vendor-onboarding-workflow

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:13 PM UTC
• Version:
  1.0.0

Overview

This is a plain workflow checklist for vendor onboarding, but it handles sensitive vendor documents that should be kept in secure business systems.

Install only if you want a vendor onboarding checklist. Treat it as process guidance, not permission for an agent to freely handle vendor records. Store W-9s, W-8BENs, tax IDs, ACH details, insurance documents, contracts, and approval packets in approved secure systems, limit access to people who need it, avoid pasting full sensitive documents into chat, and require human approval before granting vendor system access or marking a vendor active.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs users to collect and track sensitive vendor data including EIN/Tax ID, business address, contact details, and litigation disclosures, but does not provide any privacy, retention, access-control, or secure-storage guidance. In a vendor onboarding context, this omission increases the risk of unnecessary exposure of regulated or sensitive business information through spreadsheets, forms, email, or shared drives.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The workflow requests transmission, review, and filing of sensitive compliance and financial documents such as W-9/W-8BEN, COI, NDA, licenses, and related records, yet only briefly warns against emailing ACH data while leaving other document handling unsecured. Because the process explicitly suggests email and shared drives, users may transmit high-value documents through insecure channels or store them in broadly accessible locations.

VirusTotal

66/66 vendors flagged this skill as clean.