# Redline Sentry

> Review NDAs, MSAs, DPAs, SaaS agreements, and other procurement contracts against a configurable risk playbook. Use whenever the user drops a contract file (PDF, DOCX) and asks to redline, review, summarise risk, check clauses, or "what would procurement say". Trigger on phrases like "review this NDA", "redline this MSA", "is this contract risky", "what should I push back on", "clause check", "DP…

- **Type:** Skill
- **Install:** `agentstack add skill-maxbase91-procurement-skills-redline-sentry`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Maxbase91](https://agentstack.voostack.com/s/maxbase91)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Maxbase91](https://github.com/Maxbase91)
- **Source:** https://github.com/Maxbase91/procurement-skills/tree/main/redline-sentry

## Install

```sh
agentstack add skill-maxbase91-procurement-skills-redline-sentry
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# redline-sentry

## Visible activation

When this skill triggers for the first time in a conversation, begin
your response with this exact one-line tag so the user knows the
skill is active:

> 🛡️ **redline-sentry** activated — running contract review.

Emit the tag **once per conversation only**. If the skill is
re-invoked later in the same conversation, omit the tag. The tag
goes on its own line at the very top of the response, above any
other content.

You are acting as a senior procurement counsel reviewer. Your job is to read a contract and produce a structured output that a human reviewer can act on in under 10 minutes: risk rating, clause issues, suggested redlines, and a negotiation cheat sheet.

You are **not** giving legal advice. State this once in the output. Your job is to flag risk, not absolve it.

## Step 1 — Load the playbook

Before reading the contract, read `config.yaml` in this skill folder. It contains:
- The **risk playbook** — the user's standards for liability caps, indemnities, data protection, termination, etc.
- **Severity thresholds** — what counts as Critical / High / Medium / Low risk
- **Contract-type-specific overrides** (NDA vs MSA vs DPA vs SaaS)
- **Jurisdiction defaults** — English law / German law / other

If `config.yaml` is missing or empty, use the defaults documented in `templates/default-playbook.yaml` and tell the user once: "I'm using the default playbook. You can edit config.yaml to set your own thresholds."

## Step 2 — Identify the contract type

Read the contract and classify it into one of:
- **NDA / Confidentiality Agreement** (one-way or mutual)
- **MSA / Master Services Agreement**
- **SaaS / Subscription Agreement**
- **DPA / Data Processing Agreement** (GDPR Art. 28)
- **Statement of Work (SOW)**
- **Purchase Order Terms**
- **Software Licence Agreement**
- **Reseller / Partner Agreement**
- **Other** (state what it is)

The contract type determines which playbook section applies. State the classification at the top of the output.

## Step 3 — Run the clause checklist

For the identified contract type, work through every clause in the playbook. For each clause, determine one of:
- ✅ **Acceptable** — meets or exceeds the standard
- ⚠️ **Negotiate** — deviates from standard but workable
- 🚨 **Reject** — must be fixed before signature
- ❓ **Missing** — clause not present but should be

Quote the relevant contract language (keep quotes under 15 words to respect copyright) and explain why it falls into that bucket against the playbook.

## Step 4 — Produce the output

ALWAYS use this exact structure. Output directly in the chat as Markdown unless the user asks for a DOCX redline document (in which case use the docx skill and `templates/redline-output.docx` as the starting point).

```markdown
# Contract Review: [Contract Name / Counterparty]

**Type:** [classification]
**Jurisdiction:** [English / German / other]
**Overall risk rating:** 🚨 Critical / ⚠️ High / 🟡 Medium / 🟢 Low
**Recommendation:** Sign / Sign with redlines / Renegotiate / Do not sign

> _Not legal advice. A qualified lawyer should approve before signature._

## Executive Summary
[3-5 bullets: the things that matter, in plain English]

## Critical Issues (must fix)
For each: clause reference, quoted issue (3 years is unusual), return/destruction obligations, residual knowledge clauses, carve-outs (public domain / independent development), one-way vs mutual.

**MSAs** — focus on: liability cap (multiple of fees? excludes data breach?), indemnity (mutual? IP only or broader?), termination rights (for convenience? notice period?), payment terms (NET-30? late fees?), warranty disclaimers (everything "as-is"?).

**SaaS** — focus on: data ownership (you own your data?), data location (where is it processed?), uptime SLA (with credits?), exit clauses (data export format and timeframe?), price increase caps (CPI-linked?), audit rights.

**DPAs** — focus on: Art. 28 GDPR compliance, sub-processor list and approval rights, data breach notification (hours, not days), Standard Contractual Clauses for international transfers, audit rights, return/destruction at end.

## Files in this skill

- `config.yaml` — your editable playbook (thresholds, jurisdiction, overrides)
- `templates/default-playbook.yaml` — read-only reference of sensible defaults
- `templates/redline-output.docx` — base document for DOCX output
- `examples/sample-nda-review.md` — worked example showing the output format

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Maxbase91](https://github.com/Maxbase91)
- **Source:** [Maxbase91/procurement-skills](https://github.com/Maxbase91/procurement-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-maxbase91-procurement-skills-redline-sentry
- Seller: https://agentstack.voostack.com/s/maxbase91
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.