name: legal-contract-review
description: Review contracts for risk, extract key clauses, triage NDAs, and score compliance exposure. Use when evaluating vendor agreements, reviewing customer contracts, assessing NDA terms, or performing contract due diligence.
tags: [legal, contracts, compliance, risk-analysis]
Legal Contract Review
Structured contract analysis framework for extracting key terms, scoring risk, triaging NDAs, and identifying compliance exposure. Provides repeatable, evidence-based contract review — not legal advice.
Disclaimer: This skill provides structured analysis patterns and checklists. All output should be reviewed by qualified legal counsel before making binding decisions.
Use this skill when
- Reviewing vendor, customer, or partner agreements for risk
- Triaging NDAs (mutual or unilateral) for quick risk classification
- Extracting key commercial terms into a structured summary
- Scoring compliance exposure across regulatory dimensions
- Preparing contract summaries for executive or board review
- Conducting due diligence on a portfolio of contracts
Do not use this skill when
- You need binding legal opinions (consult qualified counsel)
- Drafting new contracts from scratch (use legal templates instead)
- Reviewing highly regulated instruments (securities, insurance policies) requiring specialized expertise
- The contract is in a language you cannot fully parse
Instructions
- Identify contract type — classify as vendor, customer, partnership, NDA, employment, or licensing agreement.
- Run the 10-Point Checklist — extract each element into the Clause Extraction Template.
- Score compliance risk — apply the Compliance Risk Score across all applicable dimensions.
- Check Red Flags — scan for the 8 critical red flag patterns.
- For NDAs — apply the NDA Triage Matrix for rapid classification.
- Generate output — produce a Contract Summary Brief with risk heat map.
10-Point Contract Review Checklist
Every contract review must extract and evaluate these 10 elements:
| # |
Element |
What to Look For |
Risk Level if Missing |
| 1 |
Parties |
Legal entity names, jurisdiction of incorporation, authorized signatories |
High — wrong entity = unenforceable |
| 2 |
Term & Renewal |
Start date, end date, auto-renewal clauses, notice periods for termination |
Medium — auto-renewal traps |
| 3 |
Termination Rights |
For cause, for convenience, cure periods, termination triggers |
High — inability to exit |
| 4 |
Liability Cap |
Aggregate cap, per-incident cap, carve-outs from cap |
Critical — unlimited exposure |
| 5 |
Indemnification |
Mutual vs. one-sided, scope of indemnified claims, defense obligations |
High — asymmetric risk |
| 6 |
IP & Ownership |
IP assignment, license grants, work-for-hire provisions, background IP protections |
Critical — loss of core IP |
| 7 |
Confidentiality |
Scope, duration, permitted disclosures, return/destruction obligations |
Medium — over-broad scope |
| 8 |
Governing Law & Disputes |
Jurisdiction, arbitration vs. litigation, venue, class action waiver |
Medium — unfavorable venue |
| 9 |
Data & Privacy |
Data processing terms, DPA requirements, breach notification, data residency |
High — regulatory exposure |
| 10 |
Force Majeure |
Defined events, notice requirements, performance relief, termination rights |
Low — unless critical supply chain |
Clause Extraction Template
Use this structure to summarize any contract:
## Contract Summary
**Contract Type:** [Vendor/Customer/NDA/Partnership/Employment/License]
**Parties:** [Party A] ↔ [Party B]
**Effective Date:** [YYYY-MM-DD]
**Term:** [Duration] | **Auto-Renewal:** [Yes/No — notice period]
**Governing Law:** [Jurisdiction]
### Key Commercial Terms
| Term | Value | Notes |
|------|-------|-------|
| Contract Value | $ | Annual/total |
| Payment Terms | Net [X] days | |
| Liability Cap | $ or [X]x fees | Carve-outs: [list] |
| Termination Notice | [X] days | For convenience / for cause |
### Risk Summary
| Risk Area | Score (1-5) | Key Finding |
|-----------|-------------|-------------|
| Financial Exposure | | |
| IP Risk | | |
| Compliance Risk | | |
| Operational Risk | | |
| **Overall Risk** | **[avg]** | **[summary]** |
NDA Triage Matrix
Rapid classification for NDAs — takes 10-15 minutes per NDA:
| Dimension |
Green (Low Risk) |
Yellow (Review) |
Red (Escalate) |
| Type |
Mutual |
Unilateral (we disclose) |
Unilateral (we receive only) |
| Scope |
Clearly defined to project |
Broad but reasonable |
"All information" without limits |
| Duration |
1-3 years |
3-5 years |
Perpetual or >5 years |
| Non-compete |
None |
Narrow (specific market, <1 year) |
Broad market, >1 year |
| Residuals |
Residuals clause included |
Silent on residuals |
Explicitly excludes residuals |
| Remedies |
Mutual remedies |
Injunctive relief (standard) |
Liquidated damages or penalties |
Triage Decision:
- All Green → Sign (standard terms)
- Any Yellow → Review (negotiate specific clauses)
- Any Red → Escalate to legal counsel before signing
Compliance Risk Score (0-100)
Weighted scoring across regulatory dimensions:
| Dimension |
Weight |
Score (0-10) |
Weighted |
| Data Privacy (GDPR, CCPA, PDPA) |
25% |
|
|
| Export Controls (ITAR, EAR) |
