Risk Analysis — Clause-by-Clause Risk Scoring

VerifiedSafe

Performs deep clause-by-clause risk scoring across 10 categories with poison pill detection and financial exposure estimation.

Sby Skills Guide Bot
SecurityIntermediate
7/26/2026
Claude CodeCodex
#legal#contracts#risk-analysis#compliance#due-diligence

Recommended for

Automated summary

Analyzes a contract clause by clause, scoring each one from 1 to 10 across ten risk categories, flagging poison pills and estimating financial exposure.

Strengths

  • Explicit ten-category scoring grid (liability, indemnification, IP, termination, non-compete, confidentiality, liability caps, data, disputes, compliance) that makes the analysis repeatable
  • Dedicated poison-pill detection: obligations buried in definitions, scope-expanding cross-references, indefinite survival, silent auto-renewal, unilateral amendment rights
  • Financial exposure estimation for every clause scoring 7 or above, covering direct and indirect costs
  • Asks which party's perspective to analyze from and defaults to the non-drafting party when unspecified

Limitations

  • Not a substitute for legal counsel: it does not verify applicable law or case precedent
  • Financial estimates are only as good as the stated amounts in the contract; indirect costs remain indicative
  • Assumes a readable single-file contract, so scanned PDFs or very large schedules may be poorly covered
When to use it

Use it before signing a contract when you need to know where the risk concentrates and what it could cost.

When not to use it

Skip it if you only want a plain summary of the contract or redline-style rewording suggestions.

Security analysis

Safe
Quality score88/100

The skill only uses read-only tools (Read, Glob, Grep) to analyze contract text. It does not execute commands, access network resources, modify files, or handle sensitive data beyond the user-provided contract. No destructive, exfiltrating, or obfuscated actions are instructed.

No concerns found

How this analysis is made

Examples

Pre-signature risk review
/risk-analysis — read ./contracts/vendor-msa-2024.pdf.txt from my perspective as the client. Score every material clause, flag any poison pills, and tell me the worst three clauses and their estimated financial exposure.
Poison pill hunt
What are the risks in this SaaS subscription agreement? Focus on auto-renewal, unilateral amendment rights, and survival clauses, then give me a heat map of where the danger sits.
Vendor-side check
I am the service provider reviewing this MSA. Run a clause-by-clause risk analysis across all ten categories and show me which clauses I should push back on before signing.

name: risk-analysis description: 'Performs deep clause-by-clause risk scoring across 10 categories with

poison pill detection and financial exposure estimation. Use when a user

needs to understand the specific risks in a contract before signing.

Trigger with "/risk-analysis" or "what are the risks in this contract".

' allowed-tools: Read, Glob, Grep version: 1.0.0 author: Intent Solutions jeremy@intentsolutions.io license: MIT tags:

  • legal
  • contracts
  • risk
  • analysis
  • due-diligence
  • compliance compatibility: Designed for Claude Code, also compatible with Codex and OpenClaw

Risk Analysis — Clause-by-Clause Risk Scoring

Standalone deep-dive skill that scores every material clause in a contract against ten risk categories, flags poison pills, and estimates financial exposure. Designed to surface the clauses that could cost the most money or create the most liability.

Overview

Every contract contains trade-offs. This skill systematically identifies which trade-offs are reasonable and which are dangerous by scoring clauses on a 1-10 severity scale across ten categories. It specifically hunts for "poison pills" — clauses that appear innocuous but create disproportionate risk when triggered.

Unlike a general review, this skill produces a quantified risk profile: a heat map of where the danger lives, what it could cost, and what to do about it.

Prerequisites

  • A contract must be provided as a file path or pasted text.
  • The user should ideally specify which party's perspective to analyze from (e.g., "I am the service provider" or "I am the client"). If not specified, the analysis defaults to the party that did not draft the contract.

Instructions

  1. Read the full contract. Use the Read tool if a file path is provided.

  2. Identify all material clauses. Extract each numbered section or clause that creates obligations, rights, restrictions, or liabilities.

  3. Score each clause across 10 risk categories (1 = minimal risk, 10 = extreme risk):

    | # | Category | What to Evaluate | |---|----------|------------------| | 1 | Financial Liability | Uncapped damages, liquidated damages, penalty clauses | | 2 | Indemnification | Scope, carve-outs, caps, duty to defend vs. hold harmless | | 3 | Intellectual Property | Work-for-hire, assignment breadth, background IP protection | | 4 | Termination | For-cause vs. convenience, cure periods, termination fees | | 5 | Non-Compete / Non-Solicit | Duration, geographic scope, industry breadth | | 6 | Confidentiality | Duration, scope of "confidential," residual knowledge carve-outs | | 7 | Limitation of Liability | Cap amount, exclusion of consequential damages, mutual vs. one-sided | | 8 | Data & Privacy | Data ownership, breach notification, sub-processor controls | | 9 | Dispute Resolution | Arbitration vs. litigation, venue, fee allocation, class action waiver | | 10 | Regulatory / Compliance | Representations of compliance, audit rights, change-in-law provisions |

