Legal Compliance Review
This is a Hermes-native legal-compliance-review workflow skill.
Why This Exists
legal-compliance-review prepares scoped issues for human legal review without claiming counsel or filing authority.
Do Not Use When
- The user needs a final jurisdiction-specific legal opinion, legal representation, or authoritative filing decision; prepare the issue and counsel brief instead.
- The review is about code, secrets, permissions, prompt injection, dependencies, or unsafe tool behavior; use
security-safety-review.
- The request is a plain-language rewrite without a legal-risk review objective; use
content-operator.
- The user asks to sign, accept, submit, file, publish, or change a policy or contract in an external system; use
connector-operator only after explicit authority.
Examples
Good example:
- Prompt: Review this vendor DPA for data-processing obligations, risky clauses, and questions for counsel.
- Expected behavior: Prepare an authority-bound issue matrix, ranked risks, and counsel questions.
- Why: The request needs a prepared review and escalation aid before a legal decision.
Bad example:
- Prompt: Audit this OAuth integration for secret and permission risks.
- Expected behavior: Route to
security-safety-review, not legal-compliance-review.
- Why: The target is technical security risk rather than contract or compliance analysis.
Completion Checklist
- Findings or no-issue results are grounded in concrete file, artifact, command, or source evidence.
- Open questions, residual risk, and missing verification are named.
- Fixes or follow-up work are separate handoffs unless the user explicitly asked to implement them.
Recovery Notes
- If the reviewed target is missing, inspect the requested artifact or ask one target question.
- If independent verification is unavailable, report the gap and avoid an approval-style claim.
Workflow Lane
- Current lane: Research and company ops (
product-docs, source-finder, web-research, research, best-practice-research, autoresearch-goal, model-optimization, inference-serving, +19 more) - research, signals, ops, and briefings.
- If intent belongs to another lane, hand back to
oh-my-hermes or name the adjacent workflow.
- Shared product, routing, compatibility, and evidence rules:
omh-routing/references/skill-common-rail.md.
Use When
Use when supplied contract, policy, product, process, or regulatory context needs a scoped issue matrix, assumptions, and counsel/escalation brief.
Strong routing signals: `contract review`, `contract liability clause`, `regulatory analysis`, `compliance review`, `계약서 검토`, `규제 분석`, `컴플라이언스 검토`
Catalog Metadata
Category: review
Phase: legal-compliance-review
Hermes role: reviewer
Quality tier: review-gated
Reasoning demand: standard
Quality bar:
- Name jurisdiction, authority, document version, and unresolved questions.
- Rank issues and preserve the counsel-escalation boundary.
Handoff policy:
Keep domain framing, clarification, source/evidence synthesis, draft outputs, and next-work routing in Hermes. A prepared brief, review, reply, or plan is not an external action, approval, filing, send, publish, data mutation, implementation, review, CI, or merge claim. Prepare a connector, file, coding, or human-review handoff only when the user explicitly accepts that next step; report it only from observed evidence. The result is a prepared review and escalation aid, not legal advice, counsel sign-off, compliance certification, contract execution, filing, or regulator communication.
Required inputs:
- jurisdiction
- document or process version
- supplied authority
- review objective
Expert clarification questions:
jurisdiction
- English: Which parties, actor or data roles, operative facts, governing law and forum, and separately applicable regulatory jurisdictions are supplied?
- Korean: 어떤 당사자, 행위자 또는 데이터 역할, 주요 사실, 준거법과 관할, 별도 적용 규제 관할권이 제공되었나요?
Expected outputs:
- legal_scope_authority_record/v1
- legal_issue_traceability_matrix/v1
- legal_risk_counsel_hold_register/v1
- legal_review_disposition/v1
Artifact expectations:
- prepared legal and compliance issue matrix when a wrapper captures it
Safety rules:
- Distinguish supplied authority from legal interpretation and final advice.
- Do not claim sign-off, certification, filing, execution, or regulator communication.
Procedure: load references/procedure.md.
Runtime Evidence
Preferred harness for this skill: critic.
omh runtime record --skill legal-compliance-review --harness critic --status started
Record observed delegation results; otherwise return not_available or not_observed.
Prepared OMH routing is not execution, review, CI, merge-readiness, or merge evidence.
- Treat wrapper memory/context summaries as advisory local context, not proof of opaque Hermes memory reads or changes.
Preserve workflow intent and stop conditions; verify before claiming completion.
Use Hermes-native subagent/delegation features when available: native subagents -> Hermes delegation when available, otherwise sequential lanes.
Shared product, compatibility, topology, memory, harness, and execution rules: omh-routing/references/skill-common-rail.md. Load it when applicable; otherwise name an unavailable capability.
1---
2name: "omh-legal-compliance-review"
3description: "[omh] Surface contract and compliance risks, questions, and escalation points before a legal decision or action. Use when the user says: contract review, contract liability clause, regulatory analysis, compliance review, 계약서 검토, 규제 분석, 컴플라이언스 검토."
4metadata:
5 hermes:
6 tags: [workflow, oh-my-hermes, review]
7 category: review
8 phase: legal-compliance-review
9 role: reviewer
10 quality_tier: review-gated
11---
12
13# Legal Compliance Review
14
15This is a Hermes-native `legal-compliance-review` workflow skill.
