The best solution are usualy the simpler ones:
Have the vendor use a different id than root.
if not possible use ssh key as mentioned by geekosaur.
you can even restrict that key usage to the specific script that need to be run

-Laurent