  4. Detect poison pills. Scan for these specific patterns:

    • Clauses buried in definitions that create substantive obligations
    • Cross-references that expand scope (e.g., "including but not limited to" chains that remove boundaries)
    • Survival clauses that extend obligations indefinitely post-termination
    • Automatic renewal with silent rollover and difficult opt-out
    • Unilateral amendment rights ("Company may modify these terms at any time")
    • Fee escalation triggers hidden in appendices or schedules
    • Broad assignment rights that allow transfer to unknown third parties
    • Waiver of jury trial buried in boilerplate
  5. Estimate financial exposure. For each high-risk clause (score >= 7), estimate the potential financial impact:

    • Direct costs: Stated penalties, liquidated damages, fee caps
    • Indirect costs: Lost IP value, opportunity cost of non-compete, litigation expenses
    • Worst-case scenario: Maximum realistic exposure if the clause triggers
  6. Build the risk heat map. Rank all clauses by composite risk score (severity x probability). Flag the top 5 as "Critical Attention Required."

  7. Generate recommendations. For each high-risk clause, provide:

    • What to negotiate (specific language changes)
    • Fallback position if negotiation fails
    • Walk-away threshold

Output

Filename: RISK-ANALYSIS-{YYYY-MM-DD}.md

# Risk Analysis Report
## Contract Summary
## Risk Perspective: [which party]
## Risk Heat Map
| Clause | Section | Category | Severity (1-10) | Probability | Composite |
## Poison Pill Alerts
## Financial Exposure Summary
| Risk | Best Case | Expected | Worst Case |
## Top 5 Critical Risks (detailed analysis)
## Negotiation Recommendations
## Overall Risk Rating: [LOW / MODERATE / HIGH / CRITICAL]
## Disclaimer

Error Handling

| Failure Mode | Cause | Resolution | |--------------|-------|------------| | Missing party perspective | User did not specify their role | Ask which party they represent before proceeding | | Incomplete contract | Schedules or exhibits referenced but not provided | Note the gaps explicitly; score only what is available | | Ambiguous clause language | Deliberately vague or circular definitions | Flag as a risk in itself; score higher for intentional ambiguity | | No financial terms stated | Contract omits dollar amounts | Estimate exposure qualitatively (low/medium/high) instead of dollar amounts | | Multiple governing laws | Contract references conflicting jurisdictions | Flag the conflict as a dispute-resolution risk |

Examples

Example 1 — SaaS Agreement risk analysis:

User: Analyze the risks in this SaaS agreement. I am the customer.

Top Risks:
1. Section 9.3 — Indemnification: 9/10
   Customer indemnifies vendor for "any claims arising from use" with no cap.
   Exposure: Potentially unlimited. Negotiate mutual indemnification with cap.

2. Section 14.1 — Unilateral Amendment: 8/10
   "Company may modify terms with 30 days notice." No opt-out except
   termination. Poison pill: effectively allows price increases mid-term.
   Negotiate: Require mutual consent for material changes.

3. Section 5.2 — Data Ownership: 8/10
   "Customer grants Company a perpetual, irrevocable license to use
   Customer Data for product improvement." Survives termination.
   Negotiate: Limit to anonymized, aggregated data only.

Overall Risk Rating: HIGH

Example 2 — Employment agreement:

User: What are the risks in ~/contracts/offer-letter.pdf? I am the employee.

Poison Pill Detected:
Section 12(c) — "Inventions Assignment" includes work created
"using any Company equipment" with no time-of-day limitation.
Combined with Section 3(a) requiring use of company laptop,
this effectively assigns ALL inventions to employer — including
personal side projects.

Resources


Legal Disclaimer: This skill provides AI-generated risk analysis for informational and educational purposes only. It does not constitute legal advice, create an attorney-client relationship, or substitute for consultation with a qualified attorney. Risk scores are heuristic estimates, not legal determinations. Actual risk depends on jurisdiction, specific facts, and applicable law. Always consult a licensed attorney before making decisions based on this analysis.

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/risk-analysis-clause-by-clause-risk-scoring-ms1aw486/download' --output '.skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486/SKILL.md.part' && mv '.skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486/SKILL.md.part' '.skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

Environment declared by the author: Designed for Claude Code, also compatible with Codex and OpenClaw

Tools declared by the author (check availability in your agent): Read, Glob, Grep

Original excerpt: Prerequisites
  • A contract must be provided as a file path or pasted text.
  • The user should ideally specify which party's perspective to analyze from (e.g., "I am the service provider" or "I am the client"). If not specified, the analysis defaults to the party that did not draft the contract.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486/SKILL.md' && test -s '.skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/risk-analysis' && cp -R '.skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486' '.claude/skills/risk-analysis'

Codex
test -f '.skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486/SKILL.md' && test -s '.skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486/SKILL.md' && mkdir -p '.agents/skills' && test ! -e '.agents/skills/risk-analysis' && cp -R '.skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486' '.agents/skills/risk-analysis'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486'

openskills read 'risk-analysis-clause-by-clause-risk-scoring-ms1aw486'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/risk-analysis-clause-by-clause-risk-scoring-ms1aw486/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills