supplier-risk-scoring

Generates a 0-100 Supplier Risk Index score across financial, dependency, compliance, performance, and geographic risks with tiered action plans.

This skill is a reusable rubric — it doesn't install code or ask for credentials — but it expects you (or the agent) to gather potentially sensitive vendor data from third parties or to upload vendor financial/legal documents. Before using it: (1) Confirm how you will supply data (manual input vs. agent web access vs. paid API) and whether you need to provide any API keys or paid reports; (2) Do not paste confidential vendor contracts, bank account details, or personally identifying customer data into an agent unless you are comfortable with where that data will be stored or transmitted; (3) If you want automated lookups (D&B, Experian, SEC), plan for legitimate API access and validate licensing; (4) Consider organizational privacy/compliance policies for sharing vendor financials and legal histories; (5) If you allow autonomous agent invocation, supervise first runs to ensure the agent requests and handles only the data you intend it to collect. I have moderate confidence because the provided SKILL.md appears coherent, but I could not review the file beyond what was supplied — if the full SKILL.md contains hidden instructions to access local files, environment variables, or to call arbitrary external endpoints, reassess and share those sections for a more confident evaluation.

Type: OpenClaw Skill Name: supplier-risk-scoring Version: 1.0.0 The skill bundle provides a detailed framework for supplier risk scoring, including assessment criteria, scoring rubrics, and recommended actions. All content in `_meta.json` and `SKILL.md` is descriptive and instructional, aligning perfectly with the stated purpose of risk management. There are no instructions for the AI agent to perform unauthorized actions, exfiltrate data, install backdoors, or engage in any other malicious behavior. The suggested 'Google News search' in `SKILL.md` is a descriptive data source for a legitimate purpose, not an imperative command for malicious prompt injection.