feat: add Vendor Risk Assessment Agent kit. - #331
Conversation
WalkthroughChangesThe pull request adds a Lamatic-based vendor risk assessment workflow and a React dashboard. It includes evidence-based prompts, response normalization, sample data, risk presentation, recommendations, loading and error states, report export, and setup documentation. Vendor Risk Assessment Agent
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
akshatvirmani
changed the title
:robot_face: AgentKit Structural ValidationNew Contributions Detected
Check Results
|
|
hey @Rishabh150102 some changes are requested above, please check them. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 25
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/vendor-risk-assessment-agent/apps/.env.example`:
- Around line 12-15: Remove VITE_LAMATIC_PROJECT_API_KEY from the client
environment configuration and stop exposing it through the browser-side
utils.ts/App.tsx executeFlow path. Move Lamatic flow execution behind a
server-side proxy, or replace the client value with a server-issued short-lived
access token while preserving flow execution.
In `@kits/vendor-risk-assessment-agent/apps/index.html`:
- Line 6: Update the document title in the HTML head from the placeholder “My
Google AI Studio App” to “Vendor Risk Assessment Agent” so the browser tab
displays the correct application name.
In `@kits/vendor-risk-assessment-agent/apps/package.json`:
- Around line 6-24: Replace the Vite runtime in the package scripts with Next.js
commands: use next dev, next build, and next start, while retaining clean and
lint behavior as applicable. Update dependencies to next 16.0.0, react 19.2.0,
and react-dom 19.2.0. Add next.config.mjs and migrate the src/main.tsx and
index.html entry points to the Next.js application structure, preserving the
existing app behavior.
In `@kits/vendor-risk-assessment-agent/apps/README.md`:
- Around line 163-210: Update the Installation section to use the kit-relative
application directory and its existing package.json rather than cloning an
external repository or installing from the repository root; document the
appropriate application setup commands for
kits/vendor-risk-assessment-agent/apps. Replace the Project Structure tree to
match the supplied application files, including src/components, src/data,
src/types.ts, and src/utils.ts, and remove nonexistent hooks, lib, services, and
types directories.
In `@kits/vendor-risk-assessment-agent/apps/src/App.tsx`:
- Around line 118-125: Update the input-change handling in App around
VendorInputSection so every vendor document edit clears assessmentData before or
while updating inputText. Replace the direct setInputText prop with a handler
that performs both updates, preserving the existing onAnalyze and other section
behavior so stale results are no longer displayed or exportable after input
changes.
In `@kits/vendor-risk-assessment-agent/apps/src/components/ExportModal.tsx`:
- Around line 148-151: Update the export-format label in ExportModal so it
advertises only plaintext support, matching the text/plain Blob created by the
download handler; remove the PDF wording from the span next to the Share2 icon.
- Around line 96-100: Update handleCopy to be async and await
navigator.clipboard.writeText(textSummary) before setting copied. Handle
rejected writes with the component’s existing error-state mechanism, ensuring
copied remains false when the clipboard operation fails.
- Around line 112-183: Update the export modal container around the visible
Export Assessment Summary content to provide dialog semantics with an accessible
name and aria-modal="true", move initial keyboard focus into the modal when it
opens, trap focus within it, restore focus to the previously focused element on
close, and close it on Escape while preserving the existing onClose behavior.
- Line 114: Update the modal container in ExportModal so its entrance animation
classes are backed by defined utilities: either configure the Tailwind animation
plugin and required fade/zoom utilities in the project styling setup, or remove
animate-in, fade-in, and zoom-in while preserving the modal’s existing layout
and behavior.
In `@kits/vendor-risk-assessment-agent/apps/src/components/RiskScoreHeroCard.tsx`:
- Around line 32-80: Define one shared numeric risk-band helper in
RiskScoreHeroCard.tsx and use it to classify scores consistently, including
31–35 as Moderate and scores above 85 as Critical. Update RiskScoreHeroCard.tsx
lines 151-158 to render scale labels from that helper, and update
RiskAssessmentCard.tsx lines 105-109 to derive progress-bar colors from the same
bands.
In `@kits/vendor-risk-assessment-agent/apps/src/components/VendorInfoCard.tsx`:
- Around line 104-113: Update VendorInfoCard’s descriptive text and
control-status labels to avoid claiming verification or implementation when the
response contract only provides extracted data. Replace “Verified corporate
profile,” “Data Verified,” and “Implemented” with neutral labels such as
“Extracted data” and “Reported control”; do not add verification claims without
explicit evidence and status fields in the workflow contract.
