C15t
c15t/c15t
Work with c15t consent management docs, APIs, and integrations for Next.js, React, and JavaScript.
Vendor privacy risk tiering methodology for processor management.
Install Vendor Risk Scoring
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-risk-scoring -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-risk-scoring --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/privacy/vendor-risk-scoring .claude/skills/vendor-risk-scoring && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "vendor-risk-scoring" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-risk-scoring into .claude/skills/vendor-risk-scoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-risk-scoring", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-risk-scoringType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-risk-scoring -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-risk-scoring --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/privacy/vendor-risk-scoring .agents/skills/vendor-risk-scoring && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "vendor-risk-scoring" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-risk-scoring into .agents/skills/vendor-risk-scoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-risk-scoring", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-risk-scoring -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-risk-scoring --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/privacy/vendor-risk-scoring .cursor/skills/vendor-risk-scoring && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "vendor-risk-scoring" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-risk-scoring into .cursor/skills/vendor-risk-scoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-risk-scoring", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/mukul975/Privacy-Data-Protection-Skills.git --path skills/privacy/vendor-risk-scoring--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-risk-scoring -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-risk-scoring --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/privacy/vendor-risk-scoring .gemini/skills/vendor-risk-scoring && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "vendor-risk-scoring" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-risk-scoring into .gemini/skills/vendor-risk-scoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-risk-scoring", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-risk-scoringInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-risk-scoring -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/privacy/vendor-risk-scoring .github/skills/vendor-risk-scoring && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "vendor-risk-scoring" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-risk-scoring into .github/skills/vendor-risk-scoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-risk-scoring", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-risk-scoring -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-risk-scoring --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/privacy/vendor-risk-scoring .opencode/skills/vendor-risk-scoring && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "vendor-risk-scoring" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-risk-scoring into .opencode/skills/vendor-risk-scoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-risk-scoring", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
vendor-risk-scoring- GitHub stars
- 301
- Token cost
- ~2.1k tokens
- SKILL.md length
- 883 words
- Files
- 5 (incl. scripts, references, assets)
- Skills in repo
- 280
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Vendor privacy risk tiering methodology for processor management.
- Works in 4 steps: At least one completed audit cycle at… → Updated certifications covering all… → DPO approval of tier reduction → …
- Tasks that involve Privacy and GDPR
- SKILL.md covers Overview, Risk Scoring Model, Scoring Adjustments and Aggregated Vendor Risk Dashboard, plus 1 more section
- Runs Python scripts from its folder
What it does
Vendor Risk Scoring is an agent skill from mukul975/Privacy-Data-Protection-Skills. Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.
Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/standards.md` and `references/workflows.md`).
It sits in Legal & Compliance, covering Privacy and GDPR. The repository describes itself as: 282+ structured privacy & data protection skills for AI agents. GDPR, CCPA, EU AI Act, HIPAA, LGPD, PIPL, DPDP Act. The licence is Apache-2.0.
When your agent uses it
- Tasks that involve Privacy and GDPR
Example prompts
- “/vendor-risk-scoring”
Requirements
- Python 3
Workflow steps
4 steps, taken from the first numbered list in SKILL.md.
- At least one completed audit cycle at current tier with no Major or Critical findings
- Updated certifications covering all processing in scope
- DPO approval of tier reduction
- Documentation of rationale
What it can do on your machine
Read from SKILL.md and the folder at commit 9b2ef9e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/ (Python), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Vendor Risk Scoring loads about 2.1k tokens when it runs, and up to ~4.4k if it reads all its reference files. Until then it costs about 67 tokens; SKILL.md has 883 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from mukul975/Privacy-Data-Protection-Skills at commit 9b2ef9e, republished under its Apache-2.0 licence (© mukul975). 883 words, ~2,098 tokens.
Download SKILL.mdSave it as
.claude/skills/vendor-risk-scoring/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.- name
- vendor-risk-scoring
- description
- Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.
- license
- Apache-2.0
- metadata.author
- mukul975
- metadata.version
- 1.0
- metadata.domain
- privacy
- metadata.subdomain
- vendor-privacy-management
- metadata.tags
- vendor-risk-scoring, risk-tiering, privacy-risk, vendor-assessment, control-maturity
Vendor Privacy Risk Scoring
Overview
Effective vendor privacy management requires a risk-based approach that allocates oversight resources proportionate to the privacy risk each vendor presents. GDPR Recital 76 states that risk should be assessed based on "the likelihood and severity" of potential impact on data subjects. The EDPB Guidelines 07/2020 (paragraph 86) indicate that the controller's assessment of processor sufficiency must consider expert knowledge, reliability, and resources — factors that feed directly into risk scoring.
