Legal Contract Review

---

name: legal-contract-review description: Review contracts for risk, extract key clauses, triage NDAs, and score compliance exposure. Use when evaluating vendor agreements, reviewing customer contracts, assessing NDA terms, or performing contract due diligence. tags: [legal, contracts, compliance, risk-analysis]

Legal Contract Review

Structured contract analysis framework for extracting key terms, scoring risk, triaging NDAs, and identifying compliance exposure. Provides repeatable, evidence-based contract review — not legal advice.

Disclaimer: This skill provides structured analysis patterns and checklists. All output should be reviewed by qualified legal counsel before making binding decisions.

Use this skill when

• Reviewing vendor, customer, or partner agreements for risk
• Triaging NDAs (mutual or unilateral) for quick risk classification
• Extracting key commercial terms into a structured summary
• Scoring compliance exposure across regulatory dimensions
• Preparing contract summaries for executive or board review
• Conducting due diligence on a portfolio of contracts

Do not use this skill when

• You need binding legal opinions (consult qualified counsel)
• Drafting new contracts from scratch (use legal templates instead)
• Reviewing highly regulated instruments (securities, insurance policies) requiring specialized expertise
• The contract is in a language you cannot fully parse

Instructions

1. Identify contract type — classify as vendor, customer, partnership, NDA, employment, or licensing agreement.
2. Run the 10-Point Checklist — extract each element into the Clause Extraction Template.
3. Score compliance risk — apply the Compliance Risk Score across all applicable dimensions.
4. Check Red Flags — scan for the 8 critical red flag patterns.
5. For NDAs — apply the NDA Triage Matrix for rapid classification.
6. Generate output — produce a Contract Summary Brief with risk heat map.

---

10-Point Contract Review Checklist

Every contract review must extract and evaluate these 10 elements:

#	Element	What to Look For	Risk Level if Missing
1	Parties	Legal entity names, jurisdiction of incorporation, authorized signatories	High — wrong entity = unenforceable
2	Term & Renewal	Start date, end date, auto-renewal clauses, notice periods for termination	Medium — auto-renewal traps
3	Termination Rights	For cause, for convenience, cure periods, termination triggers	High — inability to exit
4	Liability Cap	Aggregate cap, per-incident cap, carve-outs from cap	Critical — unlimited exposure
5	Indemnification	Mutual vs. one-sided, scope of indemnified claims, defense obligations	High — asymmetric risk
6	IP & Ownership	IP assignment, license grants, work-for-hire provisions, background IP protections	Critical — loss of core IP
7	Confidentiality	Scope, duration, permitted disclosures, return/destruction obligations	Medium — over-broad scope
8	Governing Law & Disputes	Jurisdiction, arbitration vs. litigation, venue, class action waiver	Medium — unfavorable venue
9	Data & Privacy	Data processing terms, DPA requirements, breach notification, data residency	High — regulatory exposure
10	Force Majeure	Defined events, notice requirements, performance relief, termination rights	Low — unless critical supply chain

---

Clause Extraction Template

Use this structure to summarize any contract:

## Contract Summary

**Contract Type:** [Vendor/Customer/NDA/Partnership/Employment/License]
**Parties:** [Party A] ↔ [Party B]
**Effective Date:** [YYYY-MM-DD]
**Term:** [Duration] | **Auto-Renewal:** [Yes/No — notice period]
**Governing Law:** [Jurisdiction]

### Key Commercial Terms
| Term | Value | Notes |
|------|-------|-------|
| Contract Value | $ | Annual/total |
| Payment Terms | Net [X] days | |
| Liability Cap | $ or [X]x fees | Carve-outs: [list] |
| Termination Notice | [X] days | For convenience / for cause |

### Risk Summary
| Risk Area | Score (1-5) | Key Finding |
|-----------|-------------|-------------|
| Financial Exposure | | |
| IP Risk | | |
| Compliance Risk | | |
| Operational Risk | | |
| **Overall Risk** | **[avg]** | **[summary]** |

---

NDA Triage Matrix

Rapid classification for NDAs — takes 10-15 minutes per NDA:

Dimension	Green (Low Risk)	Yellow (Review)	Red (Escalate)
Type	Mutual	Unilateral (we disclose)	Unilateral (we receive only)
Scope	Clearly defined to project	Broad but reasonable	"All information" without limits
Duration	1-3 years	3-5 years	Perpetual or >5 years
Non-compete	None	Narrow (specific market, <1 year)	Broad market, >1 year
Residuals	Residuals clause included	Silent on residuals	Explicitly excludes residuals
Remedies	Mutual remedies	Injunctive relief (standard)	Liquidated damages or penalties

Triage Decision:

• All Green → Sign (standard terms)
• Any Yellow → Review (negotiate specific clauses)
• Any Red → Escalate to legal counsel before signing

---

Compliance Risk Score (0-100)

Weighted scoring across regulatory dimensions:

Dimension	Weight	Score (0-10)	Weighted
Data Privacy (GDPR, CCPA, PDPA)	25%
Export Controls (ITAR, EAR)	15%
Anti-Bribery (FCPA, UK Bribery Act)	15%
Sanctions (OFAC, EU sanctions)	15%
Industry-Specific (HIPAA, PCI-DSS, SOX)	20%
Employment Law (non-compete, IP assignment)	10%
Total	100%		/100

Risk Bands:

• 0-25: Low risk — proceed with standard review
• 26-50: Moderate risk — require compliance team sign-off
• 51-75: High risk — require legal counsel review
• 76-100: Critical risk — escalate to CLO / outside counsel

---

Red Flag Checklist

These patterns require immediate escalation:

#	Red Flag	Why It Matters
1	Unlimited liability	No cap on financial exposure
2	One-sided indemnification	Only your company bears risk
3	Auto-renewal without notice	Locked into unfavorable terms
4	Broad IP assignment	Transfers IP beyond project scope
5	Non-compete overreach	Restricts future business operations
6	Unilateral amendment rights	Counterparty can change terms without consent
7	No termination for convenience	Cannot exit without cause
8	Jurisdiction in counterparty's home country	Litigation disadvantage

If any red flag is present, do not approve without legal counsel review.

---

Common Mistakes

• Confusing liability cap with indemnification — a liability cap limits total exposure; indemnification defines who pays for specific losses. Both must be reviewed independently.
• Ignoring change-of-control clauses — acquisition or merger can trigger termination or consent requirements.
• Skipping data processing addendums — GDPR/CCPA require explicit DPA terms for any contract involving personal data processing.
• Overlooking survival clauses — confidentiality, IP, and indemnification often survive termination. Check duration.
• Accepting "standard terms" — no contract is truly standard. Always review, even boilerplate.

---

Additional Resources

• Related skill: stakeholder-map — for identifying contract stakeholders and approval workflows
• IACCM (World Commerce & Contracting) — contract management best practices
• Legal design patterns for technology agreements