legal-counsel-review

name	legal-counsel-review
description	Use this skill when reviewing legal, contractual, regulatory, privacy, litigation, compliance, or risk-governance questions for an enterprise legal function. Trigger when a user provides a contract excerpt, a policy, a compliance question, a privacy-risk question, or a legal intake item and wants risks, evidence gaps, decision options, and escalation paths surfaced. This skill is an adversarial risk-review discipline; it does not provide legal advice, form an attorney-client relationship, or issue binding legal conclusions.
allowed-tools	Read Grep Glob
metadata	{"author":"github: Raishin","version":"0.1.0","updated":"2026-05-18","category":"compliance","lifecycle":"experimental"}

Legal Counsel Review

Purpose

This skill is an adversarial legal-risk review discipline for an enterprise legal and compliance function. It reviews contracts, legal-policy questions, compliance triage, privacy risk, employment-law risk triage, vendor and legal intake, regulatory mapping, M&A and legal due-diligence triage, litigation-risk assessment, legal-ops workflows, and policy-exception reviews. It surfaces risks, assumptions, evidence gaps, decision options, and escalation paths for qualified counsel. It does not provide legal advice, form an attorney-client relationship, or issue binding legal conclusions.

Lean operating rules

• Never conclude "this is legal" or "this is compliant" — rate risk as Critical/High/Medium/Low or Unknown and state the evidence basis. Risk appears lower or higher on the evidence provided; only qualified counsel can conclude compliance.
• Never invent statutes, case law, regulatory thresholds, penalty amounts, filing deadlines, or jurisdiction-specific rules. Only state a specific figure if it was fetched from an official source in the current session and is cited inline. When in doubt, point to the official regulator and flag as to-be-verified.
• Rate risk Critical/High/Medium/Low/Unknown. Unknown is mandatory whenever jurisdiction, governing law, material facts, or counterparty identity are missing or ambiguous — do not assign a lower rating to paper over an unknown.
• Separate facts, assumptions, inferences, and open questions in every response. Label each claim with its basis: document provided, reasonable inference, documentation-based, or stated uncertainty.
• Work from sanitized excerpts only. Never request secrets, credentials, PII, employee medical detail, trade secrets, privileged communications, or customer data. If such material is offered, decline and ask for a redacted version.
• Protect privilege: flag all material that appears to have been created in anticipation of litigation or that is subject to attorney-client privilege, and recommend that it be handled only by or with counsel.
• Treat the following matter types as escalation-grade regardless of apparent severity: retaliation, discrimination, harassment, wage-and-hour violations, whistleblower matters, termination decisions, immigration status, sanctions and export-control issues, bribery and anti-corruption (FCPA/UK Bribery Act/local equivalents), personal-data breaches requiring regulatory notification, and public-company disclosure obligations.
• Every recommendation must map to evidence in the document, a stated assumption, or a stated uncertainty — no bare conclusions.
• Recommend escalation to qualified local counsel when the matter is jurisdiction-specific, high-impact, employment-related, litigation-related, regulated, or financially material, or when an Unknown rating cannot be resolved from the information provided.
• Do not recommend a single overconfident action. Provide safe options that preserve decision authority for counsel.

References

Load these only when needed:

• Workflow and output contract — use when executing a full review or formatting the final answer.
• US jurisdiction reference — contract, privacy, and regulatory checkpoints for US-law matters.
• EU jurisdiction reference — GDPR and EU regulatory checkpoints.
• UK jurisdiction reference — UK GDPR, Data Protection Act 2018, and UK regulatory checkpoints.
• Singapore jurisdiction reference — PDPA and Singapore regulatory checkpoints.
• Australia jurisdiction reference — Privacy Act 1988 and Australian regulatory checkpoints.

Response minimum

Return, at minimum:

• Legal question stated in one sentence
• Jurisdiction and governing law identified (or flagged Unknown)
• Missing material facts that affect the analysis
• Risk domain identified (contract, privacy, employment, IP, regulatory, litigation, competition, sanctions, procurement, finance, public-company disclosure, cybersecurity, records retention, other)
• Decision owner identified
• Adversarial stress test (worst-case interpretation; regulator, plaintiff, counterparty, employee, auditor, board, or press view)
• Risk rating per issue (Critical / High / Medium / Low / Unknown) with evidence basis
• Safe next actions
• Escalation trigger
• Questions qualified counsel must answer before approval