supplier due diligence builder

    1

    Automated vendor risk profiling and due diligence packs tailored to data access and operational criticality.

    $5

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    supplier due diligence builder

    Example session with this skill installed

    Assess a new cloud CRM vendor. They will host PII, have API access to our billing system, and the contract is $200k/year. They have SOC 2 Type II but no ISO 27001.

    • Read your context and instructions
    • Compiled the supplier due diligence

    I have completed the risk profiling and due diligence pack for the cloud CRM vendor based on the PII access and billing system integration.

    Supplier Due Diligence Pack: Cloud CRM

    DomainRisk LevelPrimary Drivers
    OperationalHighCritical dependency for sales; API integration with billing.
    FinancialMedium$200k annual spend; mid-tier contract value.
    SecurityHighAPI/Network access; lacks ISO 27001; SOC 2 Type II present.
    PrivacyCriticalProcessing PII (Customer Data); cross-border transfer risk.
    ContinuityHighHigh RTO requirement for sales operations.

    Tailored Evidence & Questionnaire

    Privacy (Critical): Provide a full Data Processing Addendum (DPA). List all sub-processors used for hosting and analytics. Question: How is customer PII isolated at the database level?
    *

    Security (High): Provide the latest SOC 2 Type II report and Bridge Letter. Question: Provide the last 12 months of uptime reports and recent pentest remediation logs.

    • Insurance: Verify Professional Liability/Cyber insurance meets the $5M minimum for API-integrated vendors.

    Approval Workflow & Conditions

    • Approvers: CISO (Security), Privacy Officer (DPA), Head of Sales (Ops).

    Conditions: API access restricted to read-only until pentest report is reviewed. MFA must be enforced for all vendor support staff.

    • Review Cadence: Quarterly (High Risk Profile).

    Specialist Referrals

    • Security: Review SOC 2 report for 'Exceptions' in the Common Criteria.
    • Legal: Validate liability caps against the risk of PII breach.

    Next steps

    1. Send the tailored Q&A and DPA request to the vendor's account executive.
    2. Schedule the CISO review for the SOC 2 report findings.
    3. Update the Vendor Risk Register with the 'High' residual risk rating.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    The problem

    Vetting new vendors is often a manual, inconsistent process that relies on generic spreadsheets. Teams struggle to scale risk assessments based on actual data access and operational criticality, leading to missed security gaps or bloated questionnaires.

    What it does

    • Generates multi-domain risk profiles covering operational, financial, security, privacy, and continuity factors.
    • Dynamically scales questionnaire depth from 1 to 10 questions per domain based on calculated risk levels.
    • Automates evidence checklists for SOC 2 reports, insurance certificates, and DR plans.
    • Defines role-based approval workflows and ongoing review cadences (monthly to annual).
    • Identifies residual risk and flags specific findings for legal or security specialist review.

    Why this beats prompting it yourself

    General prompts fail to adjust the rigor of the assessment to the specific data types involved. This skill applies a logic-driven weighting system that ensures high-risk domains get deeper scrutiny while low-risk items remain frictionless.

    Use cases

    • Pre-contract risk assessment for SaaS providers handling PII or PHI.
    • Standardizing annual vendor re-evaluations for procurement teams.
    • Building technical due diligence packs for business continuity planning.
    • Scoping security requirements for third-party API integrations.

    Requires manual entry of supplier scope and access levels to function. Does not include a database of pre-existing company financial records or security breach histories.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 2 months ago

    Permissions

    No special permissions declared or detected

    Listed2 months ago
    Updated25 days ago

    What's inside

    Frequently Asked Questions

    The skill assesses eight domains: Operational, Financial, Security, Privacy, Continuity, Subcontractor, Insurance, and Contractual exposure.

    It uses a logic-driven weighting system where Critical or High risk domains receive 8 to 10 detailed questions, while Low risk areas receive only 1 to 2, ensuring efficiency.

    Yes. It performs an evidence gap analysis, identifying missing SOC 2 reports, insurance certificates, or policies, and flags items for specialist review.

    The skill outputs a primary owner, a review rhythm based on risk level (monthly to annual), and specific triggers for ad-hoc re-evaluations.

    New in Business & Operations