# Contract Review Checklist

> Systematic contract review checklist — evaluating liability, IP ownership, data handling, termination clauses, SLAs, and compliance requirements with risk-rated findings and suggested protective language.

- **Type:** Skill
- **Install:** `agentstack add skill-the-ai-directory-company-agents-and-skills-contract-review-checklist`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [The-AI-Directory-Company](https://agentstack.voostack.com/s/the-ai-directory-company)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [The-AI-Directory-Company](https://github.com/The-AI-Directory-Company)
- **Source:** https://github.com/The-AI-Directory-Company/agents-and-skills/tree/main/skills/contract-review-checklist
- **Website:** https://ai-directory.company

## Install

```sh
agentstack add skill-the-ai-directory-company-agents-and-skills-contract-review-checklist
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Contract Review Checklist

## Before you start

Gather the following from the user. If anything is missing, ask before proceeding:

1. **What type of contract?** (SaaS agreement, vendor contract, partnership, NDA, MSA)
2. **Which party are you?** (Customer, vendor, partner — your review posture changes)
3. **What is the contract value?** (Determines acceptable risk tolerance)
4. **What data is involved?** (PII, PHI, financial data, trade secrets, none)
5. **What regulatory frameworks apply?** (GDPR, HIPAA, SOC 2, industry-specific)
6. **Are there existing terms to compare against?** (Prior version, your standard template)

This skill produces a structured review with risk-rated findings. It is not legal advice. Flag findings rated High or Critical for legal counsel review.

## Review template

### 1. Contract Summary

```
Contract Type:   [SaaS Subscription Agreement]
Parties:         [Your Company] ("Customer") and [Vendor] ("Provider")
Term:            [Initial term + renewal terms]
Total Value:     [Annual or total contract value]
Review Date:     [Date]
```

### 2. Liability and Indemnification

| Clause                | Section | Current Language             | Risk | Recommendation                  |
|-----------------------|---------|------------------------------|------|---------------------------------|
| Liability cap         | 7.1     | 12 months of fees paid       | Low  | Acceptable — standard for SaaS  |
| Indemnification scope | 8.1     | Vendor indemnifies IP only   | High | Add data breach indemnification |
| Consequential damages | 7.3     | Mutual waiver                | Low  | Standard — acceptable           |

Red flags: liability cap below contract value, one-sided indemnification, no carve-outs for gross negligence or willful misconduct.

### 3. Intellectual Property

| Issue                   | Section | Status        | Risk | Notes                           |
|-------------------------|---------|---------------|------|---------------------------------|
| IP ownership of outputs | 4.1     | Customer owns | Low  | Verify includes derivatives     |
| License to customer data| 4.3     | Broad license | High | Narrow to service delivery only |
| Work product rights     | 4.4     | Not addressed | Crit | Must add assignment clause      |

Key questions: Who owns work product? Does the vendor retain rights to use your data for training or benchmarking? Are license grants surviving termination?

### 4. Data Handling and Privacy

| Requirement           | Section | Adequate? | Gap                                |
|-----------------------|---------|-----------|-------------------------------------|
| Data processing terms | 9.1     | Partial   | Missing subprocessor notification   |
| Breach notification   | 9.3     | No        | Timeline is 30 days — require 72 hrs|
| Data return/deletion  | 9.4     | Yes       | 30-day post-termination window      |
| Encryption standards  | 9.5     | N/A       | Add at-rest and in-transit minimums |

If the contract involves PII or regulated data and lacks a Data Processing Agreement, flag as Critical.

### 5. Service Levels and Remedies

| SLA Metric    | Commitment  | Remedy             | Risk |
|---------------|-------------|---------------------|------|
| Uptime        | 99.9%       | 5% credit per 0.1% | Low  |
| Response time | Not defined | None                | High |
| RTO/RPO       | Not defined | None                | Crit |

Verify: Are credits the sole remedy, or can you terminate for persistent SLA failures? Does the vendor self-report uptime?

### 6. Termination and Exit

| Provision                  | Terms                | Risk | Notes                         |
|----------------------------|----------------------|------|-------------------------------|
| Termination for convenience| Not permitted        | High | Add with 90-day notice        |
| Data portability           | CSV export available | Med  | Require API access + format   |
| Transition assistance      | Not addressed        | High | Add 90-day transition period  |

If you cannot exit the contract within a reasonable timeframe with your data intact, the contract creates vendor lock-in.

### 7. Findings Summary

Compile all findings prioritized by risk:

| # | Finding                        | Risk | Section | Action Required                 |
|---|--------------------------------|------|---------|---------------------------------|
| 1 | No work product IP assignment  | Crit | 4.4     | Add IP assignment clause        |
| 2 | No RTO/RPO commitments         | Crit | 6.3     | Define recovery objectives      |
| 3 | Broad license to customer data | High | 4.3     | Narrow to service delivery      |

## Quality checklist

Before delivering a contract review, verify:

- [ ] Every finding cites a specific section number or notes the clause is missing
- [ ] Risk ratings are consistent — Critical means business-threatening, not inconvenient
- [ ] IP ownership is reviewed for both pre-existing IP and work product
- [ ] Data handling covers processing terms, breach notification, and post-termination deletion
- [ ] SLAs have measurable commitments with defined remedies
- [ ] Termination provisions include data portability and transition assistance
- [ ] Findings summary is prioritized with specific recommended actions

## Common mistakes

- **Reviewing only what is written.** Missing clauses are findings. No SLA, no data deletion — these omissions are risks.
- **Treating all risks as equal.** A missing comma is not the same risk as unlimited liability. Rate findings consistently.
- **Ignoring the "other party" position.** If you are the vendor, customer-favorable terms are your risk. Adjust review posture to your role.
- **Skipping auto-renewal terms.** Contracts that silently renew with uncapped price increases are expensive surprises.
- **Reviewing without context.** A $5K SaaS tool and a $2M infrastructure contract require different risk tolerances.
- **Not flagging missing DPAs.** If personal data is processed without a Data Processing Agreement, this is a regulatory gap.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [The-AI-Directory-Company](https://github.com/The-AI-Directory-Company)
- **Source:** [The-AI-Directory-Company/agents-and-skills](https://github.com/The-AI-Directory-Company/agents-and-skills)
- **License:** MIT
- **Homepage:** https://ai-directory.company

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-the-ai-directory-company-agents-and-skills-contract-review-checklist
- Seller: https://agentstack.voostack.com/s/the-ai-directory-company
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.