Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add open-octo/octo-agent --skill contract-reviewgit clone --depth 1 https://github.com/open-octo/octo-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/open-octo/octo-agent/contract-review)<a href="https://agentmods.dev/skills/open-octo/octo-agent/contract-review"><img src="https://agentmods.dev/badge/skills/open-octo/octo-agent/contract-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/open-octo/octo-agent/contract-review"><img src="https://agentmods.dev/badge/skills/open-octo/octo-agent/contract-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00137 | $0.01718 |
| Opus 5 | $0.00068 | $0.00859 |
| Sonnet 5 | $0.00027 | $0.00344 |
| Haiku 4.5 | $0.00014 | $0.00172 |
Grade A, and why
contract-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: contract-review
审阅一份合同：识别对用户不利的条款、检查该类合同该有却缺失的关键条款、给出具体 的修改建议。产出是一份结构化审查报告，不是"这份合同能不能签"的最终结论。
前置：合同不完整信息不硬编
只处理用户实际提供的合同文本。缺少的信息（准据法、双方主体资格、合同金额上下文 等）如果影响判断，明确列在报告的"需要澄清"部分，不要替用户假设或编造。
第一步：识别合同类型
先判断合同属于哪一类，决定后面用哪套"关键条款清单"核对完整性：
| 类型 | 关键条款清单 |
|---|---|
| 服务协议 | 服务范围、服务标准、付款、知识产权、保密 |
| 劳动合同 | 工作内容、薪酬福利、工作时间、竞业限制、解除条件 |
| 保密协议(NDA) | 保密信息定义、保密期限、例外情况、返还义务 |
| 采购合同 | 产品规格、交付、验收、质保、付款 |
| 租赁合同 | 租赁物、租金、期限、维护责任、解约条件 |
不属于以上五类的合同，仍套用通用的风险条款表（第二步），但完整性检查（第三步） 需要用户或常识补充该类合同的典型必备条款。
第二步：逐条对照风险条款表
通读合同全文，对每一条实质性条款检查是否命中下表任一风险模式。命中时，在报告里 引用原文（不要转述或凭印象复述条款内容），标注严重度，给出修改建议：
| 风险模式 | 严重度 | 说明 | 建议 |
|---|---|---|---|
| 无限责任 | 高 | 责任或赔偿义务没有上限 | 增加责任上限（如 12 个月费用或合同金额） |
| 宽泛知识产权转让 | 高 | 转让全部知识产权，包括合同前已有的知识产权 | 排除既有知识产权，明确转让范围 |
| 单方解约权 | 高 | 一方可无理由或极短通知期解约 | 要求双方对等的解约权或合理通知期 |
| 单向赔偿 | 高 | 只有一方承担赔偿/indemnification义务 | 争取双向赔偿或限定范围 |
| 宽泛权利放弃 | 高 | 放弃法定权利或基本权利 | 删除或限缩放弃范围 |
| 缺少数据保护条款 | 高 | 未约定个人信息处理（对应《个人信息保护法》等） | 补充符合适用法律的数据保护条款 |
| 自动续约陷阱 | 中 | 自动续约且退出机制繁琐 | 增加清晰的不续约通知机制 |
| 过高违约金 | 中 | 违约金明显超出可能的实际损失 | 核实违约金与预估损失是否相当 |
| 宽泛竞业限制 | 中 | 竞业范围、期限、地域过宽 | 限缩范围、期限（一般不超过 2 年）、地域 |
| 永久保密 | 中 | 保密义务无期限 | 设定合理期限（常见 3-5 年） |
| 不利管辖 | 中 | 争议解决地点/仲裁地对己方明显不利 | 争取中立或己方所在地管辖 |
| 范围变更无控制 | 中 | 没有变更管理流程 | 增加变更管理及对应计价机制 |
| 不利付款条款 | 中 | 账期过长或验收标准主观 | 争取更短账期、客观验收标准 |
| 缺少不可抗力条款 | 中 | 未约定不可抗力免责 | 补充标准不可抗力条款 |
| 缺少审计权 | 低 | 无权审计对方履约或财务情况 | 增加合理的审计权条款 |
命中风险的严重度不是自动结论——同一条款在不同交易背景下重要性不同（例如"无限 责任"在小额短期合同里未必是问题）。报告里说明为什么这条被标记，而不是机械套用 表格。
第三步：完整性检查
对照第一步选定的关键条款清单，检查合同是否遗漏了该类合同通常应有的条款。缺失本 身不一定是风险（可能双方另有安排），但要在报告里列出，交给用户判断。
同时检查基本要素：双方主体名称是否明确、签署日期、盖章/签字位置是否存在（如果 用户提供的是扫描件或图片，检查是否能看到签章）。
第四步：输出审查报告
固定结构：
# 合同审查报告
**合同类型：** [识别结果]
**审查范围：** [基于用户提供的文本/文件，说明是否为节选]
## 风险清单
### 🔴 高风险
- **[风险名称]**（第 X 条）：原文"[逐字引用]"。[为什么是问题]。建议：[修改建议]
### 🟡 中风险
[同上格式]
### 🟢 提示
[同上格式，或缺失条款提示]
## 缺失的关键条款
- [该类合同通常应有但本合同未见的条款]
## 需要澄清
- [信息不足、无法判断的地方]
## 总体说明
本报告基于通俗的条款风险识别，不构成正式法律意见。涉及金额较大、可能引发诉讼、
或跨境/涉外的合同，请在签署前交由持证律师复核。
边界
- 不判断"这份合同能不能签"——只指出风险点和缺口，最终决策权在用户。
- 不臆测准据法下的具体法律后果（例如某条款是否可强制执行），除非用户明确说明 适用法律且你能引用具体依据；不确定时如实说"需要按适用法律进一步核实"。
- 两份合同对比、批量审查多份合同：这超出本技能范围，属于法律尽调场景，参考
legal-due-diligence技能。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 114 lines · 137 tokens per session scan A f2e78c95fc1e
contract-review is a skill published in the GitHub repository open-octo/octo-agent (97 stars, last pushed yesterday), licensed MIT. It adds 137 tokens to every session and 1,718 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
uspto-database
Access USPTO APIs for patent/trademark searches, examination history (PEDS), assignments, citations, office actions, TSDR, for IP analysis and prior art searches.
fda-database
Query openFDA API for drugs, devices, adverse events, recalls, regulatory submissions (510k, PMA), substance identification (UNII), for FDA regulatory data analysis and safety research.
ha-mac-control
Hope Agent native macOS desktop control — the standard maccontrol status / diagnostics / apps / dock / spaces / snapshot / visual / windows / menu / clipboard / dialog loop, target-first action rules, no-blind-coordinate policy, and recovery for stale AX/window/menu/dialog state. Load whenever using maccontrol, or…
ha-skill-creator
Create, edit, improve, or audit Hope Agent skills. Use when the user wants to: (1) create a new skill from scratch, (2) edit or improve an existing skill, (3) review or clean up a SKILL.md file, (4) run evaluations to test skill effectiveness, (5) optimize skill descriptions for better trigger accuracy. Trigger…
ha-browser
Hope Agent browser automation — the standard status → tabs → snapshot → act loop, stale-ref recovery rules, and what to do when login / 2FA / captcha / camera-prompt / dialog blocks progress. Load this skill whenever you reach for the browser tool. Trigger on: user asks the agent to open / control / click / scrape /…
ha-logs
A read-only troubleshooting skill for querying Hope Agent’s local SQLite databases, which store logs, conversations, and background-job status.