box-legal-workflows-contract

Finds contracts in Box, compares them against your firm's template with Box AI, and saves what's different as searchable file metadata for an attorney to review.

WHEN TO USE

SCOPE

USE FOR

Find every contract that was signed since your last review cycle.
Check which contracts are expiring in the next 30, 60, or 90 days.
Compare a contract against your firm's template and see exactly where it differs, citations included.
Save extracted details like counterparty, value, and key dates as searchable file metadata.
Flag the reviewing attorney with a summary and give them access to the file.

NOT FOR

Deciding how risky or material a contract clause is — that stays with the attorney.
Giving legal advice about a contract's terms.

This is a saved copy of the skill's SKILL.md instructions. It may differ from the upstream file or the version you install.

In this document (7)

Contract Review Agent

PREREQUISITES:

Use the box skill for Box MCP auth, tool selection, and base workflows. If it is not installed, run: npx skills add https://github.com/box/skills --skill box

Use the box-legal-workflows skill for Box collaboration role definitions, Box AI usage boundaries, and reusable confirmation phrasings. If it is not installed, run: npx skills add box/skills --skill box-legal-workflows

Do contract review in Box: find contracts with Box search, compare against the firm's template with Box AI, persist results as Box metadata so they stay searchable, and monitor dates with metadata search. This skill is the contract-specific recipe; the underlying Box tool mechanics live in the capability references below. Materiality, risk, and favorability are firm-supplied criteria confirmed by an attorney — the agent extracts facts, stores them, and routes. It does not provide legal advice or decide risk.

Box capability references

Reach for these for tool mechanics rather than restating them here:

The box skill's references/mcp-search.md — find contracts; metadata vs. keyword search, folder scoping, template schema lookup
The box skill's references/ai-and-retrieval.md — compare to template and extract fields; pacing, text-rep/file limits, citations
The box skill's references/content-workflows.md — metadata templates, set_file_metadata, report uploads, file comments
The box skill's references/collaboration.md — grant the reviewing attorney access

Box metadata model

Persist review results as file metadata so contracts stay searchable. Find or inspect the firm's template using the box skill's references/mcp-search.md; create one using its references/content-workflows.md if none exists.

Representative fields (confirm the firm's actual set): counterparty_name, contract_type, execution_date, effective_date, expiration_date, auto_renewal, notice_period_days, contract_value, governing_law, status (active/expired/terminated/under_negotiation), risk_rating, review_date, next_review_date, expiration_alert_date. Link to matters with matter_id, practice_area, matter_owner.
The risk_rating value is the firm/attorney's determination — store it, don't decide it.

Contract search recipes

Once contracts carry metadata, use search_files_metadata (mechanics in the box skill's references/mcp-search.md; otherwise search_files_keyword with date filters):

New since last review: execution_date >= 'YYYY-MM-DD' AND execution_date <= 'YYYY-MM-DD'
Expiring window: expiration_date >= 'YYYY-MM-DD' AND expiration_date <= 'YYYY-MM-DD' AND status = 'active'
By counterparty / rating: counterparty_name = 'Acme Corp' · risk_rating = 'High'

Tool selection

Contract task	Tool	Notes
Find new contracts (date)	`search_files_metadata`	Query `execution_date`; fall back to `search_files_keyword` if no metadata
Find expiring	`search_files_metadata`	Query `expiration_date` within 30/60/90 days
Compare to template	`ai_qa_multi_file`	Contract + firm template in one call
Extract metadata (template)	`ai_extract_structured_from_metadata_template`	If a template exists
Extract metadata (custom)	`ai_extract_structured_from_fields_enhanced`	Define fields at runtime
Write metadata	`set_file_metadata`	Persist extracted/confirmed fields
Create variance report	`upload_file`	Write the summary doc
Tag attorney	`create_file_comment`	Notify for review/expiration
Grant attorney access	`create_collaboration`	If they lack access