In
`@kits/vendor-risk-assessment-agent/apps/src/components/VendorInputSection.tsx`:
- Around line 29-34: Associate the primary vendor-document textarea with a
visible accessible name by assigning a unique id to the heading and referencing
it via the textarea’s aria-labelledby attribute, or by adding a visible label
tied to the existing textarea id. Update the corresponding textarea section as
well as the repeated location noted in the comment, preserving the current
visual content.
In `@kits/vendor-risk-assessment-agent/apps/src/utils.ts`:
- Around line 13-17: Remove the client-side Lamatic initialization from
lamaticClient and stop exposing VITE_LAMATIC_PROJECT_API_KEY in the browser
bundle. Move Lamatic construction and executeFlow requests behind an
authenticated server-side endpoint, passing only the user request and
server-validated context from the client; use a browser token only if Lamatic
explicitly supports a public, scoped, origin-restricted token.
In `@kits/vendor-risk-assessment-agent/flows/vendor-risk-assessment-agent-v2.ts`:
- Around line 188-195: Update the outputMapping for the API Response node so
vendor_information, riskAssessment, and recommendations interpolate the
generated responses as JSON objects rather than quoted strings. Remove the
surrounding quotes from the three LLMNode generatedResponse mappings while
preserving the existing keys and node references.
- Around line 75-79: Define the sampleInput contract across the trigger schema,
application payload, extractor prompt, and agent.md: either document the
required combined format for all three document types or add separate schema
fields and map them into the prompt. Keep the field names and mappings
consistent through the API Request configuration and extraction flow.
In `@kits/vendor-risk-assessment-agent/lamatic.config.ts`:
- Around line 7-10: Update the author metadata in the config’s author block to
use an approved project contact alias instead of rishabhrajput150102@gmail.com,
or omit the email field when no alias is required; keep the existing author name
unless repository policy specifies otherwise.
In
`@kits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-122_system_0.md`:
- Around line 31-46: Update the “Compliance Recommendation Rules”
preferred-wording examples to use neutral placeholders or explicitly condition
each framework example on that framework being named in the supplied risk
assessment; do not present HIPAA, PCI DSS, or GDPR as unconditional
recommendations. Preserve the existing prohibition against recommending absent
certifications or frameworks.
In
`@kits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-122_user_1.md`:
- Around line 10-18: Update the prompt’s priority_actions schema and guidance to
use an empty priority placeholder and explicitly define the ordering Critical >
High > Moderate. In the parser or rendering flow around the extracted
recommendation objects, validate that priority values are limited to Critical,
High, or Moderate and normalize or reject invalid values before rendering.
In
`@kits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-538_user_1.md`:
- Around line 4-30: Extend the JSON schema in the vendor risk assessment prompt
with an evidence-backed context block containing industry, business_context,
processes_phi, payment_processing, and jurisdiction, then update the
corresponding application type and parser contract to expose and validate these
fields consistently. Preserve the existing fields and require context values to
be grounded in the source evidence.
- Line 3: Apply an explicit untrusted-data boundary at all three prompt
interpolation sites: in
kits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-538_user_1.md:3-3,
delimit triggerNode_1.output.sampleInput and validate the extraction schema; in
kits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-644_user_1.md:3-3,
delimit LLMNode_538.output.generatedResponse and instruct the model to ignore
instructions within field values before scoring; and in
kits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-122_user_1.md:3-3,
delimit LLMNode_644.output.generatedResponse and ignore instructions within
assessment values before generating recommendations.
- Around line 29-35: Update the missing-value rule in the vendor risk assessment
prompt to use [] for array fields (certifications, other, and
missing_information), preserve object fields (security_controls, compliance, and
operational_information) as objects with "Not Provided" scalar members, and
reserve "Not Provided" for scalar fields so parseLamaticResponse receives
schema-compatible values.
In
`@kits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-644_system_0.md`:
- Around line 82-87: Update the general-enterprise framework guidance and the
unknown-industry vendor recommendations so SOC 2, ISO 27001, GDPR, and CCPA are
included only when explicitly supported by applicability evidence. Require
evidence for each framework independently, including relevant jurisdiction or
data-processing context for GDPR and CCPA, and remove any unconditional listing
that overrides this rule.
In
`@kits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-644_user_1.md`:
- Around line 10-27: Update the JSON schema example to use valid 1–5 score
values instead of 0, and enforce validation in parseLamaticResponse so responses
contain exactly five categories, integer category scores within 1–5, and an
overall_risk_score equal to their average before forwarding the result.
