contract-review
Analyze contracts for risks, obligations, key clauses, and generate structured risk reports with severity ratings. Use when the user requests contract review or provides relevant inputs for this workflow.
git clone --depth 1 https://github.com/seb1n/awesome-ai-agent-skills /tmp/contract-review && cp -r /tmp/contract-review/legal-and-compliance/contract-review ~/.claude/skills/contract-reviewSKILL.md
# Contract Review Analyze legal contracts to identify parties, obligations, risk areas, and problematic clauses. This skill systematically examines contract language for liability exposure, indemnification traps, unfavorable termination terms, IP assignment overreach, and non-compete restrictions. The output is a structured risk report with severity ratings and actionable recommendations. ## Workflow 1. **Receive and Parse Contract** — Ingest the full contract text or relevant excerpts. Identify the contract type (SaaS agreement, employment, freelancer, NDA, MSA, etc.) and establish the reviewing party's perspective (which side of the agreement you represent). Extract metadata such as effective date, governing law, and term length. 2. **Identify Parties and Core Terms** — Map all named parties, their roles, and the fundamental exchange of value. Extract key commercial terms including payment structure, deliverables, service levels, and performance metrics. Note any definitions section that modifies standard legal meanings. 3. **Flag High-Risk Clauses** — Perform clause-by-clause analysis targeting liability caps (or lack thereof), indemnification scope and triggers, termination rights and cure periods, IP assignment breadth, non-compete and non-solicitation restrictions, confidentiality obligations, data handling requirements, and force majeure provisions. Assign each flagged clause a severity rating: Critical, High, Medium, or Low. 4. **Summarize Obligations** — Produce a consolidated view of what each party must do, by when, and the consequences of non-performance. Highlight asymmetric obligations where one party bears disproportionate risk or burden. 5. **Generate Risk Report** — Compile findings into a structured report with an executive summary, clause-by-clause risk table, overall risk score, and prioritized list of recommended modifications or negotiation points. 6. **Suggest Modifications** — For each Critical and High severity finding, draft alternative contract language that better balances risk. Provide brief rationale for why the modification is important and what risk it mitigates. ## Usage Provide the contract text and specify which party you represent. Optionally indicate areas of particular concern. **Example prompt:** ``` Review this SaaS agreement from the customer's perspective. Flag any clauses that expose us to unlimited liability or allow the vendor to change terms unilaterally. Here is the contract: [paste contract text] ``` ## Examples ### Example 1: SaaS Agreement Review **Input:** A SaaS subscription agreement where the customer is subscribing to a project management tool. The customer is a 50-person company evaluating a 2-year enterprise commitment. Review from the customer's perspective. **Output:** **Executive Summary:** This agreement contains 2 Critical and 3 High severity issues that should be addressed before signing. The liability cap is absent for the vendor while the customer faces unlimited exposure, the IP assignment clause claims ownership of customer-created content, and termination requires 180-day notice with no cure period for the customer. Overall risk score: 7.2/10. We recommend negotiating all Critical items and at least the indemnification clause before execution. **Overall Risk Score:** 7.2 / 10 (High — do not sign without modifications) | Clause | Section | Risk | Severity | Recommendation | |--------|---------|------|----------|----------------| | Limitation of Liability | §8.2 | Vendor liability capped at fees paid in last 3 months; no cap on customer's liability | Critical | Add mutual liability cap at 12 months of fees | | IP Assignment | §5.1 | "All materials created using the Service become Vendor's property" | Critical | Narrow to feedback/suggestions only; customer retains IP in their content | | Auto-Renewal | §3.4 | Auto-renews for successive 2-year terms with 180-day cancellation notice | High | Reduce to 1-year renewal with 30-day notice | | Indemnification | §9.1 | Customer indemnifies vendor for "any and all claims" including vendor negligence | High | Limit to claims arising from customer's breach or misuse | | Data Handling | §6.3 | Vendor may use customer data for "service improvement and analytics" without anonymization requirement | High | Require anonymization/aggregation; add DPA reference | ### Example 