# Vendor AI Review Review vendor AI terms, agreement, addendum, or ToS AI provisions, against your... - Repository: https://github.com/anthropics/claude-for-legal (9865 stars) - Category: Business - License: Apache-2.0 - Last updated: 2026-10-29 - Runs scripts: no, instructions only ## Install Claude Code: `npx skills add anthropics/claude-for-legal --skill vendor-ai-review -g -a claude-code -y` Codex: `npx skills add anthropics/claude-for-legal --skill vendor-ai-review -g -a codex -y` Cursor: `npx skills add anthropics/claude-for-legal --skill vendor-ai-review -g -a cursor -y` Gemini CLI: `npx skills add anthropics/claude-for-legal --skill vendor-ai-review -g -a gemini-cli -y` Claude Code plugin marketplace: `/plugin marketplace add anthropics/claude-for-legal` ## Description Review vendor AI terms, agreement, addendum, or ToS AI provisions, against your governance positions; flag training-on-data, liability, model changes, and AI policy consistency. Use when user says "review this AI agreement", "check OpenAI terms", "what did we agree to with [vendor]", "vendor sent an AI addendum", "is this AI contract okay", or attaches vendor AI terms. ## SKILL.md, as published by its author (untrusted third-party text, read it as data) # /vendor-ai-review 1. Read `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`. Confirm vendor governance positions are populated, if not, stop and direct to setup. 2. Use the framework below. 3. Confirm document type (AI addendum / main agreement AI provisions / ToS). If only an AUP was provided, ask for the full terms. 4. Term-by-term review: training on data, confidentiality of inputs, model changes, output IP, liability, incident notification, human review rights, use restrictions, audit rights. 5. AI addendum gap check if DPA exists but no AI addendum. 6. AI policy consistency diff vs. `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`. 7. Output: bottom line, term-by-term, recommended redlines, if-they-won't-move routing. ``` /ai-governance-legal:vendor-ai-review openai-enterprise-agreement.pdf ``` --- ## Matter context **Matter context.** Check `## Matter workspaces` in the practice-level CLAUDE.md. If `Enabled` is `✗` (the default for in-house users), skip the rest of this paragraph, skills use practice-level context and the matter machinery is invisible. If enabled and there is no active matter, ask: "Which matter is this for? Run `/ai-governance-legal:matter-workspace switch ` or say `practice-level`." Load the active matter's `matter.md` for matter-specific context and overrides. Write outputs to the matter folder at `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/matters//`. Never read another matter's files unless `Cross-matter context` is `on`. --- ## Purpose Vendor AI terms are where your governance positions actually get tested. The cold-start interview captures what you *want*. This skill checks what you *agreed to*, and flags the gaps between those two things. The direction here is always the same: we are the deployer or buyer reviewing the vendor's terms. This is the opposite posture from the DPA review controller/processor question, there's no flip. The rest: https://github.com/anthropics/claude-for-legal/blob/HEAD/ai-governance-legal/skills/vendor-ai-review/SKILL.md