Use when reviewing one-way (unilateral) commercial NDAs, analyzing key clauses for risk, producing clause-by-clause issue logs with preferred redlines, fallbacks, and negotiation guidance.
Use when reviewing one-way (unilateral) commercial NDAs, analyzing key clauses for risk, producing clause-by-clause issue logs with preferred redlines, fallbacks, and negotiation guidance.
This skill is a structured review playbook. It is not legal advice. When the NDA is high-risk, high-value, cross-border, or otherwise sensitive, escalate to qualified counsel.
DRAFT — qualified counsel review required before signing.
Reviewer of record: __________________________ (named lawyer, required before send)
Every output produced by this skill MUST carry this header verbatim and MUST leave the reviewer-of-record line in place until a named qualified lawyer has signed off. Do not send any redline, issue log, or summary to a counterparty until this line is filled.
Overview
What this skill does
What it does not do
Reviews an NDA and outputs issues, risks, and suggested redlines
Provide jurisdiction-specific legal conclusions
Supports Recipient or Discloser perspectives (user-chosen)
Guarantee enforceability
Produces an executive summary + clause-by-clause markup guidance
Replace counsel for complex deals
Scope: supports one-way (unilateral) commercial NDAs only. If mutual, this playbook is out of scope.
Are we reviewing as Recipient (we receive confidential info) or Discloser (we disclose confidential info)?
Confirm the NDA is one-way (unilateral) — if mutual, stop: out of scope
What is the purpose / permitted use?
What are the parties (legal names) and any affiliates?
What information types are expected (tech, pricing, customer data, product roadmap, source code)?
Desired timeline: when do we need to sign?
B. Practical constraints (recommended)
Do we need to share with affiliates, advisors, contractors, auditors, or potential acquirers?
Will we export data across borders or store in cloud tools?
Will any personal data be shared?
Jurisdiction-agnostic note: avoid asserting "this clause is invalid" without governing law; focus on commercial risk, operational feasibility, and market norms.
Deliverables
A. Executive Summary (1 page)
Party role (Recipient or Discloser) and confirmation it is one-way
Top 5 negotiation points (ranked)
"Sign as-is" / "Sign with changes" / "Escalate" recommendation
Every row in the Issue Log MUST carry one of the three bands below. Use the most-severe band that applies; do not average.
Band
Criteria (any one triggers the band)
Typical examples
High (H)
Forced or one-way arbitration imposed on Recipient; unlimited liability or uncapped consequential damages; non-mutual indemnity that survives termination; perpetual confidentiality on all information with no trade-secret distinction; one-way attorneys' fees + automatic injunction against Recipient; standstill / no-hire / no-contact bundled into the NDA; cross-border personal-data flow with no carve-out; assignment clause that triggers on change of control.
"Recipient indemnifies Discloser for any and all claims"; "Recipient waives right to a jury and consents to arbitration in [foreign seat]"; "obligations survive in perpetuity".
Medium (M)
Ambiguity in a defined term that could be read against us in negotiation but is not catastrophic; onerous-but-bounded scope (e.g., 5-year confidentiality on non-trade-secret info); missing standard carve-outs (compelled disclosure, prior knowledge, independent development) where the omission is recoverable in redline; representative-liability language without a written-confidentiality limiter; return/destruction language with no backup carve-out.
"Confidential Information includes any information disclosed in connection with the Purpose" (no marking standard); "Recipient shall be liable for any breach by its Representatives".
Low (L)
Minor drafting cleanup — typos, defined-term capitalisation, cross-reference errors, stylistic inconsistencies; boilerplate that is non-standard but commercially harmless; clarifying tweaks that improve readability without shifting risk.
Scoring discipline: if you can credibly explain to a deal lead in one sentence why a clause could materially damage the business or expose the firm, it is at least Medium. If the explanation requires "and then if X, and then if Y…", it is Low.
5-Step Workflow
Step 1 — Identify Stance (Recipient vs Discloser)
Confirm which side we are on for this specific NDA (titles are often misleading)
Confirm the NDA is one-way (unilateral). If mutual, stop: out of scope.
