Purpose
Rapidly triage a contract for the clauses that actually create legal and business exposure for a technology company — privacy, IP ownership, AI/data use, liability, and key commercial terms — and return a prioritized risk register with severity ratings and specific fallback language you can drop into a redline. Turns a two-hour manual read into a structured first pass an in-house lawyer can act on immediately.
When to Use
Invoke this skill when the user asks to:
- Review an inbound vendor, customer, SaaS, or reseller agreement for risk
- Check a DPA, data processing addendum, or privacy terms against a company baseline
- Flag non-standard or one-sided clauses before starting a redline
- Assess AI/ML, data training, or model output clauses in a technology contract
- Identify uncapped liability, indemnity, or IP assignment exposure
- Prepare a risk summary to escalate to a business owner or GC
Inputs Required
Before starting, collect:
- Contract text: The full agreement or the clauses to be reviewed (paste or attach)
- Contract type: Vendor/procurement, customer/sales, DPA, NDA, SaaS, reseller, etc.
- Which side we're on: Are we the customer, the vendor, the data controller, or the processor?
- Company risk posture: Conservative / balanced / deal-hungry (affects how aggressively to flag)
- Non-negotiables: Any known dealbreakers (e.g., "we never accept uncapped liability," "no training on our data")
- Governing standard: Applicable framework(s) — GDPR, CCPA/CPRA, HIPAA, SOC 2, EU AI Act, or "none specified"
- Deal size / strategic weight: Rough contract value or importance (affects fallback aggressiveness)
If risk posture or governing standard is missing, assume a balanced posture and flag both GDPR and CCPA/CPRA obligations, noting the assumption.
Instructions
Step 1: Classify the Agreement and Set the Baseline
Identify the contract type, which party the user represents, and the corresponding "standard" market position for that role. A liability cap of 12 months' fees is standard for a customer buying SaaS but aggressive for a vendor selling it — calibrate every flag to the user's side of the table.
Step 2: Scan Across Five Risk Domains
For each domain, locate the relevant clauses (or confirm their absence) and evaluate against market-standard positions.
Domain 1 — Privacy & Data Protection
- Data processing roles (controller vs. processor) correctly assigned
- Sub-processor rights, notice, and objection mechanism
- Cross-border transfer mechanism (SCCs, DPF adequacy) present and current
- Breach notification window (flag anything above 72 hours or "reasonable time")
- Data return/deletion obligations on termination
- Missing DPA where personal data is clearly processed → severity High
Domain 2 — Intellectual Property
- Ownership of pre-existing IP, work product, and derivatives
- Broad or perpetual license grants to the counterparty (flag "irrevocable," "perpetual," "sublicensable" combinations)
- Feedback/suggestions clauses assigning improvements to the counterparty
- IP indemnity scope, carve-outs, and whether it survives termination
- Missing IP indemnity where the vendor provides software → severity High
Domain 3 — AI, ML & Data Use
- Rights to use customer data or inputs to train models (flag any training right absent explicit opt-out)
- Ownership and IP status of AI-generated outputs
- Warranties or disclaimers on output accuracy, bias, or hallucination
- Restrictions on submitting confidential or personal data to AI features
- EU AI Act / emerging-regulation allocation of compliance responsibility
- Silent-training clauses or ambiguous "improve our services" language → severity High
Domain 4 — Liability & Indemnity
- Liability cap amount and structure (aggregate vs. per-claim; multiple of fees)
- Uncapped or super-capped carve-outs (confidentiality, IP, data breach, gross negligence)
- Mutuality of caps and carve-outs
- Consequential/indirect damages exclusion and its exceptions
- One-sided indemnity, absence of a cap on indemnity → severity High
- Uncapped liability with no carve-out justification → severity Critical
Domain 5 — Key Commercial & Exit Terms
- Auto-renewal and notice-to-cancel windows (flag >30 days notice or auto-renew without notice)
- Termination for convenience rights and asymmetry
- Price increase / uplift caps
- Assignment, change-of-control, and most-favored-nation clauses
- Governing law / venue that is unfavorable or foreign
Step 3: Assign a Status and Severity to Each Flag
For every clause reviewed, assign:
- Status: Standard / Non-Standard / Missing / Absent-but-Not-Required
- Severity: Critical (dealbreaker/uncapped exposure) / High (material, negotiate hard) / Medium (negotiate if leverage exists) / Low (note, accept if needed)
- Our exposure: One sentence stating the concrete business or legal risk in plain language
Step 4: Provide Fallback Positions
For each Critical, High, and Medium flag, supply a negotiation ladder:
- Ideal ask: The redline you'd prefer, with sample clause language
- Acceptable fallback: The compromise most counterparties will accept
- Walk-away line: The point past which the term should be escalated or rejected
Fallback language must be drop-in ready — specific numbers, real clause phrasing, not "negotiate a reasonable cap."
Step 5: Build the Escalation Summary
Produce a 3-5 bullet executive summary for a business owner or GC: the top risks, the recommended overall posture (sign / redline / escalate), and any non-negotiables triggered.
Output Format
- Structure: Executive summary → risk register table → fallback ladders for Critical/High/Medium flags → overall recommendation
- Length: 900–1,400 words depending on contract complexity
- Format: Risk register as a table (Clause | Status | Severity | Exposure); fallback ladders as structured bullets per flag
- Sections: Executive Summary → Risk Register (grouped by the 5 domains) → Fallback Positions → Overall Recommendation
- Tone: In-house counsel to a colleague — precise, plain-English, decisive; names the risk without hedging and states a recommended action
Quality Checklist
Before delivering output, verify:
- [ ] All five risk domains are addressed, including any where the finding is "no material risk"
- [ ] Every flag has a Status AND a Severity rating — none left unrated
- [ ] Missing-clause risks are flagged, not just problems in existing clauses
- [ ] Every Critical and High flag has drop-in fallback language with specific terms — no "negotiate a reasonable X"
- [ ] Severity is calibrated to the user's side of the table (customer vs. vendor)
- [ ] Executive summary states a clear sign / redline / escalate recommendation
Notes
- This is a first-pass triage, not a legal opinion — flag that final positions should reflect jurisdiction-specific advice and the actual deal context.
- The highest-value finds in tech contracts are usually silent AI training rights and uncapped indemnities buried in carve-outs — scan those first.
- When the contract text is partial, review what's provided and explicitly list which standard clauses could not be assessed because they weren't included.
- If a non-negotiable from the intake is triggered, surface it at the very top of the executive summary regardless of severity ranking elsewhere.
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills