contract-review
Lightweight NDA, MSA, and vendor contract review for SMBs without legal on staff. Reads contracts from local files, Gmail attachments, or DocuSign envelopes; flags non-standard terms; explains risks in plain English; and outputs a marked-up redline as a separate DOCX. Use when the user says "review this contract," "what am I signing," "red flags," "flag any concerns," "check the payment terms," or uploads/forwards a contract or legal agreement.
What this skill does
# Contract Review
## Quick start
Attach a contract file, forward the email containing it, or paste the text directly.
```
User: "Review this MSA and flag anything I should push back on."
→ Skill reads the document, identifies parties and contract type,
analyzes 8 risk categories, returns a severity-tiered summary
with a negotiation playbook, and exports a redlined DOCX.
```
## Workflow
1. **Get the contract** — Pull from one of three sources, in order of preference:
- **Gmail**: Search for recent emails with contract attachments (see `reference/gmail-fetch.md`)
- **DocuSign**: Fetch the envelope by ID or search recent drafts awaiting signature (see `reference/docusign-fetch.md`)
- **Local file or paste**: Read the PDF (chunked via `pages` parameter for 10+ page files) or DOCX via Read tool. If the user pastes text directly, work with what's provided.
Read the full document before analyzing. Dangerous clauses are frequently in exhibits and schedules at the back.
2. **Identify contract type and parties** — Determine agreement type (NDA, MSA, SOW, SaaS subscription, consulting, subcontractor, vendor) and which party is the user's company vs. the counterparty. Note if it looks like a counterparty template — these are typically one-sided and the counterparty expects pushback.
3. **Analyze across 8 risk categories** — Work through the contract from the ops/finance perspective of a small business owner without in-house legal. Categories are ordered by typical risk severity; use judgment for context.
**Category 1: Payment terms and cash flow**
- Payment timing: Net-30 is standard; Net-60+ is flaggable; Net-90/120 is a hard negotiation point
- Payment triggers: acceptance periods that let the client slow-walk approvals indefinitely
- Late payment penalties: absence is a gap worth noting
- Invoicing requirements: rigid formats or PO numbers that can delay payment on technicalities
- Expense reimbursement: pre-approval requirements and caps
- Rate adjustments: annual increase mechanism for multi-year engagements
**Category 2: Liability and indemnification**
- Liability caps: uncapped liability is always a red flag
- Mutual vs. one-sided indemnification
- Indemnification scope: "any and all claims arising from the services" is not standard
- Insurance requirements: E&O, cyber, general liability — achievability at the required limits
- Consequential damages waiver: missing = flag prominently
**Category 3: Termination and exit**
- Termination for convenience: is it mutual? 30-day notice is typical
- Termination for cause: cure period; vague "material breach" without definition
- Wind-down: payment for in-progress work at termination
- Transition assistance: paid vs. unpaid, time-limited vs. open-ended
- Survival clauses: indefinite indemnification survival = flag
**Category 4: Intellectual property**
- IP assignment vs. license
- Pre-existing IP and background tools carve-out — absence means inadvertent assignment
- Work product definition breadth: drafts, notes, internal tools
**Category 5: Scope and change management**
- Scope definition clarity
- Change order process: absence = scope creep without compensation
- Acceptance criteria: subjective ("to client's satisfaction") vs. defined
- Timeline asymmetry: user penalized for delays but client is not for slow feedback
**Category 6: Non-compete and exclusivity**
- Non-compete scope, definition of "competitor," duration
- Exclusivity requirements on the user's company
- Non-solicitation: employee poaching is normal; industry-broad restrictions are not
**Category 7: Confidentiality and data**
- Confidentiality scope: "all information shared" with no exceptions is overly broad
- Duration: 2–3 years is typical; perpetual is aggressive
- Data handling security requirements vs. company size and data sensitivity
- Return/destruction requirements post-termination
**Category 8: Operational concerns**
- Governing law and dispute resolution; mandatory arbitration
- Auto-renewal: opt-out window and notice period (missing a 60-day window is a common SMB mistake)
- Assignment rights, especially if the client gets acquired
- Most favored nation: constrains pricing across the entire client book
- Audit rights: scope and frequency
4. **Present flagged summary** — Organize by severity:
**🔴 Red flags (push back before signing)** — For each: quote the exact clause, explain the problem in plain language, suggest specific alternative language.
**🟡 Yellow flags (negotiate, not deal-breakers)** — For each: quote the clause, explain the concern, describe what "better" looks like.
