Atlas / Skills / revfactory / Contract Checklist

Contract ChecklistCAUTION

skills/revfactory/contract-checklist
Verdict
CAUTION
Grade
B
Trust score
89 /100
Version
—
Hosts
—
License
Apache-2.0
Stars
1,297
01

Overview

An agent skill published by revfactory.

Read from source at commit 459e1bb8f76eOBSERVED · 2026-10-12
02

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: contract-checklist
description: "Procurement contract review checklist. Referenced by contract-reviewer and acceptance-builder agents when reviewing contract terms and establishing acceptance criteria. Used for 'contract review', 'contract terms', 'acceptance criteria' requests. Note: legal counsel and contract notarization are out of scope."
---

# Contract Checklist — Procurement Contract Review Checklist

Enhances the contract review capabilities of contract-reviewer / acceptance-builder agents.

## Contract Review Essential Items

### Key Clause Checklist

| Clause | Verification Points | Risk Level |
|--------|-------------------|------------|
| Scope | Scope clarity, exclusions | High |
| Price | Fixed/variable, exchange rate, taxes | High |
| Delivery | Milestones, delay penalties | High |
| Quality | Acceptance criteria, SLA, warranty | High |
| Intellectual Property (IP) | Ownership, license, assignment | High |
| Confidentiality (NDA) | Scope, duration, breach penalties | Medium |
| Termination | Grounds, notice period, settlement | Medium |
| Liability Limitation | Damages cap, indemnification | Medium |
| Dispute Resolution | Arbitration/litigation, jurisdiction | Low |
| Force Majeure | Definition, notification, indemnification | Low |

### Price Clause Details

```
Verification items:
- [ ] Total contract amount specified
- [ ] Payment terms (advance/milestone/balance ratios)
- [ ] Payment timing (N days after delivery)
- [ ] Additional cost trigger conditions
- [ ] Price index clause (long-term contracts)
- [ ] Exchange rate fluctuation handling (international)
- [ ] Tax liability assignment
- [ ] Late payment interest rate
```

### SLA Clause Details

| SLA Item | Measurement Criteria | Non-compliance Action |
|----------|---------------------|----------------------|
| Availability | Monthly 99.9% | Credit refund |
| Response time | P1: 15 min, P2: 1 hour | Penalty |
| Resolution time | P1: 4 hours, P2: 8 hours | Escalation |
| Reporting | Monthly SLA report | Warning if not submitted |

## Acceptance Criteria Design

### Acceptance Process Steps

```
1. Establish acceptance plan (before delivery)
2. Confirm deliverable receipt
3. Functional/performance testing
4. Defect classification (Critical/Major/Minor)
5. Correction request (with deadline)
6. Re-inspection
7. Issue acceptance completion certificate
8. Authorize payment
```

### Acceptance Criteria Template

| Inspection Item | Criteria | Method | Pass Condition |
|----------------|----------|--------|----------------|
| Functional completeness | 100% requirements implemented | Checklist | Must-have 100%, Optional 80% |
| Performance | Response time ≤2s | Load test | P95 criteria met |
| Security | OWASP Top 10 addressed | Vulnerability scan | 0 Critical findings |
| Documentation | Manuals, API docs | Document review | 90%+ completeness |
| Training | Operator training complete | Training completion | 100% completion rate |

### Defect Classification

| Level | Definition | Handling |
|-------|-----------|----------|
| Critical | Core functionality unusable | Correction required, acceptance held |
| Major | Key functionality limited | Correction required, conditional acceptance |
| Minor | Minor issue | Next iteration fix, acceptance proceeds |

## Negotiation Points Guide

| Buyer-favorable | Vendor-favorable | Compromise |
|----------------|-----------------|------------|
| Delay penalties | Penalty waiver | Grace period |
| Fixed price | Variable price | Price index cap |
| Unlimited liability | Liability cap | N times contract value |
| Exclusive license | Non-exclusive | Use-restricted license |

## Quality Checklist

| Item | Criteria |
|------|----------|
| Key clauses | All 10 clauses reviewed |
| Risks | High-risk items legally reviewed |
| SLA | Measurement criteria + non-compliance actions |
| Acceptance | Items + criteria + methods specified |
| Defect classification | 3-level definition |
| Termination | Grounds + notice + settlement specified |
03

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeNA
L2Instruction surface (what it tells the agent)WARN
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (1)

MEDIUMPrompt injection · review.misleading_scope · CWE-94, CWE-1427
<listing:description>
Procurement contract review checklist. Referenced by contract-reviewer and acceptance-builder agents when reviewing contract terms and establishing acceptance criteria.
Why it matters. The package description frames it as a procurement contract review checklist for contract-reviewer and acceptance-builder agents, but the package also bundles two unrelated agent definitions (license-strategist for IP portfolio and license-specialist for open source launcher) that are not disclosed
Fix. rewrite it so the instruction says plainly what it does, and asks the user before it acts

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 459e1bb8f76efull audit observations/trust-audit/skill/revfactory__contract-checklist.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-12459e1bb8f76eCAUTIONB89first audit
05

Questions

Is Contract Checklist safe to install?

With care. The audit graded it B (89/100) and found 1 thing worth knowing before you trust this skill, listed below with the exact line each was found on.

What can Contract Checklist access on my machine?

The audit observed no filesystem, network or shell use at all in its source.

How current is this page?

The grade is for one exact copy of the source (459e1bb8f76e), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement