Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add serac-labs/serac --skill vendor-managementgit clone --depth 1 https://github.com/serac-labs/seracWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/serac-labs/serac/vendor-management)<a href="https://agentmods.dev/skills/serac-labs/serac/vendor-management"><img src="https://agentmods.dev/badge/skills/serac-labs/serac/vendor-management/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/serac-labs/serac/vendor-management"><img src="https://agentmods.dev/badge/skills/serac-labs/serac/vendor-management.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.02717 |
| Opus 5 | $0.00020 | $0.01358 |
| Sonnet 5 | $0.00008 | $0.00543 |
| Haiku 4.5 | $0.00004 | $0.00272 |
Grade A, and why
vendor-management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 420 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vendor Management for ServiceNow
Vendor Management tracks suppliers, contracts, performance, and risk.
Vendor Architecture
Vendor (core_company)
├── Contracts (ast_contract)
│ ├── Contract Terms
│ └── SLAs
├── Contacts
├── Assessments
└── Performance Metrics
Key Tables
| Table | Purpose |
|---|---|
core_company |
Vendors/Companies |
ast_contract |
Contracts |
ast_contract_sla |
Contract SLAs |
vendor_risk_assessment |
Risk assessments |
procurement_vendor |
Vendor details |
Vendors (ES5)
Create Vendor
// Create vendor (ES5 ONLY!)
var vendor = new GlideRecord("core_company")
vendor.initialize()
// Basic info
vendor.setValue("name", "Acme Technology Solutions")
vendor.setValue("vendor", true)
// Contact info
vendor.setValue("phone", "+1-555-123-4567")
vendor.setValue("email", "[email protected]")
vendor.setValue("website", "https://www.acmetech.com")
// Address
vendor.setValue("street", "456 Vendor Ave")
vendor.setValue("city", "San Francisco")
vendor.setValue("state", "CA")
vendor.setValue("zip", "94105")
vendor.setValue("country", "US")
// Classification
vendor.setValue("vendor_type", "technology")
vendor.setValue("u_vendor_tier", "strategic")
// Primary contact
vendor.setValue("contact", primaryContactSysId)
vendor.insert()
Vendor Search
// Search vendors (ES5 ONLY!)
function searchVendors(criteria) {
var vendors = []
var gr = new GlideRecord("core_company")
gr.addQuery("vendor", true)
gr.addQuery("vendor_active", true)
if (criteria.name) {
gr.addQuery("name", "CONTAINS", criteria.name)
}
if (criteria.type) {
gr.addQuery("vendor_type", criteria.type)
}
if (criteria.tier) {
gr.addQuery("u_vendor_tier", criteria.tier)
}
gr.query()
while (gr.next()) {
vendors.push({
sys_id: gr.getUniqueValue(),
name: gr.getValue("name"),
type: gr.getValue("vendor_type"),
tier: gr.getValue("u_vendor_tier"),
contact: gr.contact.getDisplayValue(),
active_contracts: countActiveContracts(gr.getUniqueValue()),
})
}
return vendors
}
function countActiveContracts(vendorSysId) {
var ga = new GlideAggregate("ast_contract")
ga.addQuery("vendor", vendorSysId)
ga.addQuery("state", "active")
ga.addAggregate("COUNT")
ga.query()
if (ga.next()) {
return parseInt(ga.getAggregate("COUNT"), 10)
}
return 0
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 420 lines · 40 tokens per session scan A 162d3dd4b158
vendor-management is a skill published in the GitHub repository serac-labs/serac (78 stars, last pushed yesterday), licensed Apache-2.0. It adds 40 tokens to every session and 2,717 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-11.
Other skills, from other repositories
vendor-doc-intake
Daily vendor-onboarding intake for {{requestlabel}}. Validates the W-9, banking form, and signed contract for every new vendor request against a fixed checklist, records every vendor's status in {{vendorregister}}, drafts a follow-up for anything missing or invalid, and posts the batch to {{reviewchannel}}. Load this…
design-inventory
Use to run the Claude Design to ClosedLoop pipeline against the current web-ui. Stage A inventories a design export zip into schema-validated findings (typed design units - screens, regions like nav bars, standalone components like a chat dialog; UX and behavioral changes; Storybook component reuse mapping; token…
prd-creator
This skill helps PMs draft lightweight PRDs. It should be used when a PM wants to define a new feature, brainstorm requirements, or prep for sprint planning. Triggers include "I have a feature idea", "help me write a PRD", "let's break this into stories", or "what do I need for sprint planning". Optimized for speed …
upload-artifact
Upload a file as a ClosedLoop document (PRD, implementation plan, feature, or template). Reads file content and uploads via MCP without consuming conversation context. Also supports creating new versions of existing documents. Triggers on: "upload artifact", "upload PRD", "upload implementation plan", "upload…
cross-repo-cache
Check if cross-repo coordinator results can be reused, avoiding redundant Sonnet agent launches. Compares peer repo git hashes against stored hashes from last coordinator run. Triggers on: entering Phase 1.4.1, checking cross-repo cache, before discovering peers. Returns CROSSREPOCACHEHIT with cached status or…
standards-expert
Expert-level ISO standards, quality management, compliance, and certification. Use when the user mentions ISO standards, quality management, compliance, or certification, or when the task involves Compliance & Certification, Auditing, or Continuous Improvement.