15% |
|
|
| Anti-Bribery (FCPA, UK Bribery Act) |
15% |
|
|
| Sanctions (OFAC, EU sanctions) |
15% |
|
|
| Industry-Specific (HIPAA, PCI-DSS, SOX) |
20% |
|
|
| Employment Law (non-compete, IP assignment) |
10% |
|
|
| Total |
100% |
|
/100 |
Risk Bands:
- 0-25: Low risk — proceed with standard review
- 26-50: Moderate risk — require compliance team sign-off
- 51-75: High risk — require legal counsel review
- 76-100: Critical risk — escalate to CLO / outside counsel
Red Flag Checklist
These patterns require immediate escalation:
| # |
Red Flag |
Why It Matters |
| 1 |
Unlimited liability |
No cap on financial exposure |
| 2 |
One-sided indemnification |
Only your company bears risk |
| 3 |
Auto-renewal without notice |
Locked into unfavorable terms |
| 4 |
Broad IP assignment |
Transfers IP beyond project scope |
| 5 |
Non-compete overreach |
Restricts future business operations |
| 6 |
Unilateral amendment rights |
Counterparty can change terms without consent |
| 7 |
No termination for convenience |
Cannot exit without cause |
| 8 |
Jurisdiction in counterparty's home country |
Litigation disadvantage |
If any red flag is present, do not approve without legal counsel review.
Common Mistakes
- Confusing liability cap with indemnification — a liability cap limits total exposure; indemnification defines who pays for specific losses. Both must be reviewed independently.
- Ignoring change-of-control clauses — acquisition or merger can trigger termination or consent requirements.
- Skipping data processing addendums — GDPR/CCPA require explicit DPA terms for any contract involving personal data processing.
- Overlooking survival clauses — confidentiality, IP, and indemnification often survive termination. Check duration.
- Accepting "standard terms" — no contract is truly standard. Always review, even boilerplate.
Additional Resources
- Related skill:
stakeholder-map — for identifying contract stakeholders and approval workflows
- IACCM (World Commerce & Contracting) — contract management best practices
- Legal design patterns for technology agreements
1---2name: legal-contract-review3description: <!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->4---5<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->6---7name: legal-contract-review8description: Review contracts for risk, extract key clauses, triage NDAs, and score compliance exposure. Use when evaluating vendor agreements, reviewing customer contracts, assessing NDA terms, or performing contract due diligence.9tags: [legal, contracts, compliance, risk-analysis]10---1112# Legal Contract Review1314Structured contract analysis framework for extracting key terms, scoring risk, triaging NDAs, and identifying compliance exposure. Provides repeatable, evidence-based contract review — not legal advice.1516> **Disclaimer:** This skill provides structured analysis patterns and checklists. All output should be reviewed by qualified legal counsel before making binding decisions.1718## Use this skill when1920- Reviewing vendor, customer, or partner agreements for risk21- Triaging NDAs (mutual or unilateral) for quick risk classification22- Extracting key commercial terms into a structured summary23- Scoring compliance exposure across regulatory dimensions24- Preparing contract summaries for executive or board review25- Conducting due diligence on a portfolio of contracts2627## Do not use this skill when2829- You need binding legal opinions (consult qualified counsel)30- Drafting new contracts from scratch (use legal templates instead)31- Reviewing highly regulated instruments (securities, insurance policies) requiring specialized expertise32- The contract is in a language you cannot fully parse3334## Instructions35361. **Identify contract type** — classify as vendor, customer, partnership, NDA, employment, or licensing agreement.372. **Run the 10-Point Checklist** — extract each element into the Clause Extraction Template.383. **Score compliance risk** — apply the Compliance Risk Score across all applicable dimensions.394. **Check Red Flags** — scan for the 8 critical red flag patterns.405. **For NDAs** — apply the NDA Triage Matrix for rapid classification.416. **Generate output** — produce a Contract Summary Brief with risk heat map.4243---4445## 10-Point Contract Review Checklist4647Every contract review must extract and evaluate these 10 elements:4849| # | Element | What to Look For | Risk Level if Missing |50|---|---------|------------------|----------------------|51| 1 | **Parties** | Legal entity names, jurisdiction of incorporation, authorized signatories | High — wrong entity = unenforceable |52| 2 | **Term & Renewal** | Start date, end date, auto-renewal clauses, notice periods for termination | Medium — auto-renewal traps |53| 3 | **Termination Rights** | For cause, for convenience, cure periods, termination triggers | High — inability to exit |54| 4 | **Liability Cap** | Aggregate cap, per-incident cap, carve-outs from cap | Critical — unlimited exposure |55| 5 | **Indemnification** | Mutual vs. one-sided, scope of indemnified claims, defense obligations | High — asymmetric risk |56| 6 | **IP & Ownership** | IP assignment, license grants, work-for-hire