Quick heuristic:
If asked to keep their info secret → Recipient
If sharing our sensitive info → Discloser
Step 2 — Triage the NDA (Fast Risk Scan)
Flag immediately:
Perpetual confidentiality for all information (no trade secret distinction)
Residuals clause allowing use of "memory" or generalized knowledge
Injunctive relief + attorneys' fees one-way against Recipient
Indemnity for breach or broad third-party claims
No carve-outs for compelled disclosure or prior knowledge
Overbroad definition: "all information, whether marked or not" with no reasonableness
Affiliate coverage missing when we must share internally
Step 3 — Clause-by-Clause Review
Use reference modules:
references/KEY_CLAUSES.md — Common NDA clauses and implications
references/PARTY_OBLIGATIONS.md — Analysis of party obligations
references/DURATION_SCOPE.md — Duration and scope considerations
references/REMEDIES_LIABILITY.md — Remedies and liability provisions
references/STANDARD_EXCEPTIONS.md — Standard exceptions
Step 4 — Draft Redlines and Negotiation Positions
For each issue:
Preferred redline (best risk outcome)
Fallback position (acceptable compromise)
Rationale (1-2 sentences: business + operational feasibility)
Owner (Legal, Sales, Security, Product)
Deadline
Negotiation discipline: do not propose 20 changes. Focus on 5-10 that materially change risk.
Step 5 — Finalize the Package
Ensure consistency across definitions
Confirm operational feasibility
Re-scan Step 2 triage list; ensure each flagged item is in the issue log
Provide "what we changed and why" summary
Perspective-Specific Checklists
A. Recipient Checklist (Incoming NDA)
Topic
Red Flags
Typical Ask
Definition of Confidential Information
Overbroad; includes independently developed info; no marking standard
Add reasonableness + identification standard
Purpose / Permitted Use
Any use restriction beyond evaluation; bans on internal sharing
Tie to stated purpose; allow internal need-to-know
Representatives
Liable for any representative breach without control
Limit to written confidentiality; commercially reasonable care
M&A / Due diligence: ensure diligence sharing (advisors, financing, affiliates) is permitted and data room exports/notes are covered.
B. Discloser Checklist (When Sharing Sensitive Info)
Topic
Red Flags
Typical Ask
Definition
Too narrow; requires marking only; excludes oral disclosures
Add oral confirmation mechanism
Security standard
Only "reasonable" with no baseline
Add minimum safeguards
Exclusions
Too broad (e.g., "independently developed" with no proof)
Require written evidence
Term & survival
Too short
Extend for sensitive categories
Remedies
No equitable relief, no fees
Add equitable relief carefully
Investor / VC: watch for standstill, solicitation, and "no contact" provisions.
Limitations
This skill provides a structured framework, not legal advice
Jurisdiction-specific law not covered; always verify with qualified counsel
High-risk, high-value, or cross-border deals require escalation
Does not cover mutual NDAs — those require separate review approach
All outputs must be reviewed by a qualified legal professional before use
QA Remediation (LegalQuants, 2026-05)
This skill was QA'd by LegalQuants against the Legal Skill Design Framework on 2026-05-11 (verdict: SOME CONCERN) and remediated on 2026-05-12. The remediations target the two open gaps from that report — undefined H/M/L risk bands and an accountability gap not structurally enforced by the output shape — while leaving the technical content intact.
What changed
H/M/L risk bands now operationalised. A new section "Risk Band Rubric (How to Score H / M / L)" was added immediately after the Clause-by-Clause Issue Log table, with explicit criteria and worked examples for each band. The rubric is mandatory for every Issue Log row.
High = forced arbitration, unlimited or uncapped liability, non-mutual indemnity, perpetual confidentiality on all information, one-way fees + injunction, bundled standstill/no-hire, cross-border personal-data flow without carve-out, change-of-control assignment trigger.
Medium = ambiguity in defined terms that is recoverable in redline, onerous-but-bounded scope, missing standard carve-outs, representative-liability without a written-confidentiality limiter, return/destruction without backup carve-out.
Low = minor drafting cleanup (typos, defined-term casing, cross-reference errors, harmless boilerplate, readability tweaks that do not shift risk).
Accountability gap closed by output shape. A "DRAFT — qualified counsel review required before signing" banner with a named-reviewer placeholder is now part of the file header and is required on every output produced by the skill (Executive Summary, Issue Log, Redline package, Step 5 finalisation). The banner cannot be removed until a named qualified lawyer is written into the reviewer-of-record line; nothing leaves for the counterparty until that line is filled. This makes the lawyer-review requirement structurally enforced rather than purely a disclaimer the reader can skim past.
Versioning metadata refreshed. Frontmatter now carries version: 1.0.0, last_reviewed: 2026-05, and last_reviewed_by: LegalQuants (QA remediation). Authorship remains with Jamie Tso.
What did not change
Scope (one-way commercial NDAs only), jurisdiction-agnostic posture, inputs to collect, 5-step workflow, reference modules, perspective-specific checklists, variation callouts, and the existing limitations section are all preserved verbatim. The remediation is additive.
Open items deferred to a later pass
Audience declaration, work-shape declaration, consolidated escalation section with named-role routing, and a "common failure modes" list (all flagged as ⚠️ in the QA report) are not addressed in this remediation. They are non-blocking for the two priority gaps and can be folded into the next minor version.
