Vendor Risk Brief

对外部 SaaS/API 形成风险摘要，聚焦集成影响、权限、数据流向和替代方案。；use for vendor-risk, saas, security workflows；do not use for 冒充安全认证结论, 替代正式法务/安全审批.

This skill appears to do what it says: offline, template-driven vendor-risk briefs and local audits using a bundled Python script. Before running: (1) review scripts/run.py yourself (it only uses the stdlib and reads local files), (2) do not point the tool at system/root directories or credential stores (it will scan files you give it), and (3) avoid feeding raw sensitive PII or secrets—sanitize inputs first. If you need network-backed fact-checking or automated changes to external systems, handle those steps outside this skill and with proper approvals.

Type: OpenClaw Skill Name: vendor-risk-brief Version: 1.0.0 The 'vendor-risk-brief' skill is a legitimate tool designed to generate security risk summaries for SaaS/API vendors. The core logic in 'scripts/run.py' is transparent, using only Python standard libraries to process local text, CSV, or directory inputs into structured Markdown reports. Notably, the script includes a 'pattern_report' function that acts as a basic security scanner for risky commands (e.g., curl|bash) and secrets, which aligns with its stated purpose of risk assessment without exhibiting any malicious behaviors like data exfiltration or unauthorized execution.