Contracts

Organize, track, and analyze contracts with renewal alerts, clause lookups, and multi-role support for individuals, landlords, freelancers, and legal teams.

Security Scan

The skill is an instruction-only, local-first contract manager whose requested actions, storage layout, and privacy rules align with its stated purpose and do not ask for extraneous credentials or installs.

Purpose & Capability

Name/description (contract organization, clause lookups, alerts) match the instructions and the included docs: all operations are local, metadata extraction, deadline tracking, and role-specific workflows. No unrelated credentials, binaries, or cloud services are requested.

Instruction Scope

SKILL.md and supporting files clearly restrict behavior (local-only, no legal advice, no unsolicited sharing) and specify concrete file operations (create ~/contracts/{name}/, save PDF, extract meta.md, set alerts). Minor ambiguity: calendar integration and 'export to calendar app' are referenced but not concretely specified—this requires an explicit user action or connector at runtime; otherwise the instructions remain within scope.

Install Mechanism

Instruction-only skill with no install spec or code files — nothing is downloaded or written by an installer. This is the lowest-risk install profile.

Credentials

No environment variables, credentials, or config paths are requested. The data handled (contract PDFs and extracted metadata) is appropriate for the described functionality. The security.md explicitly forbids extracting critical identifiers (SSNs, bank accounts) and cloud upload.

Persistence & Privilege

always:false and no system-wide config changes are requested. The skill only prescribes creating and managing ~/contracts/ under the user's home — a reasonable, scoped level of persistence.

Assessment

This skill is coherent and low-risk in itself: it only describes local file organization, metadata extraction, searches, and alerts. However, it is instruction-only — there is no code enforcing the 'no cloud' rules, so you must trust the agent runtime to follow the SKILL.md. Before installing or using it, verify: (1) the AI/agent implementation will not automatically upload files or telemetry to external services; (2) any calendar/export action requires your explicit consent and configuration to a trusted calendar; (3) your backups of ~/contracts/ are encrypted and access-controlled (chmod 700 is recommended); and (4) you understand the skill will access full contract text locally to extract metadata. If you need stricter guarantees, prefer a skill with audited code or a vendor-provided integration that enforces encryption and access controls.

Role

Manage all contracts in one place. Track dates, extract key terms, flag expiring items. Scale from personal subscriptions to enterprise contract libraries.

---

Storage

~/contracts/
├── index.md                    # Master list with quick stats
├── by-type/                    # NDAs, leases, subscriptions, etc.
├── by-party/                   # Organized by counterparty
├── {contract-name}/
│   ├── executed.pdf            # Final fully-signed version
│   ├── meta.md                 # Key terms + signature status
│   ├── versions/               # Signature flow tracking
│   │   ├── 01-draft.pdf        # Initial version sent
│   │   ├── 02-signed-them.pdf  # Signed by counterparty
│   │   └── 03-signed-us.pdf    # Countersigned (if sequential)
│   ├── history/                # Amendments after execution
│   └── notes.md                # User notes, flags

Signature states: draft → pending-them → pending-us → executed

---

Quick Reference

Context	Load
Role-specific workflows	roles.md
Contract analysis patterns	analysis.md
Alert and deadline tracking	alerts.md
Security and boundaries	security.md

---

Core Capabilities

1. Extract key terms — Dates, parties, amounts, notice periods, auto-renewal terms
2. Track deadlines — Renewal dates, termination windows, milestone payments
3. Alert proactively — 90/60/30 day warnings before renewals or expirations
4. Quick clause lookup — "What's my cancellation notice period for X?"
5. Cross-contract search — "Find all contracts expiring this quarter"
6. Version tracking — Link amendments to parent contracts
7. Cost aggregation — Total spend across subscriptions/vendors

---

On Upload

When user shares a new contract:

1. Create folder in ~/contracts/{name}/
2. Save as current.pdf
3. Extract to meta.md: parties, effective date, term, value, renewal terms, notice period
4. Add to index.md
5. Set calendar alerts per alerts.md

---

Boundaries

• NO legal advice — Cannot interpret clauses, assess risk, or recommend actions
• NO cloud storage — All contracts stay local unless user explicitly moves them
• NO sharing content — Never send contract text via messages
• "Is this clause good?" → "I can show you the clause, but consult a lawyer for interpretation"

---

Active Contracts

<!-- Count and categories from ~/contracts/index.md -->

Expiring Soon

<!-- Next 90 days from meta.md dates -->