vendor-review

vendor-review is a skill for Claude Code, Codex from anthropics/knowledge-work-plugins. It costs 54 tokens per session (730 once invoked), scanned A, original, Apache-2.0.

A vendor review is a structured evaluation of a supplier or service provider. It compares total cost, security and business risks, performance, contract terms, and fit for the organization.

In plain words
What is it for?
Use it to assess proposals, compare vendors, review renewals, calculate total cost of ownership, and prepare negotiation points.
Why use it?
It looks beyond the advertised price to include implementation, support, migration, lock-in, reliability, and exit costs. This supports a clearer renewal, replacement, or procurement decision.

Skill for Claude CodeCodex

Part of the operations plugin — 9 skills shipped together

About the project

Knowledge Work Plugins is an open-source collection of Claude extensions organized around roles such as productivity, sales, and customer support. Each plugin combines role-specific guidance, connectors, commands, and sub-agents so knowledge workers can use Claude with their team’s tools and processes. The catalogue entries are examples of, or workflows from, this plugin collection.

anthropics/knowledge-work-plugins · 23,849 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/anthropics/knowledge-work-plugins/vendor-review
Any agent
npx skills add anthropics/knowledge-work-plugins --skill vendor-review
Clone the repo
git clone --depth 1 https://github.com/anthropics/knowledge-work-plugins

Made for: Claude Code, Codex.

Or install operations, the plugin that ships this one along with the rest of its 9 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for vendor-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/anthropics/knowledge-work-plugins/vendor-review.svg)](https://agentmods.dev/skills/anthropics/knowledge-work-plugins/vendor-review)
Your own site
<a href="https://agentmods.dev/skills/anthropics/knowledge-work-plugins/vendor-review"><img src="https://agentmods.dev/badge/skills/anthropics/knowledge-work-plugins/vendor-review.svg" alt="Measured on agentmods" height="20"></a>
Per session 54 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 730 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00054 $0.00730
Opus 5 $0.00027 $0.00365
Sonnet 5 $0.00011 $0.00146
Haiku 4.5 $0.00005 $0.00073

Measured yesterday against content hash c2a959a7ed06, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

vendor-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

operations/skills/vendor-review/SKILL.md · 105 lines

How it starts

The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/vendor-review

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Evaluate a vendor with structured analysis covering cost, risk, performance, and fit.

Usage

/vendor-review $ARGUMENTS

What I Need From You

  • Vendor name: Who are you evaluating?
  • Context: New vendor evaluation, renewal decision, or comparison?
  • Details: Contract terms, pricing, proposal document, or current performance data

Evaluation Framework

Cost Analysis (Total Cost of Ownership)

  • Total cost of ownership (not just license fees)
  • Implementation and migration costs
  • Training and onboarding costs
  • Ongoing support and maintenance
  • Exit costs (data migration, contract termination)

Risk Assessment

  • Vendor financial stability
  • Security and compliance posture
  • Concentration risk (single vendor dependency)
  • Contract lock-in and exit terms
  • Business continuity and disaster recovery

Performance Metrics

  • SLA compliance
  • Support response times
  • Uptime and reliability
  • Feature delivery cadence
  • Customer satisfaction

Comparison Matrix

When comparing vendors, produce a side-by-side matrix covering: pricing, features, integrations, security, support, contract terms, and references.

Output

## Vendor Review: [Vendor Name]
**Date:** [Date] | **Type:** [New / Renewal / Comparison]

### Summary
[2-3 sentence recommendation]

### Cost Analysis
| Component | Annual Cost | Notes |
|-----------|-------------|-------|
| License/subscription | $[X] | [Per seat, flat, usage-based] |
| Implementation | $[X] | [One-time] |
| Support/maintenance | $[X] | [Included or add-on] |
| **Total Year 1** | **$[X]** | |
| **Total 3-Year** | **$[X]** | |

### Risk Assessment
| Risk | Likelihood | Impact | Mitigation |
|------|-----------|--------|------------|
| [Risk] | High/Med/Low | High/Med/Low | [Mitigation] |

### Strengths
- [Strength 1]
- [Strength 2]

### Concerns
- [Concern 1]
- [Concern 2]

### Recommendation
[Proceed / Negotiate / Pass] — [Reasoning]

### Negotiation Points
- [Leverage point 1]
- [Leverage point 2]

Read the full file on GitHub · 105 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 105 lines · 54 tokens per session scan A c2a959a7ed06

Subscribe to this mod's changes

vendor-review is a skill published in the GitHub repository anthropics/knowledge-work-plugins (23,849 stars, last pushed yesterday), licensed Apache-2.0. It adds 54 tokens to every session and 730 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

entity-compliance

Entity compliance tracker — initialize, report upcoming deadlines, update status, run health audit, export to CSV. Maintains a compliance-tracker.yaml built from the entity table, calculates filing deadlines by entity and jurisdiction, and surfaces what's due in the next 30/60/90 days. Use when user says "entity…

anthropics/claude-for-legal · 98 tokens

integration-management

Post-closing M&A integration tracker — phased workplan, consent tracking, contract assignment at scale, weekly status reports. Initializes from whatever deal artifacts are available (purchase agreement, deal summary, closing checklist) and connects to deal-context.md and closing-checklist.yaml from the M&A cold-start.…

anthropics/claude-for-legal · 100 tokens

matter-workspace

Manage matter workspaces — new, list, switch, close, or detach (practice-level). File-management logic for keeping one client or engagement's context separate from every other. Use when working across multiple clients or matters, when the user says "new matter", "switch matter", "list matters", "close matter", or when…

anthropics/claude-for-legal · 82 tokens

67-agency-vendor-brief

Dung khi thue NGUOI NGOAI lam — agency, freelancer, production house, vendor: scope of work, spec deliverable, so vong sua, quy trinh duyet, moc thanh toan, dieu khoan IP va bao mat, bang danh gia vendor sau du an. Kich hoat khi user nhac 'brief agency', 'thue freelancer', 'quan ly vendor', 'scope of work', 'agency…

minhnv0807/ai-business-skills · 197 tokens

collab-vendor

공급업체를 평가·선정하고 계약 및 리스크를 관리합니다. "벤더 평가 기준 만들어줘", "공급업체 리스크 레지스터 작성해줘", "계약 관리 체계를 잡아줘"라고 요청할 때 사용하세요. 벤더 선정 기준, 공급업체 평가표, 계약 관리 워크플로우, 리스크 식별 및 대응 계획을 지원합니다.

modu-ai/moai-cowork · 93 tokens

vendor-evaluation

Evaluate, select, and contract with vendors and SaaS tools. Use this skill when comparing alternatives, running an RFP, scoring vendors against criteria, negotiating contracts, planning a switch, or assessing a vendor's risk. Triggers on vendor evaluation, RFP, vendor selection, build vs buy, SaaS evaluation, vendor…

rampstackco/claude-skills · 99 tokens