AI Blocks › Check contracts and rules
Vendor risk reviewer
Give it a vendor and what they handle. Get a risk tier, tailored questions and a review of their SOC 2 report.
Vendor risk reviewer is a free AI skill for the job "Check contracts and rules". Give the instructions to an AI assistant that supports the required files and tools, then review its output.
Free · No account · MIT licence · Made by Hemant Naik
Made by Hemant Naik. See the original on GitHub; we copied it as it is, with its licence.
What it does
A decision on how closely to watch a vendor, the questions to ask them, and a read of their security report that spots what the cover page hides. First, the skill sorts the vendor into a risk tier based on what data and systems they touch. It then writes a questionnaire to match, aligned to the rules that apply to you, such as ISO 27001, SOC 2, DORA, NIS2 or HIPAA. When the vendor sends a SOC 2 Type II report, it reads it for exceptions, carved-out services, controls you must run yourself and gaps in dates that need a bridge letter. It also reviews data processing terms and the vendor's own suppliers.
You give it
- The vendor and what they do for you
- The kind of data they will handle
- Their SOC 2 report or questionnaire answers (optional)
- Rules you must follow (optional)
You get
- A risk tier with reasons
- A tailored question list
- A SOC 2 review with issues and next steps
- A review schedule
Use it when
- A team wants to buy a tool that will hold customer data.
- A vendor sent a SOC 2 report and nobody has time to read 80 pages.
- An auditor asks how you rank and monitor your suppliers.
- You must prove you checked a vendor under EU rules.
How to use it
- Add it to your AI once: download it and add the folder to Claude, ChatGPT or Codex as a skill.
- Ask for the job in your own words. Your AI opens the skill when it fits.