contract-review-workflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited contract-review-workflow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Orchestrates a deployed Mistral Workflow for contract review. Detects wait_for_input() human-in-the-loop checkpoints by querying a status handler, presents findings to the user, and resumes the workflow with their decision via workflow_interact(action: "signal").
Profile note: workflow_execute, workflow_status, and workflow_interact are available in the core profile (default). files_upload (for local PDF upload) requires MISTRAL_MCP_PROFILE=full.
Why workflows vs direct API: the workflow runs durably on Mistral's infrastructure — it persists across restarts, handles retries, and can run multi-step analysis (OCR → clause extraction → legal DB lookup → risk scoring) without keeping a connection open.
The name field in workflow_interact calls (signal handler, query handler) is defined by the deployed workflow. Ask the user for:
"get_checkpoint")"human_approval")Defaults used in the examples below — replace with the actual names from the workflow.
Ask the user for:
workflowIdentifier — the deployed workflow name or ID (visible in mistral://workflows)file_id (from files_upload, requires full profile) or a public URLreview_type (e.g. "vendor", "employment", "partnership") and language ("fr" or "en")Call workflow_execute:
{
"workflowIdentifier": "<workflow name or ID>",
"input": {
"document_id": "<file_id, or omit if using document_url>",
"document_url": "<URL, or omit if using file_id>",
"review_type": "<vendor|employment|partnership|other>",
"language": "fr"
}
}Note the structuredContent.execution_id. Confirm to the user: "Workflow started — execution ID: <execution_id>."
Loop:
workflow_status with { "executionId": "<execution_id>" }structuredContent.status:COMPLETED → go to Step 5FAILED / CANCELED / TIMED_OUT → surface structuredContent.result and stopRUNNING → probe for checkpoint (see below), then wait ~10 secondsWhile RUNNING, query the checkpoint handler to detect if the workflow is waiting for human input:
{
"executionId": "<execution_id>",
"action": "query",
"name": "get_checkpoint"
}If structuredContent.result is non-null and contains checkpoint data (e.g. { "waiting": true, "data": {...} }), proceed to Step 4.
If no checkpoint or result is null, show a progress update and continue polling.
When a checkpoint is detected:
⏸ CHECKPOINT — Human review required
──────────────────────────────────────
[findings from query result.data — risk summary, flagged clauses, etc.] {
"executionId": "<execution_id>",
"action": "signal",
"name": "human_approval",
"input": { "approved": true }
} {
"executionId": "<execution_id>",
"action": "signal",
"name": "human_approval",
"input": { "approved": false, "comment": "<user comment>" }
}Return to Step 3 after signaling. A workflow may have multiple checkpoints.
When status === "COMPLETED", format structuredContent.result as a structured contract review:
✅ CONTRACT REVIEW COMPLETE
─────────────────────────────
Execution: <execution_id>
Overall risk: [level from result]
KEY FINDINGS
[structured list from result]
RECOMMENDED ACTIONS
[list from result]Offer to pass the output to /mistral-mcp:contract-analyzer for a complementary stateless view, or to french_legal_summary for a plain-language summary.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.