How to use the Vendor AI Terms Review agent skill

What does the vendor-ai-review skill make the agent do?

When you give the agent a vendor's AI agreement, addendum or terms of service, the skill tells it to read the AI-related clauses and compare them with your organisation's stored AI governance positions. It looks at issues such as whether the vendor can train on your data, who sees your inputs, whether the vendor must tell you about model changes, who owns outputs and what liability the vendor accepts.

The output is a bottom line, a clause-by-clause table, suggested redlines and a routing plan for terms the vendor will not move on. The skill's own description calls this a review aid, so a qualified lawyer should still confirm high-stakes terms.

• Bottom line summary
• Term-by-term review table
• Recommended redlines
• If-they-won't-move routing plan

How do you install the vendor-ai-review skill?

Download the ZIP file from the skill's page in this directory. Unzip it into one of these locations, depending on how you want to use it.

For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project. You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Per project: .claude/skills/ inside the project folder
• Claude apps: Settings → Capabilities → Skills, then upload

Should you set up a practice profile first?

The skill reads your positions from a practice profile file at ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md. Its Vendor AI governance section holds your standard, fallback and automatic-no positions. The skill also reads the AI policy commitments section, so vendor terms can be checked against any use restriction your own policy imposes.

If the profile is not configured, the skill stops and offers two choices. You can run /ai-governance-legal:cold-start-interview to set up your profile, or say 'provisional'. In provisional mode the review uses generic defaults (US jurisdiction, middle risk appetite, no playbook). Every finding is tagged [PROVISIONAL], so you can see the difference before relying on it.

How do you trigger the skill with a natural request?

You do not need to type a command. The skill is triggered by plain requests. Its description lists phrases such as 'review this AI agreement', 'check OpenAI terms', 'what did we agree to with [vendor]', 'vendor sent an AI addendum' and 'is this AI contract okay'. You can also attach the vendor's AI terms to the message.

You can also invoke it directly by name with the file. The skill's example uses the full command form below. Share the actual contract language where you can. The skill asks for the AI addendum, or the main agreement with AI provisions highlighted. If you only have an acceptable use policy, the skill will ask for the full terms, because that document does not say what the vendor can do with your data.

• 'Review this AI agreement' with the file attached
• 'Is this AI contract okay?' with pasted terms
• 'Vendor sent an AI addendum, check it before we sign'

What does the skill need, and what should you watch for?

The skill needs Claude or a SKILL.md-compatible agent environment and the vendor contract or AI terms as a file or pasted text. A configured practice profile is optional. Without one, the skill runs in provisional mode.

The skill does not run scripts and does not use the network, according to the listing. It works only from the text you provide and any positions you have configured. It can miss things, so treat it as a first-pass issue list.

• Requires Claude or a SKILL.md-compatible agent environment
• Requires the vendor contract or AI terms as a file or pasted text
• Practice profile is optional
• Runs scripts: no
• Uses network: no

What tips help you get better results?

Give the skill the complete document, with the AI provisions highlighted if the contract is long. Review the DPA alongside the AI terms, because the skill notes that the DPA governs data protection while the AI terms govern model-specific rights and risks. For stacked vendors, where a SaaS product sits on someone else's model, the skill checks whether there are two sets of terms to review.

• Provide the full contract, not only the acceptable use policy
• Review the DPA and AI terms together when both exist
• Set up your practice profile for tailored results