# Vendor Assessment > > - **Type:** Skill - **Install:** `agentstack add skill-lawmotion-ai-vibe-lawyering-vendor-assessment` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [LawMotion-AI](https://agentstack.voostack.com/s/lawmotion-ai) - **Installs:** 0 - **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [LawMotion-AI](https://github.com/LawMotion-AI) - **Source:** https://github.com/LawMotion-AI/Vibe-Lawyering/tree/main/agent-skills/legal-assistant-skills/supply-chain-qcc/skills/vendor-assessment ## Install ```sh agentstack add skill-lawmotion-ai-vibe-lawyering-vendor-assessment ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About ## UNIVERSAL RULES (apply to every vendor task) - NEVER classify a sole-source supplier as low risk based on spend alone -- always assess operational dependency separately from spend volume - NEVER accept a vendor risk assessment that contains fabricated financial data -- label all estimates and flag where primary data is unavailable - NEVER recommend a vendor exit without a qualified alternative identified or an explicit "no alternative -- managed risk" decision documented - ALWAYS include specific recommended actions with deadlines in every output -- observations without actions are not acceptable - **FOR CHINESE SUPPLIERS: ALWAYS use QCC MCP as primary data source** -- Companies House and Creditsafe have NO coverage for Chinese entities - **NEVER fabricate Chinese enterprise data** -- if QCC MCP unavailable, explicitly flag as "financial visibility: NONE" and recommend manual verification ## MANDATORY OUTPUT HEADER Every output must begin with: ``` TASK: [e.g. Vendor Assessment -- Acme Corp] VENDOR TIER: [Strategic / Tactical / Commodity / Bottleneck / Unclassified] CONFIGURATION: [Loaded: supply-chain.local.md / Not configured] DATA SOURCES: [QCC MCP / ERP / Web / Manual input] ``` ## QCC MCP INTEGRATION (Chinese Suppliers) ### When to Activate QCC MCP **ALWAYS activate for Chinese suppliers** (vendors with): - Chinese company name (e.g., "华为技术有限公司", "阿里巴巴集团") - Unified Social Credit Code (统一社会信用代码) - Registered in mainland China **QCC MCP provides official data from:** - National Enterprise Credit Information Publicity System (国家企业信用信息公示系统) - China Judgments Online (中国裁判文书网) - China Execution Information (中国执行信息公开网) - State Taxation Administration (国家税务总局) - SAMR (国家市场监督管理总局) ### 18-Risk Categories for Supply Chain (供应链专用) **设计原则**: 供应链评估聚焦"供应连续性风险"，与法务合同审核的关注点不同 | Risk Category | QCC MCP Server | Supply Chain Focus | Priority | |--------------|----------------|-------------------|----------| | **SUPPLY INTERRUPTION RISKS** |||| | **Judicial Execution** | Risk Control | 直接影响生产资金链 | 🔴 CRITICAL | | - Dishonest (失信) | | 信用崩溃，履约能力丧失 | | | - Executed person (被执行人) | | 现金流危机，影响原材料采购 | | | - Limit high consumption (限高) | | 法人受限，商务活动受阻 | | | - Final case (终本案件) | | 历史债务累积，财务恶化 | | | - Judicial auction (司法拍卖) | | 核心资产被拍卖，产能受损 | | | **Bankruptcy Liquidation** | Risk Control | 供应关系终止 | 🔴 CRITICAL | | - Bankruptcy reorganization (破产重整) | | 需立即切换供应商 | | | **OPERATIONAL CONTINUITY RISKS** |||| | **Operational Abnormal** | Enterprise Base | 经营稳定性 | 🔴 HIGH | | - Abnormal operation (经营异常) | | 工商监管介入，经营不稳定 | | | - Serious violation (严重违法) | | 可能被吊销执照，供应中断 | | | - Cancellation filing (注销备案) | | 主动终止经营，供应中断 | | | **Environmental Penalty** | Risk Control | 可能导致停产 | 🟡 MEDIUM | | - Environmental penalty (环保处罚) | | 责令停产整改，影响交付 | | | **FINANCIAL HEALTH RISKS** |||| | **Property Restricted** | Enterprise Base | 财务稳定性指标 | 🟡 MEDIUM | | - Equity freeze (股权冻结) | | 股东纠纷，控制权不稳定 | | | - Equity pledge (股权出质) | | 融资压力，流动性风险 | | | - Chattel mortgage (动产抵押) | | 设备抵押，影响产能扩张 | | | **Tax Violation** | Risk Control | 现金流与合规 | 🟡 MEDIUM | | - Tax arrears (欠税公告) | | 现金流危机，可能拖欠货款 | | | - Abnormal tax (非正常户) | | 税务合规严重问题 | | | **Administrative Penalty** | Risk Control | 行业合规 | 🔵 LOW | | - Administrative penalty (行政处罚) | | 一般合规问题 | | ### Supply Chain Specific Dimensions (供应链特有维度) Beyond the 18 core risks, supply chain assessment MUST evaluate: #### DIMENSION 7: CAPACITY & QUALIFICATION (产能与资质) **QCC MCP Server: Operation + Company** - **Business Qualifications** (资质证书): - Industry-specific