Workflow

Find: search_files_metadata or search_files_keyword. [CONFIRM: folder ID, date range/cadence]
Compare to template: ai_qa_multi_file (contract + firm template) → extract clauses that differ, with citations. [CONFIRM: template file ID]
Extract metadata: ai_extract_structured_from_metadata_template, or ai_extract_structured_from_fields_enhanced if no template.
Persist: set_file_metadata, including the firm-confirmed risk_rating. [CONFIRM: which fields]
Report: upload_file — factual differences + citations + firm-confirmed rating (observations for attorney review, not recommendations).
Route: create_file_comment to tag the attorney; create_collaboration if they need access. [CONFIRM: attorney, access]
Monitor expirations: search_files_metadata on the expiration window → create_file_comment reminders → set_file_metadata (expiration_alert_sent: yes).

Legal guardrails

Box mechanics (external-sharing confirmation, AI pacing/limits/citations, metadata writes) are governed by the capability references above and box-legal-workflows. Specific to contracts:

Risk, materiality, and favorability are firm + attorney calls, never the agent's. If the firm has no documented criteria, route to an attorney rather than rating.
Prompt Box AI to extract differences and cite section/page — not to judge materiality or legal risk.
Record decisions in Box as the audit trail: the firm-confirmed rating in metadata plus the uploaded summary.

MCP connection required

2 FOR YOU

All items below are required.

01
Install the box skill for Box authentication
Install the box skill first for Box MCP authentication, tool selection, and base workflows; run npx skills add https://github.com/box/skills --skill box if it isn't already installed.
```
npx skills add https://github.com/box/skills --skill box
```
02
Install the box-legal-workflows skill
Install the box-legal-workflows skill for the shared collaboration-role definitions, Box AI boundaries, and confirmation wording this skill builds on; run npx skills add box/skills --skill box-legal-workflows if it isn't already installed.
```
npx skills add box/skills --skill box-legal-workflows
```

This skill ships inside the Box Agent Skills plugin.

Needs a Box account connected through Box's MCP server. Set that up first — this skill doesn't include it.

Install the whole plugin

This route installs the Box Agent Skills plugin package selected for your AI tool.

PLUGIN MARKETPLACE

Add the marketplace, then install the plugin

Typed inside the agent's own prompt, not in a terminal. The marketplace is called box-plugin-marketplace, which is the part after the @.

01
```
/plugin marketplace add box/skills
```

/plugin install box@box-plugin-marketplace

Open plugin page ↗

Install without the plugin (incomplete)

What's missing

Installing just this skill adds only its own folder. Its instructions also call for other plugin components, such as shared scripts, reference files or other skills, which aren't included. Installing the whole plugin avoids this gap.

Run this outside your AI tool, using Node.js 22.20.0 or newer. Skills CLI 1.7.2 skips skill selection; prompts cancel installation without an interactive terminal. If choosing Project when asked about installation scope, open your project's folder before running this.

Install checklist

Check selected tools if a picker appears; Claude Code may be unchecked under Additional agents. ↑/↓ moves, Space toggles selections, Enter confirms.
Without a tool picker, check Installing to: for your intended tool. Stop if it names a different tool.
If asked, choose Symlink (Recommended) for shared files or Copy to all agents for separate copies; review the summary before confirming installation.
Install the find-skills skill? defaults to Yes, adding another skill for all projects. Choose No if you don't want that extra installation.

Skills CLI 1.7.2 sends install data to skills.sh by default, including the source, skill names, target tools and file details; GitHub sources are reported only when GitHub confirms the repository is public, while other remote sources can also be reported. Confirmed-public GitHub sources also trigger a security-audit request. Before installing, set the environment variable DO_NOT_TRACK=1 or DISABLE_TELEMETRY=1 to disable both.

npx skills add box/box-for-ai --skill "box-legal-workflows-contract" --full-depth

After installing for Claude Code, open it in the installation project if you chose Project; Global makes the skill available across projects on this computer. Once Claude Code loads the skill, its description helps Claude decide when to use it.

If installation created a top-level skills folder that did not exist when your Claude Code session started, run /reload-skills in that session. Run it again after later changes in that folder.

View on GitHub