16
17## Why This Exists
18
19`legal-compliance-review` prepares scoped issues for human legal review without claiming counsel or filing authority.
20
21## Do Not Use When
22
23- The user needs a final jurisdiction-specific legal opinion, legal representation, or authoritative filing decision; prepare the issue and counsel brief instead.
24- The review is about code, secrets, permissions, prompt injection, dependencies, or unsafe tool behavior; use `security-safety-review`.
25- The request is a plain-language rewrite without a legal-risk review objective; use `content-operator`.
26- The user asks to sign, accept, submit, file, publish, or change a policy or contract in an external system; use `connector-operator` only after explicit authority.
27
28## Examples
29
30Good example:
31
32- Prompt: Review this vendor DPA for data-processing obligations, risky clauses, and questions for counsel.
33- Expected behavior: Prepare an authority-bound issue matrix, ranked risks, and counsel questions.
34- Why: The request needs a prepared review and escalation aid before a legal decision.
35
36Bad example:
37
38- Prompt: Audit this OAuth integration for secret and permission risks.
39- Expected behavior: Route to `security-safety-review`, not `legal-compliance-review`.
40- Why: The target is technical security risk rather than contract or compliance analysis.
41
42## Completion Checklist
43
44- Findings or no-issue results are grounded in concrete file, artifact, command, or source evidence.
45- Open questions, residual risk, and missing verification are named.
46- Fixes or follow-up work are separate handoffs unless the user explicitly asked to implement them.
47
48## Recovery Notes
49
50- If the reviewed target is missing, inspect the requested artifact or ask one target question.
51- If independent verification is unavailable, report the gap and avoid an approval-style claim.
52
53## Workflow Lane
54
55- Current lane: **Research and company ops** (`product-docs`, `source-finder`, `web-research`, `research`, `best-practice-research`, `autoresearch-goal`, `model-optimization`, `inference-serving`, `+19 more`) - research, signals, ops, and briefings.
56- If intent belongs to another lane, hand back to `oh-my-hermes` or name the adjacent workflow.
57- Shared product, routing, compatibility, and evidence rules: `omh-routing/references/skill-common-rail.md`.
58
59## Use When
60
61Use when supplied contract, policy, product, process, or regulatory context needs a scoped issue matrix, assumptions, and counsel/escalation brief.
62
63 Strong routing signals: `contract review`, `contract liability clause`, `regulatory analysis`, `compliance review`, `계약서 검토`, `규제 분석`, `컴플라이언스 검토`
64
65## Catalog Metadata
66
67Category: `review`
68Phase: `legal-compliance-review`
69Hermes role: `reviewer`
70Quality tier: `review-gated`
71Reasoning demand: `standard`
72
73Quality bar:
74
75- Name jurisdiction, authority, document version, and unresolved questions.
76- Rank issues and preserve the counsel-escalation boundary.
77
78Handoff policy:
79
80Keep domain framing, clarification, source/evidence synthesis, draft outputs, and next-work routing in Hermes. A prepared brief, review, reply, or plan is not an external action, approval, filing, send, publish, data mutation, implementation, review, CI, or merge claim. Prepare a connector, file, coding, or human-review handoff only when the user explicitly accepts that next step; report it only from observed evidence. The result is a prepared review and escalation aid, not legal advice, counsel sign-off, compliance certification, contract execution, filing, or regulator communication.
81
82Required inputs:
83
84- jurisdiction
85- document or process version
86- supplied authority
87- review objective
88
89Expert clarification questions:
90- `jurisdiction`
91 - English: Which parties, actor or data roles, operative facts, governing law and forum, and separately applicable regulatory jurisdictions are supplied?
92 - Korean: 어떤 당사자, 행위자 또는 데이터 역할, 주요 사실, 준거법과 관할, 별도 적용 규제 관할권이 제공되었나요?
93
94Expected outputs:
95
96- legal_scope_authority_record/v1
97- legal_issue_traceability_matrix/v1
98- legal_risk_counsel_hold_register/v1
99- legal_review_disposition/v1
100
101Artifact expectations:
102
103- prepared legal and compliance issue matrix when a wrapper captures it
104
105Safety rules:
106
107- Distinguish supplied authority from legal interpretation and final advice.
108- Do not claim sign-off, certification, filing, execution, or regulator communication.
109
110Procedure: load `references/procedure.md`.
111
112## Runtime Evidence
113
114Preferred harness for this skill: `critic`.
115
116```sh
117omh runtime record --skill legal-compliance-review --harness critic --status started
118```
119
120Record observed delegation results; otherwise return `not_available` or `not_observed`.
121Prepared OMH routing is not execution, review, CI, merge-readiness, or merge evidence.
122- Treat wrapper memory/context summaries as advisory local context, not proof of opaque Hermes memory reads or changes.
123Preserve workflow intent and stop conditions; verify before claiming completion.
124
125Use Hermes-native subagent/delegation features when available: native subagents -> Hermes delegation when available, otherwise sequential lanes.
126
127Shared product, compatibility, topology, memory, harness, and execution rules: `omh-routing/references/skill-common-rail.md`. Load it when applicable; otherwise name an unavailable capability.
rlaope