provisions, background IP protections | Critical — loss of core IP |57| 7 | **Confidentiality** | Scope, duration, permitted disclosures, return/destruction obligations | Medium — over-broad scope |58| 8 | **Governing Law & Disputes** | Jurisdiction, arbitration vs. litigation, venue, class action waiver | Medium — unfavorable venue |59| 9 | **Data & Privacy** | Data processing terms, DPA requirements, breach notification, data residency | High — regulatory exposure |60| 10 | **Force Majeure** | Defined events, notice requirements, performance relief, termination rights | Low — unless critical supply chain |6162---6364## Clause Extraction Template6566Use this structure to summarize any contract:6768```markdown69## Contract Summary7071**Contract Type:** [Vendor/Customer/NDA/Partnership/Employment/License]72**Parties:** [Party A] ↔ [Party B]73**Effective Date:** [YYYY-MM-DD]74**Term:** [Duration] | **Auto-Renewal:** [Yes/No — notice period]75**Governing Law:** [Jurisdiction]7677### Key Commercial Terms78| Term | Value | Notes |79|------|-------|-------|80| Contract Value | $ | Annual/total |81| Payment Terms | Net [X] days | |82| Liability Cap | $ or [X]x fees | Carve-outs: [list] |83| Termination Notice | [X] days | For convenience / for cause |8485### Risk Summary86| Risk Area | Score (1-5) | Key Finding |87|-----------|-------------|-------------|88| Financial Exposure | | |89| IP Risk | | |90| Compliance Risk | | |91| Operational Risk | | |92| **Overall Risk** | **[avg]** | **[summary]** |93```9495---9697## NDA Triage Matrix9899Rapid classification for NDAs — takes 10-15 minutes per NDA:100101| Dimension | Green (Low Risk) | Yellow (Review) | Red (Escalate) |102|-----------|-----------------|-----------------|----------------|103| **Type** | Mutual | Unilateral (we disclose) | Unilateral (we receive only) |104| **Scope** | Clearly defined to project | Broad but reasonable | "All information" without limits |105| **Duration** | 1-3 years | 3-5 years | Perpetual or >5 years |106| **Non-compete** | None | Narrow (specific market, <1 year) | Broad market, >1 year |107| **Residuals** | Residuals clause included | Silent on residuals | Explicitly excludes residuals |108| **Remedies** | Mutual remedies | Injunctive relief (standard) | Liquidated damages or penalties |109110**Triage Decision:**111- All Green → **Sign** (standard terms)112- Any Yellow → **Review** (negotiate specific clauses)113- Any Red → **Escalate** to legal counsel before signing114115---116117## Compliance Risk Score (0-100)118119Weighted scoring across regulatory dimensions:120121| Dimension | Weight | Score (0-10) | Weighted |122|-----------|--------|-------------|----------|123| **Data Privacy** (GDPR, CCPA, PDPA) | 25% | | |124| **Export Controls** (ITAR, EAR) | 15% | | |125| **Anti-Bribery** (FCPA, UK Bribery Act) | 15% | | |126| **Sanctions** (OFAC, EU sanctions) | 15% | | |127| **Industry-Specific** (HIPAA, PCI-DSS, SOX) | 20% | | |128| **Employment Law** (non-compete, IP assignment) | 10% | | |129| **Total** | 100% | | **/100** |130131**Risk Bands:**132- 0-25: Low risk — proceed with standard review133- 26-50: Moderate risk — require compliance team sign-off134- 51-75: High risk — require legal counsel review135- 76-100: Critical risk — escalate to CLO / outside counsel136137---138139## Red Flag Checklist140141These patterns require immediate escalation:142143| # | Red Flag | Why It Matters |144|---|----------|---------------|145| 1 | **Unlimited liability** | No cap on financial exposure |146| 2 | **One-sided indemnification** | Only your company bears risk |147| 3 | **Auto-renewal without notice** | Locked into unfavorable terms |148| 4 | **Broad IP assignment** | Transfers IP beyond project scope |149| 5 | **Non-compete overreach** | Restricts future business operations |150| 6 | **Unilateral amendment rights** | Counterparty can change terms without consent |151| 7 | **No termination for convenience** | Cannot exit without cause |152| 8 | **Jurisdiction in counterparty's home country** | Litigation disadvantage |153154If **any** red flag is present, do not approve without legal counsel review.155156---157158## Common Mistakes159160- **Confusing liability cap with indemnification** — a liability cap limits total exposure; indemnification defines who pays for specific losses. Both must be reviewed independently.161- **Ignoring change-of-control clauses** — acquisition or merger can trigger termination or consent requirements.162- **Skipping data processing addendums** — GDPR/CCPA require explicit DPA terms for any contract involving personal data processing.163- **Overlooking survival clauses** — confidentiality, IP, and indemnification often survive termination. Check duration.164- **Accepting "standard terms"** — no contract is truly standard. Always review, even boilerplate.165166---167168## Additional Resources169170- Related skill: `stakeholder-map` — for identifying contract stakeholders and approval workflows171- IACCM (World Commerce & Contracting) — contract management best practices172- Legal design patterns for technology agreements173174<!-- Source: .faos/custom/skills/business/legal-contract-review/SKILL.md -->
frank-luongt