In `@kits/vendor-risk-assessment-agent/README.md`:
- Around line 5-9: Align the documented model provider with the Lamatic
configuration: in kits/vendor-risk-assessment-agent/README.md lines 5-9, verify
and update the OpenAI badge/claims to match the configured provider; in
kits/vendor-risk-assessment-agent/apps/.env.example lines 1-9, remove Gemini and
AI Studio variables unless the application’s Lamatic setup actually uses that
integration.
- Around line 306-308: The licensing statements must use one verified license
contract consistent with the repository’s actual license. Update the AgentKit
licensing statement in kits/vendor-risk-assessment-agent/README.md (lines
306-308) and replace the MIT statement in
kits/vendor-risk-assessment-agent/apps/README.md (lines 277-279) unless the
repository license confirms MIT.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 54c2de01-9ea6-4966-bf63-53c23186d7b1
⛔ Files ignored due to path filters (5)
kits/vendor-risk-assessment-agent/apps/bun.lockis excluded by!**/*.lockkits/vendor-risk-assessment-agent/apps/screenshot/1-home.pngis excluded by!**/*.pngkits/vendor-risk-assessment-agent/apps/screenshot/2-vendor.pngis excluded by!**/*.pngkits/vendor-risk-assessment-agent/apps/screenshot/3-risk.pngis excluded by!**/*.pngkits/vendor-risk-assessment-agent/apps/screenshot/4-recomm.pngis excluded by!**/*.png
📒 Files selected for processing (38)
kits/vendor-risk-assessment-agent/.gitignorekits/vendor-risk-assessment-agent/README.mdkits/vendor-risk-assessment-agent/agent.mdkits/vendor-risk-assessment-agent/apps/.env.examplekits/vendor-risk-assessment-agent/apps/.gitignorekits/vendor-risk-assessment-agent/apps/README.mdkits/vendor-risk-assessment-agent/apps/index.htmlkits/vendor-risk-assessment-agent/apps/package.jsonkits/vendor-risk-assessment-agent/apps/src/App.tsxkits/vendor-risk-assessment-agent/apps/src/components/EmptyStateCard.tsxkits/vendor-risk-assessment-agent/apps/src/components/ExportModal.tsxkits/vendor-risk-assessment-agent/apps/src/components/Header.tsxkits/vendor-risk-assessment-agent/apps/src/components/RecommendationsCard.tsxkits/vendor-risk-assessment-agent/apps/src/components/RiskAssessmentCard.tsxkits/vendor-risk-assessment-agent/apps/src/components/RiskScoreHeroCard.tsxkits/vendor-risk-assessment-agent/apps/src/components/SkeletonLoader.tsxkits/vendor-risk-assessment-agent/apps/src/components/VendorInfoCard.tsxkits/vendor-risk-assessment-agent/apps/src/components/VendorInputSection.tsxkits/vendor-risk-assessment-agent/apps/src/data/sampleData.tskits/vendor-risk-assessment-agent/apps/src/index.csskits/vendor-risk-assessment-agent/apps/src/main.tsxkits/vendor-risk-assessment-agent/apps/src/types.tskits/vendor-risk-assessment-agent/apps/src/utils.tskits/vendor-risk-assessment-agent/apps/src/vite-env.d.tskits/vendor-risk-assessment-agent/apps/tsconfig.jsonkits/vendor-risk-assessment-agent/apps/vite.config.tskits/vendor-risk-assessment-agent/constitutions/default.mdkits/vendor-risk-assessment-agent/flows/vendor-risk-assessment-agent-v2.tskits/vendor-risk-assessment-agent/lamatic.config.tskits/vendor-risk-assessment-agent/model-configs/vendor-risk-assessment-agent-v2_llmnode-122_generative-model-name.tskits/vendor-risk-assessment-agent/model-configs/vendor-risk-assessment-agent-v2_llmnode-538_generative-model-name.tskits/vendor-risk-assessment-agent/model-configs/vendor-risk-assessment-agent-v2_llmnode-644_generative-model-name.tskits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-122_system_0.mdkits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-122_user_1.mdkits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-538_system_0.mdkits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-538_user_1.mdkits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-644_system_0.mdkits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-644_user_1.md
| VITE_LAMATIC_PROJECT_ENDPOINT="https://your-project.lamatic.ai" | ||
| VITE_LAMATIC_PROJECT_ID="your-project-id" | ||
| VITE_LAMATIC_PROJECT_API_KEY="your-api-key" | ||
| VITE_LAMATIC_FLOW_ID="your-flow-id" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C4 'VITE_LAMATIC_PROJECT_API_KEY|apiKey|executeFlow|lamaticClient|proxy' \
kits/vendor-risk-assessment-agent/appsRepository: Lamatic/AgentKit
Length of output: 17031
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- app files ---'
git ls-files 'kits/vendor-risk-assessment-agent/apps/*' \
| sed -n '1,120p'
printf '%s\n' '--- package metadata ---'
cat -n kits/vendor-risk-assessment-agent/apps/package.json
printf '%s\n' '--- client initialization and flow call ---'
sed -n '1,90p' kits/vendor-risk-assessment-agent/apps/src/utils.ts
sed -n '35,85p' kits/vendor-risk-assessment-agent/apps/src/App.tsx
