grailautomation/vendor-review
operations/skills/vendor-review/SKILL.md
Evaluate a vendor — cost analysis, risk assessment, and recommendation
research
Updated May 15, 2026
$ install --global
skillsauthnpx skillsauth add grailautomation/claude-plugins vendor-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 15, 2026, 8:35 AM134.2s1 file scanned
SKILL.md
- name:
- vendor-review
- description:
- Evaluate a vendor — cost analysis, risk assessment, and recommendation
- argument-hint:
- <vendor name or proposal>
- disable-model-invocation:
- true
/operations:vendor-review
If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.
Evaluate a vendor with structured analysis covering cost, risk, performance, and fit. See the vendor-management skill for TCO frameworks, risk assessment criteria, and performance metrics.
Usage
/operations:vendor-review $ARGUMENTS
What I Need From You
- Vendor name: Who are you evaluating?
- Context: New vendor evaluation, renewal decision, or comparison?
- Details: Contract terms, pricing, proposal document, or current performance data
Output
## Vendor Review: [Vendor Name]
**Date:** [Date] | **Type:** [New / Renewal / Comparison]
### Summary
[2-3 sentence recommendation]
### Cost Analysis
| Component | Annual Cost | Notes |
|-----------|-------------|-------|
| License/subscription | $[X] | [Per seat, flat, usage-based] |
| Implementation | $[X] | [One-time] |
| Support/maintenance | $[X] | [Included or add-on] |
| **Total Year 1** | **$[X]** | |
| **Total 3-Year** | **$[X]** | |
### Risk Assessment
| Risk | Likelihood | Impact | Mitigation |
|------|-----------|--------|------------|
| [Risk] | High/Med/Low | High/Med/Low | [Mitigation] |
### Strengths
- [Strength 1]
- [Strength 2]
### Concerns
- [Concern 1]
- [Concern 2]
### Recommendation
[Proceed / Negotiate / Pass] — [Reasoning]
### Negotiation Points
- [Leverage point 1]
- [Leverage point 2]
If Connectors Available
If ~~knowledge base is connected:
- Search for existing vendor evaluations, contracts, and performance reviews
- Pull procurement policies and approval thresholds
If ~~procurement is connected:
- Pull current contract terms, spend history, and renewal dates
- Compare pricing against existing vendor agreements
Tips
- Upload the proposal — I can extract pricing, terms, and SLAs from vendor documents.
- Compare vendors — "Compare Vendor A vs Vendor B" gets you a side-by-side analysis.
- Include current spend — For renewals, knowing what you pay now helps evaluate price changes.
Related Skills
grailautomation/workato-recipe
development
VerifiedTrustedCommunity
Parse and analyze Workato recipe JSON exports. Use when the user asks about a Workato recipe's logic, data flow, field mappings, error handling, or control flow. Also use when the user references a .recipe.json file or asks to debug a Workato integration.
SKILL.mdUpdated Jul 5, 2026
grailautomation/staff-plan-review
databases
VerifiedTrustedCommunity
Review implementation plans as a staff software engineer. Use when the user asks for staff engineer feedback, senior engineering review, plan review, architecture review, implementation-plan critique, approval before proceeding, risk review, or feedback on a proposed technical plan.
SKILL.mdUpdated Jul 5, 2026
grailautomation/tasks
tools
VerifiedTrustedCommunity
Use when the user invokes $spec-kit:tasks or /spec-kit:tasks, or asks to generate dependency-ordered tasks from the plan and repo context.
SKILL.mdUpdated Jul 5, 2026
grailautomation/specify
testing
VerifiedTrustedCommunity
Use when the user invokes $spec-kit:specify or /spec-kit:specify, or asks to create a brownfield-aware feature specification from a natural language description.
SKILL.mdUpdated Jul 5, 2026