licenses (生产许可证、经营许可证) - Quality certifications (ISO 9001, IATF 16949, etc.) - Sector permits (医疗器械、食品生产、危险品等) - Flags: RED - Required license expired or not held - **Administrative Licenses** (行政许可): - Current validity of operating permits - Renewal status and timeline - Flags: AMBER - License expiring within 90 days - **Bidding Activity** (招投标活跃度): - Recent bidding participation (indicator of business health) - Win/loss ratio trends - Flags: AMBER - Significant decline in bidding activity (>50% YoY) #### DIMENSION 8: ORGANIZATIONAL STABILITY (组织稳定性) **QCC MCP Server: Company** - **Shareholder Structure** (股权结构): - Major shareholder changes (indicator of control instability) - State-owned vs. private (policy risk assessment) - Flags: RED - Major shareholder change within 6 months - **Change Records** (变更记录): - Frequent legal representative changes - Registered address changes (relocation risk) - Business scope changes (strategy shift) - Flags: AMBER - >3 material changes within 12 months - **Branch Network** (分支机构): - Geographic distribution of production facilities - Single-site vs. multi-site (business continuity) - Flags: AMBER - Single production site with no backup #### DIMENSION 9: BUSINESS HEALTH (业务健康度) **QCC MCP Server: Operation** - **Official Credit Rating** (官方信用评价): - Government credit ratings (A级、B级等) - Tax credit rating (A级纳税人) - Flags: RED - Rating below B级 - **Spot Check Records** (抽查检查记录): - Regulatory inspection results - Product quality spot checks - Flags: RED - Failed inspection with corrective action pending - **News Sentiment** (新闻舆情): - Negative news coverage (supply chain disruptions, labor issues) - Industry-specific concerns - Flags: AMBER - Negative sentiment spike (>3 negative articles in 30 days) ## ASSESSMENT WORKFLOW ### Phase 1: Vendor Classification (Kraljic Matrix) Before any assessment, classify the vendor: | Question | Strategic | Tactical | Commodity | Bottleneck | | --------------------------- | ------------- | ----------- | ------------- | ------------- | | Are alternatives available? | No / very few | Yes -- 2-3 | Many | No / very few | | Annual spend? | High | Medium | Any | Low-Medium | | Impact if vendor fails? | Critical | Significant | Manageable | Critical | | Relationship depth? | Deep / long | Established | Transactional | Variable | **STRATEGIC (Tier 1):** High spend AND high dependency. Single-source or near-sole-source. Review: quarterly + event-triggered. **TACTICAL (Tier 2):** Significant spend. Multiple alternatives available. Review: bi-annual + event-triggered. **COMMODITY (Tier 3):** Standard goods/services. Easy to switch. Review: annual. **BOTTLENECK (Tier 4):** LOW spend but HIGH dependency. MOST DANGEROUS -- most often neglected. Review: quarterly despite low spend. **CLASSIFICATION RULE:** When assessing a vendor with low spend but sole-source dependency, ALWAYS classify as BOTTLENECK and flag as high-risk regardless of spend volume. ### Phase 2: Six-Dimension Assessment #### DIMENSION 1: COMMERCIAL Contract status: - Active contract: Yes/No; expiry date; auto-renewal clause? - Notice period for non-renewal: documented? - Pricing model: fixed / index-linked / open book / variable - Payment terms: standard for sector/market? - Volume commitments: minimum order quantities; penalty clauses? - IP ownership: critical for manufactured-to-spec components **Flags:** - RED: No contract for spend > configured threshold - RED: Auto-renewal without documented notice window reminder - AMBER: Fixed price contract on commodity category (index exposure) - AMBER: Volume commitment with penalty below minimum forecast volume #### DIMENSION 2: OPERATIONAL Metrics from ERP (last 12 months): - On-time delivery rate (OTD): calculate from GR dates vs. PO delivery dates - Average lead time and variance (consistency matters as much as average) - Quality rejection rate (from QMS or goods inward records) - Capacity: can they scale with our growth? (ask directly) - Business continuity: single site or multiple? **For Chinese suppliers:** Check operational risk signals via QCC MCP: - Abnormal operation status (经营异常) - Administrative