printf '%s\n' '--- local Lamatic references ---'
rg -n -i -C3 'lamatic|project.?api.?key|api.?key|publishable|browser|server.?side|secret|executeFlow|proxy' \
kits/vendor-risk-assessment-agent/apps \
--glob '!bun.lock' \
--glob '!README.md' || true
printf '%s\n' '--- dependency and lockfile records ---'
rg -n -C5 '"(`@lamatic`|lamatic)' \
kits/vendor-risk-assessment-agent/apps/package.json \
kits/vendor-risk-assessment-agent/apps/bun.lock \
kits/vendor-risk-assessment-agent/apps/package-lock.json \
kits/vendor-risk-assessment-agent/apps/yarn.lock \
kits/vendor-risk-assessment-agent/apps/pnpm-lock.yaml 2>/dev/null || trueRepository: Lamatic/AgentKit
Length of output: 21948
🌐 Web query:
Lamatic AI JavaScript SDK project API key browser publishable secret executeFlow VITE
💡 Result:
To interact with the Lamatic AI platform using the JavaScript SDK in a frontend environment like Vite, you should follow standard security practices by avoiding hardcoding your API key directly in client-side code [1]. The Lamatic AI SDK allows initialization using either an API key or an access token [2][3]. For secure frontend applications, the recommended approach is to have a backend server handle the authentication and interact with the Lamatic API, or use a temporary access token generated by your server [2]. Key concepts and implementation steps for using executeFlow in a frontend environment: 1. Security Warning: Do not hardcode your project API key directly into your frontend code (e.g., inside Vite components). Exposing your API key can allow unauthorized access to your project [1]. 2. Secure Architecture: The official documentation suggests that for sensitive operations, your frontend should request a temporary access token from your own backend server [2]. Your backend server, which has access to the secret key, can generate this token [2]. 3. Initialization: Once you have a secure way to obtain credentials (such as an access token), you can initialize the Lamatic client [2][3]: const lamatic = new Lamatic({ endpoint: "your-endpoint", projectId: "your-project-id", accessToken: "your-access-token" // Use access token instead of raw API key for frontend }); 4. Executing Flows: You can then use the executeFlow method [2][3]: const response = await lamatic.executeFlow("your-flow-id", { key: "value" // Your payload }); 5. Vite Environment Variables: If you are using Vite, you can use.env files to manage configuration variables (prefixed with VITE_ to be accessible in the client), but ensure that you do not place sensitive API keys there if they are meant to remain secret [4][5]. Use environment variables only for non-sensitive configuration, such as your endpoint URL or project ID [4][5]. For full implementation details, refer to the official Lamatic AI SDK documentation [2][3].
Citations:
- 1: https://lamatic.ai/docs/api-integration/integration-guide
- 2: https://lamatic.ai/docs/api-integration/sdk
- 3: https://github.com/Lamatic/lamatic-sdk
- 4: https://lamatic.ai/docs/api-integration/sdk/react
- 5: https://lamatic.ai/docs/api-integration/sdk/next
🌐 Web query:
site:lamatic.ai/docs/api-integration/sdk apiKey accessToken frontend project API key Lamatic
💡 Result:
In Lamatic.ai projects, you can authenticate using either an API key or an access token, but you must not use both simultaneously [1]. Key considerations for choosing between them in a frontend project include: 1. API Keys: These are generally static credentials. They are often used in server-side contexts or controlled environments. If used in a frontend (client-side) project, be aware that embedding them directly in client-side code exposes them to anyone who inspects your source code [2][3]. It is common practice to manage them via environment variables (e.g., in.env.local) to avoid hardcoding, though this still exposes the key to the client's browser in a frontend bundle [2][3]. 2. Access Tokens: These are typically short-lived (often JWTs) and provide a more secure mechanism for authentication, especially when you need to rotate or update credentials at runtime [1][4]. The Lamatic SDK provides a specific method, updateAccessToken, which allows you to update the token during the application lifecycle without re-instantiating the client [1][4]. This is particularly useful for frontend applications that need to refresh authentication sessions dynamically. For a frontend project, evaluate the security requirements: if you need to handle user-specific sessions or rotate credentials frequently, an access token is the preferred approach [1][4]. If you are building a simple prototype or a private internal tool, an API key may suffice, provided you understand the security implications of exposing it on the client side [2][3].
