跳到主要内容
知仓学习社ZHICANG

contract-review

律师助理与法律助手、项目管理专家在审核合同、排查条款风险时必备。自动执行基础、商业、法律三层审查,仅添加批注不改原文,一键生成带批注合同、审查摘要、综合意见及业务流程图,让合同风控与业务梳理更高效专业。

执行命令写文件读环境变量(配置)严重 0 · 高危 5anbeime/skill

它会碰到什么

扫了多少27 个文本文件,154 KB
它会碰到什么执行命令写文件读环境变量(配置)
命中总数11 处
命中统计严重 0 · 高 5 · 中 6 · 低 0

关于「读环境变量(配置)」:这个技能会读 process.env 之类的环境变量,但读到的都是端口、目录、超时这类配置项,没有读取密钥类变量。扫描规则原本把「读环境变量」一律算作「读凭据」,本站按变量名做了细化区分,命中明细仍如实列在下面。

逐条看命中(5 条严重或高危)
  • scripts/contract_analyzer.py:41exec-spawn
    result = subprocess.run(
  • scripts/mermaid_renderer.py:87exec-spawn
    subprocess.run(build_cmd(mmd_path, config_path), check=True)
  • scripts/mermaid_renderer.py:93cred-envread
    chrome_path = os.environ.get("PUPPETEER_EXECUTABLE_PATH") or _find_chrome_executable()
  • scripts/mermaid_renderer.py:100exec-spawn
    subprocess.run(build_cmd(mmd_path, config_path), check=True)
  • scripts/mermaid_renderer.py:116exec-spawn
    subprocess.run(build_cmd(sanitized_path, config_path), check=True)

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Contract Review Skill

Overview

This skill performs contract reviews by adding comments only (no edits to the original text). It follows a three-layer review (basic, business, legal) and generates:

  • Annotated contract (.docx)
  • Contract summary (.docx)
  • Consolidated review opinion (.docx)
  • Business flowchart (Mermaid + rendered image)

Language rule: detect the contract’s dominant language and output all generated content (comments, summary, opinion, flowchart text) in that language. Use the guidance in [references/language.md](references/language.md).

Workflow

  1. Unpack the contract (.docx) for XML operations
  2. Read contract text (pandoc or XML)
  3. Execute three-layer review
  4. Add comments to the document
  5. Generate contract summary
  6. Generate consolidated opinion
  7. Generate business flowchart and render image
  8. Repack to .docx

Output Naming

  • Output directory: 审核结果:{ContractName} for Chinese or Review_Result_{ContractName} for English
  • Reviewed contract: {ContractName}_审核版.docx for Chinese or {ContractName}_Reviewed.docx for English
  • Review report: 审核报告.txt for Chinese or Review_Report.txt for English

Comment Principles

  • Comments only: do not modify the original text or formatting
  • Precise anchoring: comment should target specific clauses/paragraphs
  • Structured content: each comment includes issue type, risk reason, and revision suggestion
  • Risk level: carried by reviewer name; do not include a “risk level” line in comment body
  • Output language: use labels in the contract’s language (see references/language.md)

Comment example (English):

[Issue Type] Payment Terms
[Risk Reason] The total amount is stated as USD 100,000 in Section 3.2, but the payment clause lists USD 1,000,000 in Section 5.1. This inconsistency may cause disputes.
[Revision Suggestion] Align the total amount across clauses and clarify whether tax is included.

Review Standards

Use the three-layer review model and the detailed checklist in [references/checklist.md](references/checklist.md).

Layer 1: Basic (text quality)

  • Accuracy of numbers, dates, terms
  • Consistent numbering and references
  • Clarity and lack of ambiguity
  • Formatting and punctuation quality

Layer 2: Business terms

  • Scope, deliverables, quantity/specs
  • Pricing and payment schedule
  • Delivery/acceptance procedures
  • Rights/obligations and performance guarantees

Layer 3: Legal terms

  • Effectiveness and term/termination
  • Liability/penalties and remedies
  • Dispute resolution and governing law
  • Confidentiality, force majeure, IP, notice, authorization

Risk levels (encoded in reviewer name):

  • 🔴 High: core business ambiguity (price, scope, rights/obligations)
  • 🟡 Medium: material but non-core ambiguity
  • 🔵 Low: minimal practical impact

Contract Summary

Generate a structured, objective summary in the contract’s language.

  • See [references/summary.md](references/summary.md) (English template)
  • Use [references/language.md](references/language.md) for language selection and Chinese labels

Output file: 合同概要.docx for Chinese or Contract_Summary.docx for English (default font: 仿宋; adjust if language requires)

Consolidated Opinion

Generate a concise, two-paragraph response for the business team in the contract’s language.

  • See [references/opinion.md](references/opinion.md)

Output file: 综合审核意见.docx for Chinese or Consolidated_Opinion.docx for English (default font: 仿宋; adjust if language requires)

Business Flowchart (Mermaid)

Generate Mermaid flowchart per requirements and render to image.

  • See [references/flowchart.md](references/flowchart.md)

Outputs:

  • business_flowchart.mmd
  • business_flowchart.png

li## Technical Notes

Core workflow:

  1. Unpack → 2. Add comments → 3. Summary → 4. Opinion → 5. Flowchart → 6. Repack

API & implementation details:

  • [references/technical.md](references/technical.md)

Dependencies

  • Python 3.9+ (3.10+ recommended)
  • pandoc (system install)
  • defusedxml
  • Mermaid CLI (mmdc) for rendering
  • python-docx for rich text output

Troubleshooting (Short)

  • Comments missing in Word: run doc.verify_comments() and re-save
  • find_paragraph fails: shorten search text; confirm actual paragraph text
  • Mermaid render fails: ensure mmdc installed; use Chrome path or Puppeteer config

Examples

See [references/examples.md](references/examples.md) for a full workflow example.

Important Rules

  1. Never alter original contract text
  2. Review all three layers, do not skip items
  3. Ensure risk level is accurate and consistent
  4. Keep comments precise, professional, and actionable
  5. Flowchart must come strictly from the contract text
  6. Summary is objective only; no risk analysis
  7. Opinion only reflects findings already identified

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 6,808
本站分层T1
该仓技能数84
原文件路径skills/legal-assistant-skills-main/contract-review/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 84 个技能