Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add akiotanaka847/qaio-desktop --skill vet-a-vendorgit clone --depth 1 https://github.com/akiotanaka847/qaio-desktopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/akiotanaka847/qaio-desktop/vet-a-vendor)<a href="https://agentmods.dev/skills/akiotanaka847/qaio-desktop/vet-a-vendor"><img src="https://agentmods.dev/badge/skills/akiotanaka847/qaio-desktop/vet-a-vendor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/akiotanaka847/qaio-desktop/vet-a-vendor"><img src="https://agentmods.dev/badge/skills/akiotanaka847/qaio-desktop/vet-a-vendor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.02542 |
| Opus 5 | $0.00032 | $0.01271 |
| Sonnet 5 | $0.00013 | $0.00508 |
| Haiku 4.5 | $0.00006 | $0.00254 |
Grade A, and why
vet-a-vendor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vet A Vendor
One skill for vendor due-diligence. aspect param picks the angle: a commercial-fit evaluation against your supplier rubric, or a public-source compliance research report. Both ground in your operating context so risk thresholds match your posture.
Parameter: aspect
fit- rubric-based commercial due-diligence. Scores supplier 1-10 against your rubric, assigns risk tier (green / yellow / red), surfaces strengths, concerns, first-call questions, and a recommendation. Output:evaluations/{supplier-slug}.md.compliance- public-source compliance research. Catalogs frameworks claimed, triangulates against independent verification, names security leadership, lists incidents from the last 3 years. Every claim cited. Output:compliance-reports/{company-slug}.md.
User names aspect in plain English ("evaluate Stripe", "is Vercel a fit", "compliance check on Mongo", "is Notion clean") -> infer. Ambiguous -> ask ONE question naming both options.
When to use
fit:
- "evaluate {supplier} for {product / service}"
- "score these suppliers against our criteria"
- "is {vendor} a fit for {our use case}"
- Called from
score-an-inboundwhen inbound is a supplier application.
compliance:
- "run compliance due-diligence on {vendor}"
- "is {company}'s compliance posture real"
- "what frameworks does {vendor} actually hold"
- Called as sub-step of
aspect=fitfor risk-sensitive suppliers (data processors, infra, financial services).
Connections I need
I run external work through Composio. Before this skill runs I check the categories below are linked. Missing -> I name the category, ask you to connect it from the Integrations tab, stop.
- Web research (Firecrawl, Exa, Perplexity) - Required (both aspects). For
fit: pulls supplier site, pricing, case studies, recent news. Forcompliance: pulls trust pages, security pages, news coverage, triangulates framework claims. - Inbox (Gmail, Outlook) - Optional for
fit. Surfaces prior correspondence so I don't start cold. Not used forcompliance. - Social / professional network (LinkedIn) - Optional for
compliance. Lets me confirm a named CCO / CISO is real and active. Not used forfit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 150 lines · 64 tokens per session scan A 8cd33044bb77
vet-a-vendor is a skill published in the GitHub repository akiotanaka847/qaio-desktop (2 stars, last pushed 8d ago), licensed MIT. It adds 64 tokens to every session and 2,542 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
status-card-query
Create and maintain agent-authored Paperclip status cards, or compile a prose interest prompt into bounded CompanySearchQuery objects and write the first summary from the assigned Summarizer run.
anti-sleep
Keep a Mac awake with caffeinate during long builds, downloads, or supervised automation runs.
media-asset-management
Plan and run a media pipeline for images, video, and downloadable assets. Use this skill when designing image storage and delivery, choosing formats (WebP, AVIF), setting up responsive images, picking a video host, organizing a brand asset library, or auditing a slow image pipeline. Triggers on image pipeline, asset…
security-baseline
Establish a security baseline for a website or web app. Use this skill when configuring HTTPS and TLS, setting security headers, planning secrets management, evaluating CSP policies, doing a basic security audit, or hardening a site before launch. Triggers on security headers, HTTPS, TLS, CSP, content security policy…
after-action-report
Run a structured after-action review (postmortem, retrospective) on a launch, incident, or completed project to capture timeline, root cause analysis, contributing factors, and actionable lessons. Use this skill whenever the user wants to run a postmortem, retrospective, AAR, or after-action review on any past event.…
email-deliverability
Make sure email actually reaches inboxes. Use this skill when setting up email authentication (SPF, DKIM, DMARC), diagnosing emails landing in spam, planning a domain reputation strategy, monitoring sender reputation, or hardening against email spoofing. Triggers on email deliverability, SPF, DKIM, DMARC, spam folder…