Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add serac-labs/serac --skill vendor-managementgit clone --depth 1 https://github.com/serac-labs/seracWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/serac-labs/serac/vendor-management)<a href="https://agentmods.dev/skills/serac-labs/serac/vendor-management"><img src="https://agentmods.dev/badge/skills/serac-labs/serac/vendor-management/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/serac-labs/serac/vendor-management"><img src="https://agentmods.dev/badge/skills/serac-labs/serac/vendor-management.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.02717 |
| Opus 5.5 | $0.00016 | $0.01087 |
| Sonnet 5.5 | $0.00008 | $0.00543 |
| Haiku 4.5 | $0.00004 | $0.00272 |
Grade A, and why
vendor-management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 420 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vendor Management for ServiceNow
Vendor Management tracks suppliers, contracts, performance, and risk.
Vendor Architecture
Vendor (core_company)
├── Contracts (ast_contract)
│ ├── Contract Terms
│ └── SLAs
├── Contacts
├── Assessments
└── Performance Metrics
Key Tables
| Table | Purpose |
|---|---|
core_company |
Vendors/Companies |
ast_contract |
Contracts |
ast_contract_sla |
Contract SLAs |
vendor_risk_assessment |
Risk assessments |
procurement_vendor |
Vendor details |
Vendors (ES5)
Create Vendor
// Create vendor (ES5 ONLY!)
var vendor = new GlideRecord("core_company")
vendor.initialize()
// Basic info
vendor.setValue("name", "Acme Technology Solutions")
vendor.setValue("vendor", true)
// Contact info
vendor.setValue("phone", "+1-555-123-4567")
vendor.setValue("email", "[email protected]")
vendor.setValue("website", "https://www.acmetech.com")
// Address
vendor.setValue("street", "456 Vendor Ave")
vendor.setValue("city", "San Francisco")
vendor.setValue("state", "CA")
vendor.setValue("zip", "94105")
vendor.setValue("country", "US")
// Classification
vendor.setValue("vendor_type", "technology")
vendor.setValue("u_vendor_tier", "strategic")
// Primary contact
vendor.setValue("contact", primaryContactSysId)
vendor.insert()
Vendor Search
// Search vendors (ES5 ONLY!)
function searchVendors(criteria) {
var vendors = []
var gr = new GlideRecord("core_company")
gr.addQuery("vendor", true)
gr.addQuery("vendor_active", true)
if (criteria.name) {
gr.addQuery("name", "CONTAINS", criteria.name)
}
if (criteria.type) {
gr.addQuery("vendor_type", criteria.type)
}
if (criteria.tier) {
gr.addQuery("u_vendor_tier", criteria.tier)
}
gr.query()
while (gr.next()) {
vendors.push({
sys_id: gr.getUniqueValue(),
name: gr.getValue("name"),
type: gr.getValue("vendor_type"),
tier: gr.getValue("u_vendor_tier"),
contact: gr.contact.getDisplayValue(),
active_contracts: countActiveContracts(gr.getUniqueValue()),
})
}
return vendors
}
function countActiveContracts(vendorSysId) {
var ga = new GlideAggregate("ast_contract")
ga.addQuery("vendor", vendorSysId)
ga.addQuery("state", "active")
ga.addAggregate("COUNT")
ga.query()
if (ga.next()) {
return parseInt(ga.getAggregate("COUNT"), 10)
}
return 0
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 420 lines · 40 tokens per session scan A 162d3dd4b158
vendor-management is a skill published in the GitHub repository serac-labs/serac (78 stars, last pushed 7d ago), licensed Apache-2.0. It adds 40 tokens to every session and 2,717 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-11.
Other skills, from other repositories
vendor-doc-intake
Daily vendor-onboarding intake for {{requestlabel}}. Validates the W-9, banking form, and signed contract for every new vendor request against a fixed checklist, records every vendor's status in {{vendorregister}}, drafts a follow-up for anything missing or invalid, and posts the batch to {{reviewchannel}}. Load this…
standards-expert
Expert-level ISO standards, quality management, compliance, and certification. Use when the user mentions ISO standards, quality management, compliance, or certification, or when the task involves Compliance & Certification, Auditing, or Continuous Improvement.
analisi-fornitori
Usa questa skill quando il cliente invia il mastrino fornitori (o un elenco fatture/fornitori) e serve lo screening privacy — es. «analizza il mastrino fornitori», «chi dobbiamo nominare responsabile ex art. 28», «screening fornitori GDPR», «analisi fornitori per la nomina», «il cliente ci ha mandato l'elenco dei…
procure-quotazioni
Genera in serie procure alle liti (art. 83 c.p.c.) e lettere di quotazione compensi D.M. 55/2014 in DOCX per posizioni di recupero crediti, partendo da un Excel di posizioni o dai dati forniti, con rilevamento della fase processuale (monitorio, esecuzione forzata, opposizione a decreto ingiuntivo). Usa quando l'utente…
analisi-giurisprudenziale
Analisi degli orientamenti giurisprudenziali su un tema con sintesi delle sentenze principali. Usa quando l'utente chiede di ricercare giurisprudenza, orientamenti della Cassazione, o precedenti.
analisi-sinistro
Analizza sinistri stradali, sanitari e lavorativi con quantificazione del danno non patrimoniale (unitario, ex art. 2059 c.c.), rivalutazione ISTAT e interessi compensativi. Usa quando l'utente descrive un incidente, un sinistro, chiede risarcimento danni per invalidita o quantificazione danni da lesioni personali.