At Summit Cloud Partners, the Vendor Privacy Risk Scoring Model assigns each vendor a quantified risk score based on objective factors, enabling consistent risk tiering, proportionate oversight, and audit prioritization.
Risk Scoring Model
Scoring Dimensions
The model evaluates seven dimensions, each scored on a 1-5 scale where 1 = lowest risk and 5 = highest risk.
Dimension 1: Data Volume (Weight: 15%)
| Score | Criterion | Description |
|---|---|---|
| 1 | < 100 data subjects | Minimal volume processing |
| 2 | 100 – 1,000 data subjects | Low volume |
| 3 | 1,001 – 10,000 data subjects | Moderate volume |
| 4 | 10,001 – 100,000 data subjects | High volume |
| 5 | > 100,000 data subjects | Very high volume |
Dimension 2: Data Sensitivity (Weight: 25%)
| Score | Criterion | Description |
|---|---|---|
| 1 | Pseudonymized non-sensitive data only | Minimal identifiability |
| 2 | Non-sensitive personal data (names, email) | Standard personal data |
| 3 | Behavioral data, location data, financial identifiers | Elevated sensitivity |
| 4 | Government IDs, precise geolocation, communications content | High sensitivity |
| 5 | Special category data (Art. 9) or criminal convictions (Art. 10) | Maximum sensitivity |
Dimension 3: Transfer Locations (Weight: 15%)
| Score | Criterion | Description |
|---|---|---|
| 1 | Processing exclusively within EEA | No transfer risk |
| 2 | Processing in EEA + adequacy decision countries | Minimal transfer risk |
| 3 | Processing includes non-adequate countries with robust SCCs and supplementary measures | Managed transfer risk |
| 4 | Processing in jurisdictions with government surveillance concerns (per EDPB assessments) | Elevated transfer risk |
| 5 | Processing in jurisdictions lacking rule of law / no valid transfer mechanism | Maximum transfer risk |
Dimension 4: Certifications and Attestations (Weight: 15%)
Inverse scoring — higher certifications reduce risk.
| Score | Criterion | Description |
|---|---|---|
| 1 | ISO 27001 + ISO 27701 + SOC 2 Type II + sector-specific cert | Comprehensive certification |
| 2 | ISO 27001 + SOC 2 Type II (or equivalent combination) | Strong certification |
| 3 | ISO 27001 only or SOC 2 Type II only | Moderate certification |
| 4 | Self-assessment or CSA STAR Level 1 only | Limited certification |
| 5 | No recognized certifications or attestations | No certification |
Dimension 5: Breach and Enforcement History (Weight: 10%)
| Score | Criterion | Description |
|---|---|---|
| 1 | No breaches, no enforcement actions in past 5 years | Clean record |
| 2 | Minor incident(s) with prompt notification and remediation | Low incident history |
| 3 | One significant breach with adequate response | Moderate history |
| 4 | Multiple breaches or one enforcement action | Elevated history |
| 5 | Major enforcement action or pattern of breach non-compliance | High-risk history |
Dimension 6: Control Maturity (Weight: 10%)
| Score | Criterion | Description |
|---|---|---|
| 1 | Optimized — continuous improvement, metrics-driven, automated controls | Industry leading |
| 2 | Managed — controls measured and monitored, regular testing | Mature program |
| 3 | Defined — documented policies and procedures, periodic testing | Established program |
| 4 | Developing — basic controls in place, gaps in documentation | Emerging program |
| 5 | Initial — ad hoc controls, minimal documentation | Immature program |
Dimension 7: Processing Autonomy (Weight: 10%)
| Score | Criterion | Description |
|---|---|---|
| 1 | No discretion — purely technical processing per exact instructions | Minimal autonomy |
| 2 | Limited discretion — predefined processing options | Low autonomy |
| 3 | Moderate discretion — processor selects technical means | Standard autonomy |
| 4 | Significant discretion — processor defines processing logic | Elevated autonomy |
| 5 | High discretion — processor approaches controller boundary | Maximum autonomy |
Show full SKILL.md (338 more words)Show less
Risk Score Calculation
Weighted Risk Score = Σ (Dimension Score × Dimension Weight)
Weighted Risk Score = (D1 × 0.15) + (D2 × 0.25) + (D3 × 0.15) + (D4 × 0.15)
