Contract Risk Triage
Triage one inbound contract clause by clause against your playbook: green/yellow/red ratings, fallback redlines, lawyer questions.
Before & after
Same prompt, same agent — the only difference is the skill.
Open-source decisions always involve trade-offs. It depends on a few things: How mature is the library? How active is the maintainer? Does it have tests? What's the license—is it GPL or something more permissive? And how critical is it to your app—would it be easy to swap out later if issues come up? If you tell me the library name and your use case, I can help you think through the risks.
LIBRARY ASSESSMENT: express-redis-cache RISK SCORECARD (1-10 scale, 10=high risk) Maintenance risk: 7 (no commits in 12 months) License risk: 2 (MIT, permissive) Security risk: 4 (1 known CVE from 2022, patched) API stability risk: 3 (v1.x, mature, unlikely breaking changes) Bundlesizing risk: 1 (15kb gzipped, lightweight) OVERALL RECOMMENDATION Caution: Medium risk for production Better alternative exists: ioredis (actively maintained, same API, safer) KEY FINDINGS ✓ 2.4k stars (moderate popularity) ✓ 89% test coverage ✗ 12 months since last commit (maintainer may have moved on) ✗ 47 open issues, 8 pull requests pending (backlog growing) ✓ MIT license (reuse-friendly) ✗ 1 known CVE (qs injection, 2022-11, patched in v2.1.1) IF YOU PROCEED Pin version (2.1.1) in package-lock.json Test CVE scenario (qs injection) in your integration Monitor GitHub for new CVE disclosures monthly Plan swap to ioredis within 18 months (migration path pre-built) IF YOU WANT SAFER Switch to ioredis (v5.0, actively maintained, 8 commits this month) Same Redis API, battle-tested, 12.9k stars vs 2.4k ACTION Decision: ioredis (safer long-term) Task: Swap import, run test suite (15 min)
About this skill
Get a first-pass review of an MSA, SaaS agreement, NDA, DPA, or vendor contract that tells you what to sign, what to push back on, and what to send to a lawyer. Every finding cites the section and comes with replacement language.
What it does
- Maps parties, term, renewal, order of precedence, and documents incorporated by reference that the other side can change
- Reviews 12 core clause types, including liability caps, indemnities, IP and data rights, DPA terms, renewal traps, and assignment
- Rates each clause against your side of the deal and scales severity to the deal size
- Drafts specific fallback contract language for every yellow and red item
What you get
A triage memo with an overall recommendation, a clause table with ratings and fallback language, your top three asks in negotiation order, missing clauses, key dates, and focused questions for counsel.
Best for
Founders, ops leads, and procurement teams signing contracts without in-house counsel. Not a substitute for a licensed attorney.
SKILL.md preview
---
name: contract-risk-triage
description: Triage a single inbound commercial contract (MSA, SaaS agreement, NDA, DPA, vendor or services agreement) clause by clause against the user's negotiation playbook, rate each clause green/yellow/red, propose fallback redline language, and list what must go to a lawyer. Use when the user pastes or uploads a contract and asks "is this OK to sign", "what should we push back on", "redline this", or "what's risky here", including casual asks like "can you look over this NDA", "anything bad in this contract", or "is this auto-renewal clause normal".
---
# Contract Risk Triage
… (sign up to view the full skill)More business & ops skills
View all Business & Ops skills →General Counsel Plan Review
A General Counsel issue-spot of one plan: IP, worker classification, securities, privacy, export, ads, and when you need a lawyer.
ISO 42001 Gap Assessment
Assess your AI management system against ISO/IEC 42001 clauses 4-10 and Annex A, draft the SoA, and plan certification.
Services Proposal, SOW and Contract Drafter
Draft proposals, SOWs, freelance agreements, MSAs, and NDAs with acceptance, change orders, payment, and IP terms. Counsel-review flagged.
Compliance Control Mapper
Maps one control set to SOC 2, ISO 27001, ISO 42001 and EU AI Act with owners, evidence tracking, and gaps ranked by audit risk.