grailautomation/vendor-review
operations/skills/vendor-review/SKILL.md
Evaluate a vendor — cost analysis, risk assessment, and recommendation
research
Updated May 15, 2026
$ install --global
skillsauthnpx skillsauth add grailautomation/claude-plugins vendor-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 15, 2026, 8:35 AM134.2s1 file scanned
SKILL.md
- name:
- vendor-review
- description:
- Evaluate a vendor — cost analysis, risk assessment, and recommendation
- argument-hint:
- <vendor name or proposal>
- disable-model-invocation:
- true
/operations:vendor-review
If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.
Evaluate a vendor with structured analysis covering cost, risk, performance, and fit. See the vendor-management skill for TCO frameworks, risk assessment criteria, and performance metrics.
Usage
/operations:vendor-review $ARGUMENTS
What I Need From You
- Vendor name: Who are you evaluating?
- Context: New vendor evaluation, renewal decision, or comparison?
- Details: Contract terms, pricing, proposal document, or current performance data
Output
## Vendor Review: [Vendor Name]
**Date:** [Date] | **Type:** [New / Renewal / Comparison]
### Summary
[2-3 sentence recommendation]
### Cost Analysis
| Component | Annual Cost | Notes |
|-----------|-------------|-------|
| License/subscription | $[X] | [Per seat, flat, usage-based] |
| Implementation | $[X] | [One-time] |
| Support/maintenance | $[X] | [Included or add-on] |
| **Total Year 1** | **$[X]** | |
| **Total 3-Year** | **$[X]** | |
### Risk Assessment
| Risk | Likelihood | Impact | Mitigation |
|------|-----------|--------|------------|
| [Risk] | High/Med/Low | High/Med/Low | [Mitigation] |
### Strengths
- [Strength 1]
- [Strength 2]
### Concerns
- [Concern 1]
- [Concern 2]
### Recommendation
[Proceed / Negotiate / Pass] — [Reasoning]
### Negotiation Points
- [Leverage point 1]
- [Leverage point 2]
If Connectors Available
If ~~knowledge base is connected:
- Search for existing vendor evaluations, contracts, and performance reviews
- Pull procurement policies and approval thresholds
If ~~procurement is connected:
- Pull current contract terms, spend history, and renewal dates
- Compare pricing against existing vendor agreements
Tips
- Upload the proposal — I can extract pricing, terms, and SLAs from vendor documents.
- Compare vendors — "Compare Vendor A vs Vendor B" gets you a side-by-side analysis.
- Include current spend — For renewals, knowing what you pay now helps evaluate price changes.
Related Skills
grailautomation/write-spec
documentation
VerifiedTrustedCommunity
Write a feature spec or PRD from a problem statement or feature idea
SKILL.mdUpdated May 15, 2026
grailautomation/user-research-synthesis
development
VerifiedTrustedCommunity
Synthesize qualitative and quantitative user research into structured insights and opportunity areas. Use when analyzing interview notes, survey responses, support tickets, or behavioral data to identify themes, build personas, or prioritize opportunities.
SKILL.mdUpdated May 15, 2026
grailautomation/synthesize-research
research
VerifiedTrustedCommunity
Synthesize user research from interviews, surveys, and feedback into structured insights
SKILL.mdUpdated May 15, 2026
grailautomation/stakeholder-update
data-ai
VerifiedTrustedCommunity
Generate a stakeholder update tailored to audience and cadence
SKILL.mdUpdated May 15, 2026