Vendor Security Review
Review vendor security questionnaires, procurement security notes, SOC2 summaries, DPA excerpts, subprocessor lists, security answer drafts, or risk-review packets for missing coverage, weak evidence, follow-up questions, and human-review risks. Use when Codex needs to prepare a vendor security review without making legal, compliance, or approval decisions.
Install
$ agentstack add skill-clarentcinematics-codex-skills-for-enterprise-vendor-security-review ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Vendor Security Review
Workflow
- Identify vendor, product, data involved, intended use, review stage, and source documents.
- Check coverage for security, privacy, data handling, access control, auditability, and contractual evidence.
- Separate supplied evidence from vendor claims, assumptions, missing answers, and review questions.
- Flag gaps, weak answers, risks, and required human review.
- Produce a concise review packet for security, legal, procurement, or business owners.
Script-Assisted Workflow
When given a questionnaire or answer draft, run scripts/check_vendor_security_answers.py --input first. Use --json for structured coverage output. The helper detects missing topic coverage and weak answers; it does not approve vendors or provide legal/security certification.
Output Standard
Use this structure by default:
- Review Summary: vendor, product, intended use, data sensitivity, and readiness.
- Coverage Check: SOC2, DPA, subprocessors, retention, breach notification, encryption, SSO, and audit logs.
- Evidence Gaps: missing or weak answers with source excerpts.
- Risk Questions: security, privacy, legal, procurement, and business-owner follow-ups.
- Recommended Next Steps: review actions and owners when stated.
- Human Review Required: approvals, exceptions, legal terms, or risk acceptance.
- Caveats: non-inferred approvals and source limitations.
Rules
- Do not approve vendors, accept risk, provide legal advice, or certify compliance.
- Do not invent SOC2 status, DPA terms, subprocessors, encryption controls, SSO support, or breach-notification terms.
- Mark missing answers as missing, not failed, unless the source explicitly says a control is absent.
- Treat customer, employee, health, financial, or regulated data as requiring human review.
References
Read references/vendor-security-rubric.md when preparing security, privacy, procurement, or legal follow-up questions.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: ClarentCinematics
- Source: ClarentCinematics/Codex-Skills-for-Enterprise
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.