Citations:
- 1: https://lamatic.ai/docs/api-integration/sdk
- 2: https://lamatic.ai/docs/api-integration/sdk/react
- 3: https://lamatic.ai/docs/api-integration/sdk/next
- 4: https://lamatic.ai/docs/api-integration/sdk/go
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- npm package metadata ---'
curl -fsSL 'https://registry.npmjs.org/lamatic/0.3.2' \
| jq '{name,version,description,repository,homepage,dist}'
printf '%s\n' '--- official SDK source references ---'
curl -fsSL 'https://api.github.com/repos/Lamatic/lamatic-sdk/contents' \
| jq -r '.[].name' \
| sed -n '1,100p'
printf '%s\n' '--- SDK documentation credential references ---'
for url in \
'https://raw.githubusercontent.com/Lamatic/lamatic-sdk/main/README.md' \
'https://raw.githubusercontent.com/Lamatic/lamatic-sdk/master/README.md'
do
if content=$(curl -fsSL "$url"); then
printf '%s\n' "$content" | rg -n -i -C4 'apiKey|accessToken|executeFlow|frontend|browser|secret' || true
fi
doneRepository: Lamatic/AgentKit
Length of output: 960
Keep VITE_LAMATIC_PROJECT_API_KEY out of the browser bundle.
utils.ts passes this VITE_* value to Lamatic, and App.tsx calls executeFlow in browser code. A deployed app exposes the static project API key and allows reuse. Move flow execution behind a server-side proxy, or use a server-issued short-lived access token. Remove the project API key from VITE_*.
🧰 Tools
🪛 dotenv-linter (4.0.0)
[warning] 12-12: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 13-13: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 14-14: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 14-14: [UnorderedKey] The VITE_LAMATIC_PROJECT_API_KEY key should go before the VITE_LAMATIC_PROJECT_ENDPOINT key
(UnorderedKey)
[warning] 15-15: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 15-15: [UnorderedKey] The VITE_LAMATIC_FLOW_ID key should go before the VITE_LAMATIC_PROJECT_API_KEY key
(UnorderedKey)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@kits/vendor-risk-assessment-agent/apps/.env.example` around lines 12 - 15,
Remove VITE_LAMATIC_PROJECT_API_KEY from the client environment configuration
and stop exposing it through the browser-side utils.ts/App.tsx executeFlow path.
Move Lamatic flow execution behind a server-side proxy, or replace the client
value with a server-issued short-lived access token while preserving flow
execution.
| <head> | ||
| <meta charset="UTF-8" /> | ||
| <meta name="viewport" content="width=device-width, initial-scale=1.0" /> | ||
| <title>My Google AI Studio App</title> |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Mission item: replace the placeholder document title.
The browser tab shows My Google AI Studio App. Set the title to Vendor Risk Assessment Agent.
Proposed fix
- <title>My Google AI Studio App</title>
+ <title>Vendor Risk Assessment Agent</title>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| <title>My Google AI Studio App</title> | |
| <title>Vendor Risk Assessment Agent</title> |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@kits/vendor-risk-assessment-agent/apps/index.html` at line 6, Update the
document title in the HTML head from the placeholder “My Google AI Studio App”
to “Vendor Risk Assessment Agent” so the browser tab displays the correct
application name.
| "scripts": { | ||
| "dev": "vite --port=3000 --host=0.0.0.0", | ||
| "build": "vite build", | ||
| "preview": "vite preview", | ||
| "clean": "rm -rf dist server.js", | ||
| "lint": "tsc --noEmit" | ||
| }, | ||
| "dependencies": { | ||
| "@google/genai": "^2.4.0", | ||
| "@tailwindcss/vite": "^4.1.14", | ||
| "@vitejs/plugin-react": "^5.0.4", | ||
| "dotenv": "^17.2.3", | ||
| "express": "^4.21.2", | ||
| "lamatic": "^0.3.2", | ||
| "lucide-react": "^0.546.0", | ||
| "motion": "^12.23.24", | ||
| "react": "^19.0.1", | ||
| "react-dom": "^19.0.1", | ||
| "vite": "^6.2.3" |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Do not execute project code. Inspect the application runtime configuration.
