Contract Review Checklist skill for Codex

Gives the Codex app a display name, a one-line description and a starter prompt for this skill.

interface:
  display_name: "Contract Review Checklist"
  short_description: "Know what you are signing before counsel does"
  default_prompt: "$contract-review-checklist Review this SaaS subscription agreement from the customer side and list the risky clauses"

# Clause checklist

Detailed checks per clause. Read the sections that apply to the contract type, then
the "Contract-type extras" at the end. Each item: what to check, red flags, typical ask.
Typical asks are common market positions, not legal advice; counsel decides.

## Definitions

- Check: "Confidential Information", "Customer Data", "Deliverables", "Affiliate",
  "Fees", "Services", "Documentation", "Losses".
- Red flags: Confidential Information limited to items marked "confidential"; "Customer
  Data" excluding derived or usage data; "Affiliate" broad enough to let a competitor in.
- Ask: include information that a reasonable person would understand to be confidential;
  define Customer Data to include outputs generated from it.

## Scope, services and SLAs

- Check: what exactly is delivered, where it is specified (SOW, documentation URL),
  service levels, support hours, credits and their cap.
- Red flags: vendor may modify services or documentation at will; SLA credits are the
  "sole and exclusive remedy" with a credit cap of a few percent; no right to terminate
  for chronic SLA failure.
- Ask: no material reduction in functionality during the term; termination right after
  repeated SLA misses (for example three months in any rolling six).

## Fees and payment

- Check: fee schedule, increases at renewal, overage pricing, payment terms, late
  interest, taxes, expenses, disputed invoices, suspension rights.
- Red flags: uncapped renewal increases; overages billed at list price; suspension on
  short notice for any late payment, including disputed amounts.
- Ask: renewal increase cap (for example the lower of CPI or 5%); right to withhold
  disputed amounts in good faith; written notice and 15-30 days before suspension.

## Term, renewal and termination

- Check: initial term, renewal mechanics, notice windows, termination for convenience,
  for cause (cure periods), for insolvency, effects of termination, survival clause.
- Red flags: auto-renewal with notice window over 60 days; all fees for the remaining
  term accelerate on any termination; no data export period.
- Ask: 30-day notice; termination for convenience with pro-rata refund of prepaid fees
  (customer side) or minimum commitment (vendor side); 30-60 days to export data after
  termination, then certified deletion.

## Limitation of liability

- Check: cap amount and basis (fees paid vs payable, period), mutuality, exclusion of
  indirect/consequential damages, carve-outs from cap and from exclusion.
- Red flags: cap tied to a short period (1-3 months); cap applies to indemnities and
  confidentiality; exclusions cover "loss of data" for a data-processing service; cap
  only protects one side.
- Ask: mutual cap of 12 months' fees; carve-outs for indemnity obligations, breach of
  confidentiality, gross negligence, wilful misconduct, and (often) a separate higher cap
  for data protection breaches.

## Indemnification

- Check: who indemnifies whom for what; procedure (notice, control of defence,
  cooperation, settlement consent); exclusions; remedies for IP claims.
- Red flags: one-way indemnity from the weaker party; indemnity for "any claim arising
  from" use; no consent right over settlements that admit fault.
- Ask: vendor IP infringement indemnity with modify/replace/refund remedies; each party
  indemnifies for its own legal violations; no settlement imposing obligations without
  consent.

## Intellectual property

- Check: ownership of pre-existing IP, deliverables, customisations, feedback,
  customer data, aggregated data, and AI training rights.
- Red flags: vendor owns custom deliverables the customer paid for; feedback clause
  broad enough to cover customer confidential information; rights to train models on
  customer data without opt-out.
- Ask: customer owns deliverables created specifically for it (or gets a perpetual,
  royalty-free licence); explicit prohibition or opt-in for training on customer data.

## Confidentiality

- Check: duration, exclusions, permitted disclosures, return/destruction, trade secret
  survival, residuals clause.
- Red flags: obligations end shortly after termination; "residuals" clause allowing use
  of anything retained in memory.
- Ask: 3-5 years after termination, trade secrets for as long as they remain secret;
  delete the residuals clause or narrow it.

## Data protection and security

- Check: whether personal data is processed; DPA attached; roles (controller,
  processor); sub-processor list and change notice; international transfer mechanism
  (for example EU Standard Contractual Clauses); breach notification timing; security
  standards (SOC 2 report, ISO 27001); audit rights; deletion on exit.
- Red flags: no DPA despite personal data; breach notice "without undue delay" with no
  outer limit; sub-processors added without notice; no right to object.
- Ask: DPA as an exhibit; breach notification within a fixed window (24-72 hours is
  common); notice of new sub-processors with a right to object or terminate; annual
  security report.

## Warranties and disclaimers

- Check: performance warranty, compliance with laws, non-infringement, authority,
  malware, disclaimers.
- Red flags: everything "as is"; warranty remedy limited to re-performance with no
  refund.
- Ask: services perform materially per documentation; remedy of fix, then refund of
  prepaid fees for the non-conforming period.

## Insurance

- Check: required coverage types and amounts (general liability, professional/E&O,
  cyber), certificates, additional insured status.
- Ask: cyber coverage for vendors holding customer data; amounts proportionate to deal
  size.

## Assignment, change of control, subcontracting

- Red flags: free assignment by the counterparty to anyone, including a competitor.
- Ask: assignment only with consent, except to a successor in a merger or sale of
  substantially all assets, with notice.

## Restrictive covenants

- Check: exclusivity, non-compete, non-solicitation of employees, most-favoured-nation
  pricing, publicity (use of logo).
- Red flags: broad non-solicit that blocks hiring from public job ads; logo use without
  consent.
- Ask: non-solicit excludes general advertising; publicity only with written consent.

## Governing law and disputes

- Check: governing law, venue, arbitration vs courts, jury waiver, escalation process,
  injunctive relief carve-outs.
- Note: enforceability of many clauses depends on jurisdiction. Flag unfamiliar governing
  law for counsel rather than assessing it.

## Boilerplate worth reading

- Entire agreement and order of precedence; amendments only in writing; notices (address
  and email validity); force majeure scope (does it excuse payment? does it include
  cyberattacks?); severability; counterparts and e-signature.

## Contract-type extras

### NDA
- Mutual vs one-way matches the actual information flow; purpose limitation; no hidden
  licence or non-compete; term reasonable; compelled disclosure procedure.

### SOW / consulting / services
- Deliverables and acceptance criteria are testable; acceptance deemed after a set period;
  change-order process; who supplies what (dependencies); payment milestones tied to
  acceptance; key personnel; IP assignment on payment.

### SaaS subscription
- Data export format and window; uptime commitment; support response times; usage limits
  and overage; price lock; suspension rights; AI features and data use.

### Independent contractor
- Worker classification depends on actual working conditions and local law, not the
  label in the contract; flag for counsel. IP assignment and moral-rights waiver where
  applicable; invoicing and expenses; confidentiality; no exclusivity unless paid for.

### DPA
- Subject matter, duration, nature and purpose of processing, types of data and data
  subjects, documented instructions, confidentiality of personnel, security measures
  annex, sub-processors, assistance with data subject requests, deletion or return, audit.