+ (D5 × 0.10) + (D6 × 0.10) + (D7 × 0.10)Risk Tier Assignment
| Tier | Score Range | Label | Oversight Level |
|---|---|---|---|
| Tier 1 | 3.5 – 5.0 | High Risk | Maximum oversight: annual on-site audit, quarterly monitoring, full due diligence refresh annually |
| Tier 2 | 2.5 – 3.4 | Standard Risk | Standard oversight: annual remote audit, semi-annual monitoring, due diligence refresh biennially |
| Tier 3 | 1.0 – 2.4 | Low Risk | Minimum oversight: biennial documentation audit, annual monitoring, due diligence refresh triennially |
Tier-Based Oversight Requirements
| Activity | Tier 1 (High) | Tier 2 (Standard) | Tier 3 (Low) |
|---|---|---|---|
| Due diligence refresh | Annual | Biennial | Triennial |
| Privacy audit | Annual (Type 2 or 3) | Annual (Type 1) | Biennial (Type 1) |
| Sub-processor review | Quarterly | Semi-annual | Annual |
| DPA review | Annual | Biennial | Triennial |
| Risk score recalculation | Semi-annual | Annual | Biennial |
| Continuous monitoring | Active monitoring | Periodic monitoring | Annual check |
Scoring Adjustments
Escalation Triggers
The following events trigger automatic tier escalation (one tier up):
| Trigger | Duration |
|---|---|
| Personal data breach at vendor | Until post-breach reassessment completed |
| Regulatory enforcement action | Until remediation verified |
| Certification lapse (> 30 days) | Until certification renewed |
| Material service change without prior notification | Until change assessed |
| Failed audit (Critical findings) | Until remediation verified |
De-escalation Criteria
Tier reduction requires:
- At least one completed audit cycle at current tier with no Major or Critical findings
- Updated certifications covering all processing in scope
- DPO approval of tier reduction
- Documentation of rationale
Aggregated Vendor Risk Dashboard
Summit Cloud Partners maintains an aggregated view of vendor privacy risk:
| Metric | Description |
|---|---|
| Total vendors processing personal data | Count of active vendor DPAs |
| Vendors by tier | Distribution across Tier 1/2/3 |
| Average risk score | Mean weighted score across all vendors |
| Trend | Quarter-over-quarter score movement |
| Overdue assessments | Vendors past their scheduled reassessment date |
| Open audit findings | Total by severity |
| Vendors with third-country transfers | Count and transfer mechanisms used |
Key Regulatory References
- GDPR Recital 76 — Risk assessment based on likelihood and severity
- GDPR Article 24 — Controller responsibility proportionate to risk
- GDPR Article 28(1) — Sufficient guarantees requirement
- GDPR Article 32(1) — Security measures accounting for risk
- EDPB Guidelines 07/2020 — Processor assessment factors (paragraph 86)
- NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments (methodology reference)
© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 4 other files (scripts, references, assets) in skills/privacy/vendor-risk-scoring of mukul975/Privacy-Data-Protection-Skills.
- SKILL.md
- assets/template.md
- references/standards.md
- references/workflows.md
- scripts/process.py
Open the folder on GitHubat commit 9b2ef9e
Compare with similar skills
Vendor Risk Scoring next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Vendor Risk Scoring this skillmukul975/Privacy-Data-Protection-Skills | 301 | — | ~2.1k | Automated safety check: Pass | Apache-2.0 | |
| C15tc15t/c15t | 1.9k | 1 repos | ~1.6k | Automated safety check: Pass | Apache-2.0 | |
| HIPAA Safe Harbor Coverage Auditmaziyarpanahi/openmed | 5.5k | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | |
| Korean Privacy Termskimlawtech/korean-privacy-terms | 587 | — | ~2.9k | Automated safety check: Pass | Apache-2.0 | |
| Gdpr ComplianceSushegaad/Claude-Skills-Governance-Risk-and-Compliance | 946 | 1 repos | ~3.9k | Automated safety check: Pass | MIT | |
| Hipaa ComplianceSushegaad/Claude-Skills-Governance-Risk-and-Compliance | 946 | 1 repos | ~2.3k | Automated safety check: Pass | MIT |
Similar skills
HIPAA Safe Harbor Coverage Audit
maziyarpanahi/openmed
Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.