set -euo pipefail
APP="kits/vendor-risk-assessment-agent/apps"
sed -n '1,180p' "$APP/package.json"
printf '\nNext configuration files:\n'
fd -a '^next\.config\.(js|mjs|ts)$' "$APP" || true
printf '\nVite configuration files:\n'
fd -a '^vite\.config\.(js|mjs|ts)$' "$APP" || trueRepository: Lamatic/AgentKit
Length of output: 1151
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' 'Relevant kit manifests:'
git ls-files 'kits/*/apps/package.json' | head -80 | while IFS= read -r file; do
printf '\n--- %s ---\n' "$file"
sed -n '1,100p' "$file"
done
printf '\nRepository guidance references:\n'
rg -n --glob '!node_modules' --glob '!dist' --glob '!build' \
'(Next\.js|nextjs|next|React 19|React 18|React 19\.2|16\.0\.0|14-15)' \
README.md CONTRIBUTING.md docs kits package.json 2>/dev/null | head -240Repository: Lamatic/AgentKit
Length of output: 50373
🏁 Script executed:
#!/bin/bash
set -euo pipefail
APP="kits/vendor-risk-assessment-agent/apps"
printf '%s\n' 'Target kit files:'
git ls-files "$APP" | sed -n '1,160p'
printf '\nRequired configuration files:\n'
for file in "$APP/package.json" "$APP/next.config.mjs" "$APP/tsconfig.json" "$APP/.env.example" "$APP/vite.config.ts"; do
if [ -f "$file" ]; then
printf '\n--- %s ---\n' "$file"
sed -n '1,180p' "$file"
else
printf '%s: MISSING\n' "$file"
fi
done
printf '\nApplication entry-point candidates:\n'
git ls-files "$APP" | rg '(^|/)(src/)?(app|pages|main|index|server|App|layout|page|route)' | head -100Repository: Lamatic/AgentKit
Length of output: 6692
Mission: migrate this kit to Next.js. Replace the Vite runtime with next dev, next build, and next start. Use next: "16.0.0", react: "19.2.0", and react-dom: "19.2.0". Add next.config.mjs and convert the src/main.tsx / index.html entry point to Next.js.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@kits/vendor-risk-assessment-agent/apps/package.json` around lines 6 - 24,
Replace the Vite runtime in the package scripts with Next.js commands: use next
dev, next build, and next start, while retaining clean and lint behavior as
applicable. Update dependencies to next 16.0.0, react 19.2.0, and react-dom
19.2.0. Add next.config.mjs and migrate the src/main.tsx and index.html entry
points to the Next.js application structure, preserving the existing app
behavior.
Sources: Coding guidelines, Learnings
| ## ⚙️ Installation | ||
|
|
||
| ```bash | ||
| git clone https://github.com/Rishabh150102/vendor-risk-assessment-agent.git | ||
|
|
||
| cd vendor-risk-assessment-agent | ||
|
|
||
| npm install | ||
|
|
||
| npm run dev | ||
| ``` | ||
|
|
||
| --- | ||
|
|
||
| ## 🔑 Environment Variables | ||
|
|
||
| Create a `.env` file in the project root. | ||
|
|
||
| ```env | ||
| VITE_LAMATIC_PROJECT_ENDPOINT= | ||
|
|
||
| VITE_LAMATIC_PROJECT_ID= | ||
|
|
||
| VITE_LAMATIC_PROJECT_API_KEY= | ||
|
|
||
| VITE_LAMATIC_FLOW_ID= | ||
| ``` | ||
|
|
||
| --- | ||
|
|
||
| ## 📂 Project Structure | ||
|
|
||
| ``` | ||
| src/ | ||
| ├── components/ | ||
| ├── hooks/ | ||
| ├── lib/ | ||
| ├── services/ | ||
| ├── types/ | ||
| ├── App.tsx | ||
| └── main.tsx | ||
|
|
||
| public/ | ||
|
|
||
| package.json | ||
|
|
||
| vite.config.ts | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Use the kit-relative setup path and the actual application tree.
