box-legal-workflows-ma

Builds and runs an M&A data room inside Box, creates the folder structure, sets role-based access for internal and external parties, and answers cross-document due-diligence questions with Box AI, citations included.

WHEN TO USE

SCOPE

USE FOR

Set up a numbered folder structure for a new M&A deal room in Box.
Scope who can see what, giving external counsel, auditors, and buyers only the folders they need.
Check that a folder's access is actually correct before and after sharing it externally.
Answer a cross-document due-diligence question and get the answer with citations to the source files.
Pull deal terms out of documents and save them as searchable file metadata.

NOT FOR

Judging deal risk, materiality, or how to interpret a contract term.
Giving legal advice about the transaction itself.

This is a saved copy of the skill's SKILL.md instructions. It may differ from the upstream file or the version you install.

In this document (7)

M&A Deal Room Management

PREREQUISITES:

Use the box skill for Box MCP auth, tool selection, and base workflows. If it is not installed, run: npx skills add https://github.com/box/skills --skill box

Use the box-legal-workflows skill for Box collaboration role definitions, Box AI usage boundaries, and reusable confirmation phrasings. If it is not installed, run: npx skills add box/skills --skill box-legal-workflows

Build and run an M&A data room in Box: create the folder hierarchy, scope role-based access with Box collaborations, validate permissions before sharing, and answer due-diligence questions with Box AI plus citations. This skill is the deal-room-specific recipe; the underlying Box tool mechanics live in the capability references below. Deal risk, materiality, and terms are attorney calls. Not legal advice.

Box capability references

Reach for these for tool mechanics rather than restating them here:

The box skill's references/content-workflows.md — create the folder hierarchy, upload/copy, classify-and-file submissions
The box skill's references/collaboration.md — role-based access, shared links, permission audits (list_item_collaborations)
The box skill's references/mcp-search.md — locate documents, folder-scoped search
The box skill's references/ai-and-retrieval.md — due-diligence Q&A and term extraction with citations

Folder structure

Create the tree using the MCP tools in the box skill's references/content-workflows.md (top-down, parent before child; reuse the existing folder on a 409 name conflict). Confirm the firm's template first. Example numbered structure — numeric prefixes keep ordering consistent and segregate external submissions:

[Deal Name] M&A Deal Room/
├── 01 - Financial Statements/
├── 02 - Legal Documents/
├── 03 - HR & Employment/
├── 04 - Intellectual Property/
├── 05 - Commercial Contracts/
├── 06 - Real Estate & Assets/
├── 07 - IT & Cybersecurity/
└── 08 - External Submissions/

Access model

Scope access least-privilege and folder-specific rather than root (role capabilities and external-sharing confirmation rules are in the box skill's references/collaboration.md and the bundled box-legal-workflows skill). Example deal-room mapping (confirm with the user):

Internal: Deal Lead → Editor/Co-Owner on root; Finance → Viewer on Financial Statements; Legal → Editor on Legal Documents.
External: External Counsel → Uploader on their own folder; Auditors → Viewer on Financial Statements; Prospective Buyer → Viewer on a curated subset, not the full room.

Tool selection

Deal-room task	Tool	Notes
Create folders	`create_folder`	Batch the hierarchy, top-down
Add files	`upload_file` / `copy_file`	New uploads or copy existing Box files
Grant access	`create_collaboration`	Confirm first for any external party
Shared link	`add_folder_shared_link`	Confirm audience/expiration
Audit/verify access	`list_item_collaborations`	Before and after external changes
Find docs	`search_files_keyword`	Scope with `ancestor_folder_id`
Due-diligence Q&A	`ai_qa_multi_file`	Cross-document; surface citations
Extract terms	`ai_extract_structured_from_fields_enhanced`	Persist with `set_file_metadata`
Classify submissions	`ai_qa_single_file`	Then `copy_file` into the right folder

Workflow

Setup: create the folder tree → grant internal access with create_collaboration. [CONFIRM: structure, emails/roles]
Populate: upload_file/copy_file; classify submissions with ai_qa_single_file, then copy_file into the right category folder.
External access: list_item_collaborations (audit) → [CONFIRM: who, folders, permission, expiration] → create_collaboration or add_folder_shared_link → list_item_collaborations (verify).
Due diligence: search_files_keyword (folder-scoped) → ai_qa_multi_file → present the answer with citations; ai_extract_structured_from_fields_enhanced for terms → set_file_metadata to persist.