**🟢 Key terms to note (awareness only)** — Payment schedules, notice periods, renewal dates, insurance requirements, key contacts.
**📋 Contract summary** — Plain-language summary: who does what, for how much, over what timeframe, under what conditions.
**💡 Negotiation playbook** — For each red and yellow flag: what to ask for, how to frame the ask, and what a reasonable compromise looks like.
5. **Export redline DOCX** — After presenting the summary, offer to export a redlined DOCX with the suggested changes marked up. Use the `docx` skill to generate a Word document that:
- Preserves the original contract structure
- Marks suggested deletions in strikethrough and additions in underline
- Adds a cover page summarizing the changes
Ask: "Want me to export a redlined DOCX you can send back to the counterparty?"
## Approval gates
- Never characterize the output as legal advice. Always recommend attorney review for red flags or binding decisions.
- Quote actual clause language, not paraphrases. The user needs the exact text for negotiation calls.
- Flag what's missing, not just what's there. A contract silent on liability caps or change orders is often more dangerous than one with unfavorable terms.
- Do not flag standard boilerplate. If a clause is fair and market-standard, skip it. The user wants signal, not a clause-by-clause restatement.
- Compare to market norms when flagging: "Net-90 is uncommon in professional services — Net-30 is standard."
- Adjust recommendations to the power dynamic. A Fortune 500 procurement MSA is a different negotiation than a small startup agreement.
- Never send the redlined DOCX to the counterparty without explicit user confirmation.
## Reference
- `reference/gotchas.md` — edge cases in contract analysis
- `reference/docusign-fetch.md` — pulling envelopes from DocuSign
- `reference/gmail-fetch.md` — finding contract attachments in Gmail
- `reference/examples/flagged-summary-saas.md` — worked example: SaaS agreement review output
Related in Productivity
gitea-workflow
IncludedOrchestrate agile development workflows for Gitea repositories using the tea CLI. Use when working with Gitea-hosted repos and asking to 'run the workflow', 'continue working', 'what's next', 'complete the task cycle', 'start my day', 'end the sprint', 'implement the next task', or wanting guided step-by-step development assistance. Keywords: workflow, orchestrate, agile, task cycle, sprint, daily, implement, review, PR, standup, retrospective, gitea, tea.
microsoft-graph-gateway
IncludedRoute Microsoft Graph work in this workspace. Use when users want to read or write Outlook mail, calendar events, contacts, OneDrive or SharePoint files, Teams, Planner, To Do, users, groups, directory data, or arbitrary Microsoft Graph endpoints from VS Code. Prefer WorkIQ for common read scenarios. Use Microsoft Graph for write actions and gap-read scenarios that need exact Graph properties, filters, permissions, or endpoints.
copilotkit
IncludedUse when building with CopilotKit — setup, development, integrations, debugging, upgrading, or contributing. Routes to the appropriate specialized skill based on the task.
wordly-wisdom
IncludedProvides calibrated decision analysis using Charlie Munger-style multiple mental models, inversion, incentive mapping, circle-of-competence checks, misjudgment audits, second-order effects, and forecast updates. Use when the user asks for an oracle take, a hard call, a decision memo, a premortem, an outside view, a red-team, a sanity-check, what am I missing, think this through, or wants a strategy, hire, investment, plan, product, partnership, or major life choice analysed. Avoid for simple factual lookups or time-sensitive legal, medical, or market questions without fresh evidence.
swain-session
IncludedSession management and project status dashboard. Owns the full session lifecycle (start/work/close/resume), focus lane, bookmarks, worktree detection, and tab naming. Also serves as the project status dashboard — shows active epics, progress, actionable next steps, blocked items, tasks, GitHub issues, and recommendations. Worktree creation is deferred to swain-do task dispatch (SPEC-195). Triggers on: 'session', 'status', 'what's next', 'dashboard', 'overview', 'where are we', 'what should I work on', 'show me priorities', 'bookmark', 'focus on', 'session info'.
gandi
IncludedComprehensive Gandi domain registrar integration for domain and DNS management. Register and manage domains, create/update/delete DNS records (A, AAAA, CNAME, MX, TXT, SRV, and more), configure email forwarding and aliases, check SSL certificate status, create DNS snapshots for safe rollback, bulk update zone files, and monitor domain expiration. Supports multi-domain management, zone file import/export, and automated DNS backups. Includes both read-only and destructive operations with safety controls.