mcpField
P
procurement-security-review

procurement-security-review

github.com/sylphxaiSecurity141 installsUpdated today
Repository

About procurement-security-review

A skill for turning enterprise procurement security requests into a structured response plan. It organizes evidence, approved answers, gaps, access controls, and handoffs among sales, legal, and security teams.

Key features

  1. 01Request type classification
  2. 02Evidence and approved-answer tracking
  3. 03Gap and exception handling
  4. 04Access control and review ownership
  5. 05Response plans and checklists

Use cases

  1. 01Preparing a vendor security questionnaire response
  2. 02Organizing evidence for a DPA or subprocessor review
  3. 03Coordinating security and legal handoffs during procurement

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/sylphxai/skills --skill procurement-security-review

After installing, type/procurement-security-reviewin Claude Code to confirm it loaded.

Bundled filesagents/openai.yamlreferences/procurement-security-patterns.md

Details

From the project README

Procurement Security Review

Use this skill to convert a enterprise procurement security, vendor-risk evidence, questionnaires, DPAs, policy proof, and sales/legal/security handoff question into a concrete artifact with owners, gates, metrics, and recovery paths.

Workflow

  1. Identify buyer type, deal stage, requested evidence, data sensitivity, contract terms, compliance status, gaps, owner teams, and response deadline.
  2. Read references/procurement-security-patterns.md.
  3. Classify request as questionnaire, evidence packet, DPA, subprocessor review, insurance, compliance report, pen test summary, AI/data-use review, or redline.
  4. Define evidence source, approved answer, gap wording, exception path, access control, reviewer, expiry, and sales/legal/security handoff.
  5. Produce procurement review plan, state machine, decision table, event schema, evidence checklist, and gap-escalation policy.

When not to use

  • Do not use for generic advice the base model already handles without this skill's specific artifact contract.

Guardrails

  • Do not answer “yes” to controls that are planned, partial, customer-specific, or not evidenced.
  • Do not send SOC reports, pen tests, customer data, architecture secrets, or insurance documents without access control and approval.
  • Do not let sales invent security/compliance commitments to unblock a deal.
  • Do not lose track of redlines, exceptions, and promised remediation dates after signature.

Output format

Procurement context:
Buyer / evidence / data sensitivity / deadline:

Procurement security response plan:
| Area | Decision | Evidence | Risk | Owner |
| --- | --- | --- | --- | --- |

Evidence, answers, and gaps:
- <item> -> <policy, metric, edge case, support note>

Exception and post-signature tracking:
- <trigger> -> <action, communication, owner>

Comments

Markdown supported