Vendor Risk Assessment

Assess third-party vendor risk for AI and SaaS products. Evaluates security posture, data handling, compliance, financial stability, and operational resilien...

This skill appears coherent and limited to vendor research/reporting. Before installing or using it, consider: (1) Do not paste or upload confidential vendor contracts, credentials, or screenshots containing secrets into the agent — only provide non-sensitive vendor metadata. (2) The agent will perform open-ended web research (public sites, Crunchbase/LinkedIn, status pages), so confirm you are comfortable with public-source queries. (3) Verify any critical findings by obtaining vendor-supplied artifacts (e.g., SOC2 report) directly rather than relying solely on automated summaries. (4) If you need the agent to fetch private documents, require explicit controls (scoped, temporary credentials) and audit logging. Overall this skill is internally consistent with its purpose, but treat outputs as advisory and validate high-impact decisions with primary evidence.

Type: OpenClaw Skill Name: vendor-risk-assessment Version: 1.0.0 The skill instructs the AI agent to perform extensive web research and access external websites (e.g., vendor websites, Crunchbase, LinkedIn, status pages) based on user-provided input, as detailed in the 'Research Process' section of `SKILL.md`. While the stated purpose is benign (vendor risk assessment), this direct interaction with untrusted external data and user-supplied URLs creates a significant vulnerability for prompt injection or other forms of exploitation against the AI agent's underlying capabilities. There is no explicit malicious intent found, but the inherent risk of uncontrolled external interaction warrants a 'suspicious' classification.