How to use the Vendor Agreement Review agent skill

What the skill makes the agent do

Once installed, the agent reads a vendor agreement and compares it to your team's playbook, which it reads from a configuration file you set up. It lists every term that deviates from that playbook, rates each issue by severity, explains the business impact, and drafts specific replacement clause language rather than general advice to consider revising.

The agent also checks for a deal-breaker term first, suggests who should approve the deal, and writes the results up as a review memo. The output is meant to be checked by a qualified lawyer before anyone acts on it.

• Flags each term that deviates from your playbook
• Rates each issue by severity and explains business impact
• Drafts specific redline language for each fix
• Checks for a deal-breaker term before the detailed review
• Suggests the approver and escalation call where needed

What you need before you start

The skill is written for Claude Code or a compatible SKILL.md agent. It also depends on the claude-for-legal commercial-legal plugin, which holds your practice profile. The profile is a file named CLAUDE.md at ~/.claude/plugins/config/claude-for-legal/commercial-legal/CLAUDE.md. You also need the vendor agreement document itself.

A configured practice profile is optional if you are willing to run a generic provisional review, described below.

• Claude Code or a compatible SKILL.md agent
• The claude-for-legal commercial-legal plugin
• A practice profile at ~/.claude/plugins/config/claude-for-legal/commercial-legal/CLAUDE.md (optional for provisional mode)
• The vendor agreement document to review

Install the skill

Download the ZIP from this page and unzip it. The package contains a single file, SKILL.md. Put the unzipped folder in one of two places, depending on how you want to use it.

To make the skill available across all your projects, place it in ~/.claude/skills/. To make it available only inside one project, place it in that project's .claude/skills/ folder.

If you use the Claude apps instead, you can upload the skill under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside the project folder
• Claude apps: Settings → Capabilities → Skills, then upload

Set up your playbook

The agent reviews against your team's standard positions, not market standard. The playbook file tells it what your standard positions are, which fallbacks you have accepted before, what you never accept, who approves what, and the one deal-breaker to check first.

The skill points to the configuration path shown above. The source also describes a /commercial-legal:cold-start-interview command for configuring the profile, which asks questions to set it up. Run that before relying on tailored output.

• Standard positions for your team
• Accepted fallbacks
• Positions you never accept
• Approval matrix
• Deal-breaker term to check first

Trigger the review with natural requests

The skill is loaded when a vendor MSA, services agreement, or similar is detected, and the source notes it is loaded by the /commercial-legal:review command. You can also describe what you want in plain language alongside the agreement.

The agent will ask a few questions before it runs the detailed review. It checks which side your company is on (vendor or customer), and it asks for the annual contract value if the main agreement does not state one.

• Attach the agreement and ask for a review against our playbook
• Ask which side we are on if the contract is a reseller, partnership or revenue share
• Provide the Order Form value when the MSA does not state one

Run a provisional review without a playbook

If your profile is not configured, the agent offers two choices. You can configure the profile first, or reply with the word "provisional". A provisional run uses generic defaults such as US jurisdiction and middle risk appetite, and flags common vendor-side risks from first principles, such as unlimited liability, no data-breach carveout, uncapped indemnity and auto-renewal without notice.

Every finding in a provisional run is tagged [PROVISIONAL], and the output ends with a prompt to run the cold-start interview. Treat a provisional memo as a preview, not a tailored review.

• Use provisional mode to see what the skill does before committing to setup
• Expect every finding to be tagged [PROVISIONAL]

Safety notes: scripts, network and privilege

According to the skill's listing, it runs no scripts and uses no network. It is a set of instructions in SKILL.md, not a program that calls out to other services.

The skill also warns about privilege. If you name a destination such as a public channel, a company-wide list, a counterparty or a vendor, the agent will ask whether that destination is inside the privilege circle. Sending work product outside that circle can waive legal privilege. Do not paste the memo into a counterparty thread or a broad channel without checking.

• Runs scripts: no
• Uses network: no
• Ask the agent to check the destination before sharing any output
• Use the privileged version for legal only, or a sanitized version for wider channels

Tips for better results

Keep your playbook current, because the agent can only apply positions that are written down. Give the full agreement, and if it incorporates a data processing agreement by URL, expect the data-protection analysis to be partial unless you supply that document too.

The skill is designed for a lawyer who acts on the memo. Read the findings and redlines yourself before sending anything to the counterparty.

• Keep the playbook file up to date
• Supply the DPA if the agreement refers to it by URL
• Review every redline before it leaves your team