This README is checked in under kits/vendor-risk-assessment-agent/apps, but its commands clone a separate repository and run npm install at repository root. The kit README places package.json under kits/vendor-risk-assessment-agent/apps. The documented tree also lists src/hooks, src/lib, src/services, and src/types, while the supplied application files use src/components, src/data, src/types.ts, and src/utils.ts. Update the commands and tree before release so users can install and locate the application.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 195-195: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@kits/vendor-risk-assessment-agent/apps/README.md` around lines 163 - 210,
Update the Installation section to use the kit-relative application directory
and its existing package.json rather than cloning an external repository or
installing from the repository root; document the appropriate application setup
commands for kits/vendor-risk-assessment-agent/apps. Replace the Project
Structure tree to match the supplied application files, including
src/components, src/data, src/types.ts, and src/utils.ts, and remove nonexistent
hooks, lib, services, and types directories.
| <VendorInputSection | ||
| inputText={inputText} | ||
| setInputText={setInputText} | ||
| onAnalyze={handleAnalyze} | ||
| isAnalyzing={isAnalyzing} | ||
| onLoadPreset={handleLoadPreset} | ||
| onClearText={() => setInputText('')} | ||
| /> |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Mission directive: Invalidate results when vendor input changes.
Line 120 passes setInputText directly. A user can edit the vendor document while the completed assessment remains visible and exportable. If the next analysis fails, the UI shows the prior vendor assessment with the new vendor input.
Clear assessmentData when the document changes, or bind results to an input version and mark stale results.
Proposed fix
+ const handleInputTextChange = (text: string) => {
+ setInputText(text);
+ setAssessmentData(null);
+ setError(null);
+ };
+
<VendorInputSection
inputText={inputText}
- setInputText={setInputText}
+ setInputText={handleInputTextChange}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| <VendorInputSection | |
| inputText={inputText} | |
| setInputText={setInputText} | |
| onAnalyze={handleAnalyze} | |
| isAnalyzing={isAnalyzing} | |
| onLoadPreset={handleLoadPreset} | |
| onClearText={() => setInputText('')} | |
| /> | |
| const handleInputTextChange = (text: string) => { | |
| setInputText(text); | |
| setAssessmentData(null); | |
| setError(null); | |
| }; | |
| <VendorInputSection | |
| inputText={inputText} | |
| setInputText={handleInputTextChange} | |
| onAnalyze={handleAnalyze} | |
| isAnalyzing={isAnalyzing} | |
| onLoadPreset={handleLoadPreset} | |
| onClearText={() => setInputText('')} | |
| /> |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@kits/vendor-risk-assessment-agent/apps/src/App.tsx` around lines 118 - 125,
Update the input-change handling in App around VendorInputSection so every
vendor document edit clears assessmentData before or while updating inputText.
Replace the direct setInputText prop with a handler that performs both updates,
preserving the existing onAnalyze and other section behavior so stale results
are no longer displayed or exportable after input changes.
| "missing_information": [] | ||
| } | ||
| Rules: | ||
| - Do not calculate risk. | ||
| - Do not generate recommendations. | ||
| - Do not explain your reasoning. | ||
| - If a field is unavailable, return "Not Provided". |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Keep missing-value defaults compatible with the JSON schema.
Line 35 applies "Not Provided" to every field, including arrays and objects. The schema declares certifications, other, and missing_information as arrays. It declares security_controls, compliance, and operational_information as objects. parseLamaticResponse in kits/vendor-risk-assessment-agent/apps/src/utils.ts forwards these values without coercion. A missing collection or object can therefore reach the dashboard as a string and violate the response contract.
Use [] for arrays, preserve object shape with "Not Provided" scalar members, and reserve the sentinel for scalar fields.
Proposed prompt contract
- If a field is unavailable, return "Not Provided".
+ For scalar fields, return "Not Provided".
+ For array fields, return [].
+ For object fields, preserve the object keys and use "Not Provided" for unavailable scalar members.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "missing_information": [] | |
| } | |
| Rules: | |
| - Do not calculate risk. | |
| - Do not generate recommendations. | |
| - Do not explain your reasoning. | |
| - If a field is unavailable, return "Not Provided". | |
| "missing_information": [] | |
| } | |
| Rules: | |
| - Do not calculate risk. | |
| - Do not generate recommendations. | |
| - Do not explain your reasoning. | |
| - For scalar fields, return "Not Provided". | |
| - For array fields, return []. | |
| - For object fields, preserve the object keys and use "Not Provided" for unavailable scalar members. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@kits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-538_user_1.md`
around lines 29 - 35, Update the missing-value rule in the vendor risk
assessment prompt to use [] for array fields (certifications, other, and
missing_information), preserve object fields (security_controls, compliance, and
operational_information) as objects with "Not Provided" scalar members, and
reserve "Not Provided" for scalar fields so parseLamaticResponse receives
schema-compatible values.
| General Enterprise Vendors | ||
| Relevant only if explicitly mentioned: | ||
| - GDPR | ||
| - SOC 2 | ||
| - ISO 27001 | ||
| - CCPA |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Resolve the compliance applicability override.