penalties (行政处罚) - Environmental penalties (环保处罚) **Flags:** - RED: OTD configured threshold (e.g. >2% for direct materials) - RED: Abnormal operation status detected (QCC MCP) - AMBER: OTD declining trend (even if above threshold -- trajectory matters) - AMBER: Single production site with no documented BCP #### DIMENSION 3: FINANCIAL **For Chinese suppliers (QCC MCP):** - **Property Restrictions** (RED FLAGS): - Equity freeze (股权冻结): Indicates judicial disputes - Equity pledge (股权出质): Financing pressure signal - Chattel mortgage (动产抵押): Working capital pressure - **Tax Status** (RED FLAGS): - Tax arrears announcements (欠税公告) - Abnormal tax status (税务非正常户) - Tax violations (税收违法) - **Bankruptcy/Liquidation** (RED FLAGS): - Bankruptcy reorganization proceedings (破产重整) - Liquidation information (清算信息) - **Financial Data Availability:** - Non-listed companies: Limited financial visibility - For Strategic/Bottleneck vendors: Request audited financial statements annually **Financial Risk Assessment (QCC MCP Enhanced):** | Indicator | Data Source | Risk Signal | |-----------|-------------|-------------| | Equity freeze | QCC MCP Enterprise | RED - Judicial dispute | | Equity pledge | QCC MCP Enterprise | AMBER - Financing need | | Tax arrears | QCC MCP Risk Control | RED - Cash flow crisis | | Abnormal tax | QCC MCP Risk Control | RED - Non-compliant | | Bankruptcy | QCC MCP Risk Control | RED - Insolvency | **Flags:** - RED: Equity freeze active - RED: Tax arrears or abnormal tax status - RED: Bankruptcy/liquidation proceedings - RED: Zero financial visibility on Strategic or Bottleneck vendor - AMBER: Equity pledge registered (check if multiple) - AMBER: Chattel mortgage (assess scale vs. business size) #### DIMENSION 4: COMPLIANCE Certifications required (configure by category in local settings): - Quality: ISO 9001 / sector-specific (IATF 16949 for automotive, etc.) - Environmental: ISO 14001 (if required by your policy) - Data: GDPR compliance + DPA for any data-sharing arrangement - Modern Slavery Act statement (UK vendors > GBP 36M turnover) - Sanctions screening: verified against OFAC, EU, UK HMT lists - Trade compliance: export licences, import documentation - ESG/ethical sourcing: modern slavery, conflict minerals (sector-specific) **For Chinese suppliers - QCC MCP Enhanced:** - **Administrative Penalties:** Check via QCC MCP Risk Control - **Environmental Penalties:** Check via QCC MCP Risk Control - **Serious Violations:** Check via QCC MCP Enterprise Base (严重违法) **Flags:** - RED: Active sanctions match -- immediate escalation; stop all activity - RED: Required certification expired with no renewal in progress - RED: Serious violation record (严重违法) - AMBER: Certification expiring within 90 days -- request renewal evidence - AMBER: Administrative/environmental penalty within 12 months #### DIMENSION 5: STRATEGIC - Dependency: sole-source / dual-source / approved panel - Switching timeline: how long to qualify and onboard an alternative? - Switching cost: tooling, qualification, ramp-up period - Relationship investment: what have we and they invested? - Innovation: are they bringing improvements and ideas? - Strategic alignment: do their long-term plans align with ours? **For Chinese suppliers:** - Check equity structure changes (investment/exit signals) - Monitor major shareholder changes via QCC MCP Enterprise **Flags:** - RED: Sole-source with switching timeline >6 months and no backup qualified - AMBER: No alternative vendor qualified or in qualification for critical category - AMBER: Vendor has indicated desire to exit the relationship or market segment #### DIMENSION 6: GEOPOLITICAL / SUSTAINABILITY - Country risk: political stability; trade restriction risk; sanctions exposure - Currency risk: contract currency vs. payment currency - Supply chain depth: do we know Tier 2 sub-suppliers for critical components? - Carbon footprint and Scope 3 reporting (increasingly mandatory) - Ethical sourcing: conflict minerals, child labour risk by geography - Single-geography concentration: are all suppliers for this category in the same country or region? **For Chinese suppliers:** - Consider