Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/WARROOM-CEO/COREnpx agentmods add skills/warroom-ceo/core/vendor-checkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/warroom-ceo/core/vendor-check)<a href="https://agentmods.dev/skills/warroom-ceo/core/vendor-check"><img src="https://agentmods.dev/badge/skills/warroom-ceo/core/vendor-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/warroom-ceo/core/vendor-check"><img src="https://agentmods.dev/badge/skills/warroom-ceo/core/vendor-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00104 | $0.01350 |
| Opus 5.5 | $0.00042 | $0.00540 |
| Sonnet 5.5 | $0.00021 | $0.00270 |
| Haiku 4.5 | $0.00010 | $0.00135 |
Grade A, and why
vendor-check-th scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Language: All user-facing output — responses, summaries, and any text the user will read — must be written in Thai (ภาษาไทย). Internal logic, file paths, code snippets, and technical values remain in English.
/vendor-check -- Vendor Agreement-th Status-th
If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.
Check the status of existing agreements with a vendor across all connected systems. Provides a consolidated view of the legal relationship.
Important: This command assists with legal workflows but does not provide legal advice. Agreement status reports should be verified against original documents by qualified legal professionals.
Invocation
/vendor-check [vendor name]
If no vendor name is provided, prompt the user to specify which vendor to check.
Workflow
Step 1: Identify the Vendor
Accept the vendor name from the user. Handle common variations:
- Full legal name vs. trade name (e.g., "Alphabet Inc." vs. "Google")
- Abbreviations (e.g., "AWS" vs. "Amazon Web Services")
- Parent/subsidiary relationships
Ask the user to clarify if the vendor name is ambiguous.
Step 2: Search Connected Systems
Search for the vendor across all available connected systems, in priority order:
CLM (Contract Lifecycle Management) -- If Connected
Search for all contracts involving the vendor:
- Active agreements
- Expired agreements (last 3 years)
- Agreements in negotiation or pending signature
- Amendments and addenda
CRM -- If Connected
Search for the vendor/account record:
- Account status and relationship type
- Associated opportunities or deals
- Contact information for vendor's legal/contracts team
Email -- If Connected
Search for recent relevant correspondence:
- Contract-related emails (last 6 months)
- NDA or agreement attachments
- Negotiation threads
Documents (e.g., Box, Egnyte, SharePoint) -- If Connected
Search for:
- Executed agreements
- Redlines and drafts
- Due diligence materials
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 162 lines · 104 tokens per session scan A ad79646d166a
vendor-check-th is a skill published in the GitHub repository WARROOM-CEO/CORE (30 stars, last pushed 7mo ago), licensed MIT. It adds 104 tokens to every session and 1,350 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
vendor-review
Evaluate a vendor — cost analysis, risk assessment, and recommendation. Use when reviewing a new vendor proposal, deciding whether to renew or replace a contract, comparing two vendors side-by-side, or building a TCO breakdown and negotiation points before procurement sign-off.
entity-compliance
Entity compliance tracker — initialize, report upcoming deadlines, update status, run health audit, export to CSV. Maintains a compliance-tracker.yaml built from the entity table, calculates filing deadlines by entity and jurisdiction, and surfaces what's due in the next 30/60/90 days. Use when user says "entity…
portfolio
Track the IP portfolio — registrations, renewals, maintenance fees, and use declarations. Use when checking what's renewing, adding or updating an asset, recording a maintenance filing, or auditing the register for gaps, lapses, and use-in-commerce questions. Receives handoffs from prosecution and clearance work.
launch-review
Full launch review against your framework and risk calibration. Use when the user says "review this launch", "legal review for [feature]", "can we ship this", "what are the legal issues with [product]", or references a launch tracker ticket or PRD that needs a category-by-category review memo.
client-intake
Structured intake — practice-area templates, cross-area issue spotting, conflict flags, and triage classification. Produces a formatted case summary the student analyzes and the professor reviews. Does NOT decide case acceptance. Use when starting a new client intake, running an intake interview, or writing up a new…
gap-surfacer
Reference: shared gap- and comment-tracker framework backing /regulatory-legal:gaps and /regulatory-legal:comments. Tracks open policy gaps with remediation status, ingests gaps from policy-diff, surfaces what's open and aging, routes to owners, and notifies gap owners via Slack with per-send confirmation. Loaded by…