Lines 82-87 restrict general-enterprise frameworks to explicit relevance. Lines 196-202 then list SOC 2, ISO 27001, GDPR, and CCPA as applicable to unknown-industry vendors. GDPR and CCPA are not universally applicable. This override can raise risk without evidence and can cause unsupported recommendations. Require explicit applicability evidence for each framework, including jurisdiction or processing context where relevant.
Also applies to: 196-202
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@kits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-644_system_0.md`
around lines 82 - 87, Update the general-enterprise framework guidance and the
unknown-industry vendor recommendations so SOC 2, ISO 27001, GDPR, and CCPA are
included only when explicitly supported by applicability evidence. Require
evidence for each framework independently, including relevant jurisdiction or
data-processing context for GDPR and CCPA, and remove any unconditional listing
that overrides this rule.
| For each category provide: | ||
| - risk | ||
| - score (1–5) | ||
| - reason | ||
| - evidence | ||
| Calculate the average category score and return it as overall_risk_score. | ||
| Determine the overall_risk using the scoring rules defined in the system prompt. | ||
| Return ONLY valid JSON using this schema: | ||
| { | ||
| "overall_risk_score": 0, | ||
| "overall_risk": "", | ||
| "categories": [ | ||
| { | ||
| "name": "Security Risk", | ||
| "risk": "", | ||
| "score": 0, | ||
| "reason": "", | ||
| "evidence": "" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Mission control: enforce the 1–5 score contract.
The prompt requires scores from 1 to 5, but the schema uses 0 for overall_risk_score and every category score. This is an invalid example that can be copied into the response. The supplied parseLamaticResponse path forwards the overall score without range validation. Use structured output validation or reject results unless there are exactly five categories, integer category scores from 1 to 5, and an overall score equal to their average.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@kits/vendor-risk-assessment-agent/prompts/vendor-risk-assessment-agent-v2_llmnode-644_user_1.md`
around lines 10 - 27, Update the JSON schema example to use valid 1–5 score
values instead of 0, and enforce validation in parseLamaticResponse so responses
contain exactly five categories, integer category scores within 1–5, and an
overall_risk_score equal to their average before forwarding the result.
|  | ||
|  | ||
|  | ||
|  | ||
|  |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use one model-provider contract in documentation and environment examples.
kits/vendor-risk-assessment-agent/README.md#L5-L9: Replace or confirm the OpenAI claims after checking the Lamatic model configuration.kits/vendor-risk-assessment-agent/apps/.env.example#L1-L9: Remove the Gemini and AI Studio variables unless this application actually uses that integration.
📍 Affects 2 files
kits/vendor-risk-assessment-agent/README.md#L5-L9(this comment)kits/vendor-risk-assessment-agent/apps/.env.example#L1-L9
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@kits/vendor-risk-assessment-agent/README.md` around lines 5 - 9, Align the
documented model provider with the Lamatic configuration: in
kits/vendor-risk-assessment-agent/README.md lines 5-9, verify and update the
OpenAI badge/claims to match the configured provider; in
kits/vendor-risk-assessment-agent/apps/.env.example lines 1-9, remove Gemini and
AI Studio variables unless the application’s Lamatic setup actually uses that
integration.
| # 📄 License | ||
|
|
||
| This project is submitted as part of the Lamatic AgentKit contribution and follows the licensing terms of the AgentKit repository. No newline at end of file |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Publish one verified license contract.
kits/vendor-risk-assessment-agent/README.md#L306-L308: Align the AgentKit licensing statement with the repository’s actual license.kits/vendor-risk-assessment-agent/apps/README.md#L277-L279: Replace the MIT statement unless the repository license confirms MIT.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 308-308: Files should end with a single newline character
(MD047, single-trailing-newline)
📍 Affects 2 files
kits/vendor-risk-assessment-agent/README.md#L306-L308(this comment)kits/vendor-risk-assessment-agent/apps/README.md#L277-L279
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@kits/vendor-risk-assessment-agent/README.md` around lines 306 - 308, The
licensing statements must use one verified license contract consistent with the
repository’s actual license. Update the AgentKit licensing statement in
kits/vendor-risk-assessment-agent/README.md (lines 306-308) and replace the MIT
statement in kits/vendor-risk-assessment-agent/apps/README.md (lines 277-279)
unless the repository license confirms MIT.
2 participants
Summary
This PR adds a new AgentKit: Vendor Risk Assessment Agent.
The kit automates enterprise third-party vendor due diligence using a multi-agent workflow built with Lamatic.
Features
Tech Stack
Includes
gpt-4o-minimodel configurations.