2: Freelancer Contract Review **Input:** A freelance development contract from the hiring company's template. The freelancer is a mobile app developer being engaged for a 3-month iOS project. Review from the freelancer's perspective. **Output:** **Executive Summary:** 1 Critical and 2 High severity issues identified. The non-compete clause is overly broad and likely unenforceable in most jurisdictions, the IP assignment has a dangerous gap tied to payment, and the payment terms heavily favor the hiring company. Overall risk score: 6.8/10. **Overall Risk Score:** 6.8 / 10 (Moderate-High — negotiate before signing) **Red Flags:** - **Non-Compete (§7, Critical):** Prohibits freelancer from working in "any related field" for 24 months globally. This is almost certainly unenforceable in most jurisdictions and signals aggressive posturing. **Suggested modification:** Narrow to direct competitors, 6-month duration, reasonable geographic scope. - **IP Assignment (§4, High):** Assigns IP only upon "final payment" but doesn't define what constitutes final payment in a milestone-based project. Gap risk: disputed milestone could leave IP ownership ambiguous. **Suggested modification:** Add that IP transfers per-milestone upon each milestone payment. - **Payment Terms (§3, High):** Net-90 payment with no late payment penalties. **Suggested modification:** Net-30 with 1.5% monthly late fee. ## Best Practices - Always establish which party you represent before beginning analysis — risk assessment is perspective-dependent and a favorable clause for one party is a risk for the other. - Flag the absence of stan
Design reproducible evaluations for AI agents with representative task sets, explicit rubrics, appropriate graders, baselines, regression gates, and failure analysis. Use when defining agent quality, comparing prompts or models, validating a release, measuring tool-use reliability, investigating regressions, or deciding whether an agent is ready for production.
Design privacy-aware observability for AI agents using traces, spans, structured events, metrics, cost attribution, dashboards, alerts, and investigation workflows. Use when instrumenting an agent, debugging intermittent tool or model failures, defining service-level objectives, analyzing latency or spend, auditing agent decisions, or preparing production monitoring.
Design and verify auditable human oversight, approval gates, escalation paths, and safe state transitions for AI agent workflows. Use when deciding which agent actions require review, adding approve/reject or dual-control flows, preventing unauthorized autonomous effects, creating decision records, reducing rubber-stamping, or recovering safely from rejected, expired, or failed actions.
Design, implement, harden, and verify Model Context Protocol (MCP) servers with precise tool contracts, least-privilege authorization, safe transports, structured errors, and interoperability tests. Use when creating a new MCP server, exposing an API or data source through MCP, reviewing an MCP server design, adding or revising MCP tools, or preparing an MCP server for production.
Design and operate bounded multi-agent workflows with task decomposition, dependency graphs, ownership, handoff contracts, shared-state controls, approvals, recovery, and synthesis. Use when a task contains genuinely independent workstreams, specialized roles, parallel research or implementation, reviewer-worker loops, or coordination problems that one agent should not execute sequentially.
Design and validate model-facing tool definitions with clear names, action-oriented descriptions, bounded JSON Schema parameters, explicit side effects, safe defaults, idempotency, errors, and realistic tests. Use when creating function-calling tools, MCP tools, agent actions, structured tool inputs, or when a model selects the wrong tool, invents arguments, or causes unsafe side effects.
Plan, execute, document, and retest authorized security assessments of AI agents and multi-agent workflows using safe adversarial cases, synthetic identities, canaries, and evidence-based findings. Use when defining red-team rules of engagement, assessing prompt injection or excessive agency, testing tool and identity boundaries, evaluating memory or cross-agent attacks, scoring a campaign, or verifying remediation in an approved environment.
Threat-model and harden AI agents, RAG systems, assistants, and tool-using workflows against direct, indirect, stored, cross-agent, and multimodal prompt injection. Use when reviewing an agent architecture, isolating untrusted content, constraining tools and egress, protecting secrets, adding injection-focused tests, investigating a suspected injection incident, or documenting residual prompt-injection risk.