Legal guardrails

Box mechanics (external-sharing confirmation, shared-link settings, AI pacing/limits/citations) are governed by the capability references above and box-legal-workflows. Specific to deal rooms:

Deal risk, materiality, and term interpretation are attorney calls, never the agent's.
Validate permissions with list_item_collaborations before and after external changes — a folder grant exposes everything inside it, including files added later.
Audit trail: record returned folder/file/collaboration IDs and write DD summaries back to Box.

MCP connection required

2 FOR YOU

All items below are required.

01
Install the box skill for Box authentication
Install the box skill first for Box MCP authentication, tool selection, and base workflows; run npx skills add https://github.com/box/skills --skill box if it isn't already installed.
```
npx skills add https://github.com/box/skills --skill box
```
02
Install the box-legal-workflows skill
Install the box-legal-workflows skill for the shared collaboration roles, Box AI boundaries, and confirmation phrasing this deal-room workflow builds on; run npx skills add box/skills --skill box-legal-workflows if it isn't already installed.
```
npx skills add box/skills --skill box-legal-workflows
```

Listed as free: Connected services may require an account or charge fees.
Installation: One command — usually under 2 minutes.

This skill ships inside the Box Agent Skills plugin.

Needs a Box account connected through Box's MCP server. Set that up first — this skill doesn't include it.

Install the whole plugin

This route installs the Box Agent Skills plugin package selected for your AI tool.

PLUGIN MARKETPLACE

Add the marketplace, then install the plugin

Typed inside the agent's own prompt, not in a terminal. The marketplace is called box-plugin-marketplace, which is the part after the @.

01
```
/plugin marketplace add box/skills
```

/plugin install box@box-plugin-marketplace

Open plugin page ↗

Install without the plugin (incomplete)

What's missing

Installing just this skill adds only its own folder. Its instructions also call for other plugin components, such as shared scripts, reference files or other skills, which aren't included. Installing the whole plugin avoids this gap.

Run this outside your AI tool, using Node.js 22.20.0 or newer. Skills CLI 1.7.2 skips skill selection; prompts cancel installation without an interactive terminal. If choosing Project when asked about installation scope, open your project's folder before running this.

Install checklist

Check selected tools if a picker appears; Claude Code may be unchecked under Additional agents. ↑/↓ moves, Space toggles selections, Enter confirms.
Without a tool picker, check Installing to: for your intended tool. Stop if it names a different tool.
If asked, choose Symlink (Recommended) for shared files or Copy to all agents for separate copies; review the summary before confirming installation.
Install the find-skills skill? defaults to Yes, adding another skill for all projects. Choose No if you don't want that extra installation.

Skills CLI 1.7.2 sends install data to skills.sh by default, including the source, skill names, target tools and file details; GitHub sources are reported only when GitHub confirms the repository is public, while other remote sources can also be reported. Confirmed-public GitHub sources also trigger a security-audit request. Before installing, set the environment variable DO_NOT_TRACK=1 or DISABLE_TELEMETRY=1 to disable both.

npx skills add box/box-for-ai --skill "box-legal-workflows-ma" --full-depth

After installing for Claude Code, open it in the installation project if you chose Project; Global makes the skill available across projects on this computer. Once Claude Code loads the skill, its description helps Claude decide when to use it.

If installation created a top-level skills folder that did not exist when your Claude Code session started, run /reload-skills in that session. Run it again after later changes in that folder.

What's inside

Files included with this skill.

View on GitHub