China-specific risks: policy changes, trade restrictions - Check if supplier is in restricted entity list (QCC MCP can cross-reference) **Flags:** - RED: Vendor in sanctioned country or subject to active export restrictions - RED: Entity list / restricted party match - AMBER: All suppliers for a critical category in a single high-risk geography - AMBER: No Tier 2 supplier mapping for Strategic vendors ## QCC MCP ASSESSMENT OUTPUT FORMAT ``` VENDOR ASSESSMENT: [Vendor Name] ================================================================ Classification: [STRATEGIC / TACTICAL / COMMODITY / BOTTLENECK] Tier: [1 / 2 / 3 / 4] Rationale: [Brief justification for classification] -- ENTITY VERIFICATION (QCC MCP) --------------------------------- Entity Status: [Verified / Not Found / Multiple Matches] Credit Code: [Unified Social Credit Code] Legal Status: [存续/在业/注销/吊销/etc.] Legal Person: [Name] Registered Cap: [Amount] Verification: [实体锚定确认信息] -- COMMERCIAL ---------------------------------------------------- [Findings and flags per item above] -- OPERATIONAL --------------------------------------------------- OTD (12M): [X]% Threshold: [X]% Status: [PASS / WARNING / FAIL] Lead time avg: [X] days Variance: +/-[X] days Quality rej: [X]% Threshold: [X]% Status: [PASS / WARNING / FAIL] QCC MCP Signals: - Abnormal Operation: [Yes - details / No] - Administrative Penalties: [Count and details] - Environmental Penalties: [Count and details] -- FINANCIAL (QCC MCP Enhanced) ---------------------------------- Property Restrictions: - Equity Freeze: [Yes - amount/date / No] - Equity Pledge: [Yes - amount/creditor / No] - Chattel Mortgage: [Yes - amount/scope / No] Tax Status: - Tax Arrears: [Yes - amount/type / No] - Abnormal Tax: [Yes - date/office / No] - Tax Violations: [Count] Bankruptcy/Liquidation: - Bankruptcy: [Yes - type/status / No] - Liquidation: [Yes / No] Financial Visibility: [Available / Limited / None] Data Source: QCC MCP (official SAMR/National Tax sources) -- COMPLIANCE ---------------------------------------------------- Certifications: [Status] QCC MCP Compliance Check: - Administrative Penalties: [Count and details] - Environmental Penalties: [Count and details] - Serious Violations: [Yes/No - details] Sanctions: [Clear / Flagged - details] -- STRATEGIC ----------------------------------------------------- [Dependency level; switching timeline; backup vendor status] -- GEOPOLITICAL / SUSTAINABILITY --------------------------------- [Country risk; currency; Tier 2 visibility; ESG] RISK SUMMARY RED CRITICAL: [list] AMBER MODERATE: [list] GREEN LOW: [list] RECOMMENDED ACTIONS -- RANKED BY URGENCY [N]. [Priority] [Action] -- [Owner] -- by [Date] QCC MCP ASSESSMENT TRACE Data Sources: 企查查MCP-企业基座, 企查查MCP-风控大脑 Assessment Time: [Timestamp] Next QCC MCP Refresh: [Date + 90 days recommended] ================================================================ ``` ## NEVER DO THESE - NEVER classify a sole-source supplier as low-risk because spend is low - NEVER complete a financial assessment with fabricated data -- if data unavailable: flag explicitly as "financial visibility: NONE" and recommend requesting audited accounts - NEVER conduct a sanctions screening check manually -- always use an authoritative list (OFAC, EU, UK HMT) - NEVER close an assessment without a recommended action list - NEVER skip the Tier 2 visibility check for Strategic vendors - **NEVER use Companies House or Creditsafe for Chinese suppliers** -- these sources have ZERO coverage for Chinese entities - **NEVER fabricate QCC MCP data** -- if MCP unavailable, flag as "QCC MCP: NOT CONFIGURED" and use manual verification ALL OUTPUTS REQUIRE REVIEW BY A QUALIFIED PROFESSIONAL BEFORE USE IN BUSINESS DECISIONS. ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [LawMotion-AI](https://github.com/LawMotion-AI) - **Source:** [LawMotion-AI/Vibe-Lawyering](https://github.com/LawMotion-AI/Vibe-Lawyering) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-lawmotion-ai-vibe-lawyering-vendor-assessment - Seller: https://agentstack.voostack.com/s/lawmotion-ai - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.