Redline Contract

Review and redline DOCX contracts paragraph by paragraph with tracked changes, clause-level risk analysis, and draft comment responses. Use when a user wants...

Security Scan

The skill's code, instructions, and resource files are internally consistent with a DOCX paragraph-level redlining tool and do not request unrelated credentials or external network access.

Purpose & Capability

Name/description (paragraph-by-paragraph redlines, risk reports, .review.json) matches the included script and SKILL.md workflow; required resources (none) are proportionate.

Instruction Scope

SKILL.md instructs the agent to run the included Python script on local DOCX files and to edit the produced .review.json; the runtime instructions focus on reading/writing DOCX and JSON and do not ask the agent to read unrelated system files, environment variables, or send data to external endpoints.

Install Mechanism

Instruction-only skill with a bundled script — there is no install spec, no network downloads, and no unusual install locations. The script depends on Python libraries (lxml / python-docx) which are typical for DOCX manipulation.

Credentials

The skill declares no environment variables, no credentials, and no config paths. The code operates on user-supplied input/output paths only, which is appropriate for the stated purpose.

Persistence & Privilege

Flags show normal defaults (always: false); the skill does not request permanent/privileged platform presence or attempt to modify other skills or global agent settings.

Assessment

This appears to be a straightforward local DOCX redlining tool. Before installing or running it: 1) Review the provided scripts (you already have them) and run them on copies of your contracts rather than originals. 2) The tool operates locally and does not include network calls, but ensure your environment's Python packages (e.g., lxml/python-docx) are installed from trusted sources. 3) Confirm outputs (.review.json, amended .docx, risk-report.docx) look correct and that tracked changes are accurate. 4) If you have strict data-handling requirements, run the script in a sandboxed environment or on an isolated machine. 5) Note a minor mismatch in the script's dependency error message (mentions python-docx when it imports lxml) — this is likely a documentation slip, not malicious behavior.

Redline

Overview

Use this skill to review contract .docx files at paragraph level and generate:

• a tracked-changes amended .docx
• a risk-report .docx
• a .review.json review dataset

Do not collapse multiple operative paragraphs into one generic comment. Each non-empty paragraph or bullet must be reviewed on its own merits, with distinct risk analysis and replacement language where needed.

Workflow

1. Confirm the supported party and the priority risk areas.
2. Run scripts/contract_review_pipeline.py init-review for each source .docx.
3. Review the generated .review.json paragraph by paragraph.
4. For each clauses[] entry, write a specific assessment tied to that paragraph only:
   • favorability
   • risk_level
   • risk_summary
   • why_it_matters
   • proposed_replacement
5. Draft specific responses for any opponent comments in opponent_comments[].
6. Run materialize to create the amended .docx and risk report .docx.
7. Verify the outputs exist and the tracked changes are readable.

Required Review Standard

• Treat each review unit as one paragraph-level issue, not a whole section summary.
• Do not reuse the same replacement text across unrelated paragraphs.
• If several bullets in the same section have different obligations, analyze and redraft them separately.
• Keep replacement language narrow and operational. Match the exact risk in the source paragraph.
• When reviewing privacy and security language, check for:
  • uncapped or super-capped liability exposure
  • audit overreach
  • subprocessor approval friction
  • cross-border transfer restrictions
  • incident notification deadlines
  • certifications, penetration testing, and customer testing rights
  • unilateral policy updates
  • AI/security terms that exceed the actual service model

Commands

Initialize a review file:

python scripts/contract_review_pipeline.py init-review \
  --input <contract.docx> \
  --output <contract.review.json> \
  --supported-party "<party>" \
  --focus-area "<area-1>" \
  --focus-area "<area-2>" \
  --opponent-comment-author "<author-1>"

Materialize the outputs:

python scripts/contract_review_pipeline.py materialize \
  --input <contract.docx> \
  --review-json <contract.review.json> \
  --amended-output <contract.amended.docx> \
  --report-output <contract.risk-report.docx> \
  --author "Codex Redline Reviewer"

Resources

• JSON field details: references/review-json-schema.md
• Main tool: scripts/contract_review_pipeline.py