Korean Privacy Terms
kimlawtech/korean-privacy-terms
처리방침·이용약관 자동 생성 스킬 패키지 (v4.0). An agent skill from kimlawtech/korean-privacy-terms.
Gdpr Compliance
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert GDPR compliance assistant covering all four core workflows: (1) auditing code and systems for GDPR violations, (2) drafting GDPR-compliant documents such as privacy policies, Data Processing…
Hipaa Compliance
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert HIPAA compliance assistant for healthcare and software contexts.
Pii Contract Analyze
gregmos/PII-Shield
Universal legal document processor with PII anonymization. An agent skill from gregmos/PII-Shield.
More from mukul975/Privacy-Data-Protection-Skills
All 280 skills in this repoAge Gating Services
mukul975/Privacy-Data-Protection-Skills
Implements age-gating mechanisms for online services to restrict access based on user age.
AI Data Retention
mukul975/Privacy-Data-Protection-Skills
Manages AI model retention and machine unlearning requirements.
AI Dpia
mukul975/Privacy-Data-Protection-Skills
Conducts Data Protection Impact Assessments for AI and ML systems per EDPB Guidelines 04/2025 on AI processing.
Dpia Mitigation Plan
mukul975/Privacy-Data-Protection-Skills
Structures risk mitigation planning and residual risk tracking for Data Protection Impact Assessments under GDPR Article 35(7)(d).
Gdpr Accountability
mukul975/Privacy-Data-Protection-Skills
Guides implementation of the GDPR accountability principle under Articles 5(2) and 24, including documentation requirements for policies, DPIAs, RoPA, training records, and breach logs.
Pia Threshold Screening
mukul975/Privacy-Data-Protection-Skills
Conducts pre-DPIA threshold screening to determine whether a full Data Protection Impact Assessment is required under GDPR Article 35.
Related
Categories
Questions about Vendor Risk Scoring
What does Vendor Risk Scoring do?
Vendor privacy risk tiering methodology for processor management. Vendor Risk Scoring is an agent skill from mukul975/Privacy-Data-Protection-Skills. Vendor privacy risk tiering methodology for processor management.
When should I use Vendor Risk Scoring?
Vendor Risk Scoring fits situations like: tasks that involve Privacy and GDPR.
How do I install Vendor Risk Scoring in Claude Code?
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-risk-scoring -a claude-code`. Or copy the skill folder (skills/privacy/vendor-risk-scoring in mukul975/Privacy-Data-Protection-Skills) into .claude/skills/vendor-risk-scoring in your project. Claude Code loads it when a task matches its description.
How do I install Vendor Risk Scoring in Codex?
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-risk-scoring -a codex`. Or copy the skill folder (skills/privacy/vendor-risk-scoring in mukul975/Privacy-Data-Protection-Skills) into .agents/skills/vendor-risk-scoring in your project. Codex loads it when a task matches its description.
Can I use Vendor Risk Scoring in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-risk-scoring -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/vendor-risk-scoring, .gemini/skills/vendor-risk-scoring, .github/skills/vendor-risk-scoring and .opencode/skills/vendor-risk-scoring in your project.
What does Vendor Risk Scoring need to run?
Going by SKILL.md and its folder, Vendor Risk Scoring needs Python for the scripts in its folder. Our summary lists: Python 3.
Does Vendor Risk Scoring access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Vendor Risk Scoring safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Vendor Risk Scoring use?
Vendor Risk Scoring is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Vendor Risk Scoring use?
About 2.1k tokens (SKILL.md is roughly 8.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.3k tokens, read only when the agent opens those files.
What are the alternatives to Vendor Risk Scoring?
Skills that share tags, products or a category with Vendor Risk Scoring: C15t (c15t/c15t, 1.9k stars), HIPAA Safe Harbor Coverage Audit (maziyarpanahi/openmed, 5.5k stars), Korean Privacy Terms (kimlawtech/korean-privacy-terms, 587 stars) and Gdpr Compliance (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 946 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Vendor Risk Scoring?
mukul975 (a GitHub user) maintains it in mukul975/Privacy-Data-Protection-Skills, which has 301 GitHub stars. The repository holds 280 skills in this directory. The repository was last updated on March 16, 2026.
Source: mukul975/Privacy-Data-Protection-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.