务/安全审批.
⭐ 0· 74·0 current·0 all-time
byvx：17605205782@52yuanchangxing
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the included assets: a template, spec, examples, and a Python script that generates structured vendor-risk briefs and local audits. Requiring python3 is proportionate; no unrelated binaries, env vars, or cloud credentials are requested.
Instruction Scope
Runtime instructions confine work to user-provided inputs, local spec/template, and an included script. The bundled script can read files, scan directories, and parse CSVs; this is expected for audit functionality but means whoever runs it must avoid pointing it at sensitive system directories or credential stores. The SKILL.md explicitly advises read-only, review-first behavior.
Install Mechanism
No install spec—instruction-only skill with a bundled Python script. There are no downloads, package managers, or extract steps. Risk from installation is minimal.
Credentials
The skill requests no environment variables or credentials (primaryEnv none). Its functionality operates on local files and templates; no secret exfiltration or unrelated credential access is requested or present in the code.
Persistence & Privilege
always=false and user-invocable; the skill does not modify other skills or system-wide settings. It may write an output file if told to, which is expected behavior for a report generator.
Assessment
This skill appears to do what it says: offline, template-driven vendor-risk briefs and local audits using a bundled Python script. Before running: (1) review scripts/run.py yourself (it only uses the stdlib and reads local files), (2) do not point the tool at system/root directories or credential stores (it will scan files you give it), and (3) avoid feeding raw sensitive PII or secrets—sanitize inputs first. If you need network-backed fact-checking or automated changes to external systems, handle those steps outside this skill and with proper approvals.Like a lobster shell, security has layers — review code before you run it.
latestvk97e32wqyt801rwwhx7t221ws183e0nz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🏢 Clawdis
OSmacOS · Linux · Windows
Binspython3