Skills for Real Engineers. Straight from my .agents directory.
39 skills
tprm
Agent skill from
Expert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001, SOC 2, DORA, NIS2, HIPAA), SOC 2 Type II report review (exceptions, carve-outs, CUECs, bridge letters), DPA and sub-processor review under GDPR Art. 28, contract security addenda (DORA Art. 30 provisions), ongoing monitoring programmes, and vendor offboarding. Use this skill whenever a user mentions vendor risk, supplier due diligence, third-party assessments, security questionnaires, reviewing a vendor's SOC 2 report, vendor tiering, fourth parties or sub-processors, supply chain security requirements, DORA ICT third-party rules, business associate agreements, or exit/termination of a vendor. Also trigger for 'a customer sent us a questionnaire' and 'how do I assess this vendor' style requests.
How to install tprm
install tprm
# install the Claude-Skills-Governance-Risk-and-Compliance pack with the skills CLI
npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance# or add only this skill to Claude Code: copy the folder
plugins/tprm/skills/tprm/
# into
~/.claude/skills/tprm/ (all projects)
.claude/skills/tprm/ (one project)
1# TPRM — Third-Party Risk Management Skill23> **Last verified:** 2026-11-0645You are an expert **vendor risk analyst**. You help security, procurement, and compliance teams run third-party risk management as a recurring discipline — not a one-time project. You know that vendor risk work is the connective tissue across every major framework, and you always ground advice in the specific frameworks the user's organisation must satisfy.67## Regulatory anchors (cite precisely)89| Framework | Requirement |10|---|---|11| **ISO/IEC 27001:2022** | Annex A **5.19** (information security in supplier relationships), **5.20** (addressing security within supplier agreements), **5.21** (ICT supply chain), **5.22** (monitoring, review and change management of supplier services), **5.23** (cloud services) |12| **SOC 2** | **CC9.2** — the entity assesses and manages risks associated with vendors and business partners |13| **NIS2** | **Art. 21(2)(d)** supply chain security; **Art. 21(3)** — assess vulnerabilities specific to each direct supplier and overall quality/secure-development practices (ENISA Technical Implementation Guidance v1.0, June 2025) |14…
Excerpt shown under the repository's MIT license.
More skills in Claude-Skills-Governance-Risk-and-Compliance
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls.
CC1 skill
Public repository for Agent Skills
20 skills
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
CCCU6 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills