Imported from RobertHH-IS/legalcode-skills (skills/legalcode-trade-secret-audit/SKILL.md). Install upstream with npx skills add RobertHH-IS/legalcode-skills --skill legalcode-trade-secret-audit. Copyright stays with the author.

Using this skill

Before following the workflow, read runtime and evidence requirements. They govern current tool use and source verification when older examples below differ from the connected runtime.

Legalcode Trade Secret Audit

Disclaimer: This skill provides a framework for AI-assisted trade secret program assessment. It does not constitute legal advice. All outputs should be reviewed by a qualified legal professional licensed in the relevant jurisdiction before use. Statutory references and case citations carry hallucination risk — verify against authoritative sources (Westlaw, LexisNexis, EUR-Lex, or equivalent) before relying on them. Trade secret law is intensely fact-specific and jurisdiction-dependent; this skill provides analytical structure, not legal conclusions.

Purpose and Scope

This skill audits an organization's trade secret protection program across six domains: (1) crown jewels identification, (2) reasonable measures (physical, IT, HR, contractual), (3) contractual portfolio, (4) employee departure protocols, (5) litigation readiness, and (6) M&A and third-party risk. It produces a severity-scored findings register and a prioritized remediation roadmap.

Covers:

• Crown jewels identification and classification (Tier 1–4 asset register)
• Reasonable measures gap analysis under DTSA § 1839(3), UTSA § 1(4), and EU Directive Art. 2(1)
• Physical security, IT/DLP, HR program, and contractual portfolio assessment
• Employee departure protocol audit (pre-, during-, and post-departure)
• Inevitable disclosure doctrine exposure (jurisdiction-dependent)
• Whistleblower immunity compliance (DTSA § 1833(b))
• M&A and third-party trade secret risk
• Misappropriation remedies overview (injunctive relief, damages, exemplary damages)
• Litigation readiness scoring
• AI/ML-specific trade secret considerations

Does not:

• Provide legal advice or replace qualified trade secret counsel
• Conduct forensic investigation of suspected misappropriation (a separate engagement)
• Draft non-disclosure agreements, employment agreements, or restrictive covenants
• Perform technical source code or formula analysis
• Apply exclusively to one jurisdiction — jurisdiction-specific content is marked [JURISDICTION-SPECIFIC]

Jurisdiction and Governing Law

This skill is designed for US/EU primary coverage with jurisdiction-agnostic markers for other common law and civil law systems.

[JURISDICTION-SPECIFIC] State-by-state US variations: California rejects the inevitable disclosure doctrine (Whyte v. Schlage Lock Co. (2002)); Texas applies it (M-I LLC v. Stelly); New York is mixed; Delaware is favorable to employers on reasonable measures. Always identify the applicable state law, as federal DTSA and state UTSA may both apply concurrently.

[JURISDICTION-SPECIFIC] EU post-Brexit note: UK courts apply equitable principles from Saltman Engineering Co. v. Campbell Engineering Co. [1963] and Coco v. AN Clark (Engineers) Ltd [1969] (three-element test: information has necessary quality of confidence, imparted in circumstances of confidence, unauthorized use causing detriment). No EU Directive transposition in UK. [VERIFY: UK Trade Secrets Bill status as of date of audit]

Interactive Clarification

This skill uses interactive clarification (marked ⟁ CLARIFY) at key decision points. Rather than assuming context, the workflow pauses when:

• The audit scope would materially change based on the answer
• Industry-specific or jurisdiction-specific customization is needed
• Risk tolerance or deal context affects severity classification
• Gaps in the user's documentation require a different analytical approach

If the user has already provided the information, skip the question and proceed.

Workflow

Step 1: Accept the Engagement Scope

Accept the engagement context in any of these formats:

• Document package: Trade secret policies, NDA templates, employment agreements, IT security policies, classification policies, audit reports, organizational charts
• Questionnaire responses: Answers to the intake questions below
• Prior audit findings: Previous trade secret audit reports to update or verify
• M&A context: Target company materials for acquisition due diligence
• Litigation context: Pre-litigation assessment of trade secret claim strength
• Free description: User describes the organization and situation in natural language

If no materials are provided, proceed with the intake questionnaire in Step 2.

Step 2: Gather Context

⟁ CLARIFY — Ask the following questions before beginning. Present as a structured intake:

1. Organization type and industry:

   • Options: Technology/Software, Pharmaceutical/Biotech, Manufacturing, Financial Services, Consumer Products, Professional Services, Other
   • Why it matters: Industry determines which assets are crown jewels and which regulatory overlays apply (FDA, HIPAA, export controls, etc.).

2. Primary jurisdiction(s):

   • Options: US only, US + EU, EU only, US + specific states, Global (specify key jurisdictions), Other
   • Why it matters: Determines applicable statutory framework, inevitable disclosure doctrine applicability, and NDA enforceability rules.

3. Audit trigger:

   • Options: Proactive/preventive program review, M&A due diligence (buy-side), M&A due diligence (sell-side), Pre-litigation readiness, Post-departure incident investigation, Regulatory requirement, Board/investor request
   • Why it matters: The trigger determines depth, sequencing, and report format.

4. Organization size:

   • Options: Startup (1–50), Small (51–250), Mid-market (251–2,500), Large (2,500–25,000), Enterprise (25,000+)
   • Why it matters: Scales the audit expectations; a startup with no DLP is different from an enterprise with no DLP.

5. Available documentation (check all that exist):

   • Trade secret register / IP asset register
   • Written information classification policy
   • IT security policies (DLP, access control, encryption)
   • Employee NDA templates
   • Contractor/consultant NDA templates
   • Vendor NDA templates
   • Employee offboarding checklist
   • Exit interview protocol
   • Trade secret training program
   • Prior trade secret audits or assessments
   • Why it matters: Documentation availability shapes Phase 1 asset identification depth.

6. Focus areas (if any):

   • Options: Full audit (all six domains), Reasonable measures only, Employee departure protocols only, Contractual portfolio only, Litigation readiness only, M&A due diligence focus, AI/ML assets focus
   • Why it matters: Allows scoped audits when time or scope is constrained.

7. Recent events (if any):

   • Recent high-risk employee departure to competitor
   • Active or threatened trade secret litigation
   • M&A transaction (buy-side or sell-side)
   • Significant cybersecurity incident
   • Workforce reduction or restructuring
   • Joint venture or partnership with a competitor
   • Why it matters: Recent events trigger elevated scrutiny of specific domains.

Step 3: Load Legal Framework

Read the applicable legal framework for the identified jurisdiction(s). Use legalcode-mcp to gather verified legal authority.

Search legalcode-mcp for:

• DTSA § 1836–1839 current text and recent amendments [VERIFY]
• Applicable state UTSA — the state's specific version and notable divergences from the 1985 or 1995 uniform act
• EU Trade Secrets Directive 2016/943 and relevant implementing legislation
• Leading case law on reasonable measures in the applicable jurisdiction (see Case Law Reference below)
• Recent appellate decisions on inevitable disclosure doctrine in the applicable state
• DTSA § 1833(b) whistleblower immunity requirements

Save key findings to /tmp/legalcode-trade-secret-authority.md.

If legalcode-mcp is not connected: Mark all statutory and case law references [VERIFY]. Note in the Glass Box audit trail: legalcode_mcp: "Not connected".

Step 4: Crown Jewels Identification

Identify and classify the organization's trade secret assets before assessing how well they are protected. An organization cannot prove reasonable measures without first identifying what it is protecting.

⟁ CLARIFY — If no trade secret register exists, prompt the user to identify crown jewels across these asset categories:

Crown Jewels Identification Techniques:

1. Value-Secrecy Matrix: Plot each asset on two axes: (a) competitive damage if disclosed to a competitor, (b) current degree of secrecy. High-value, high-secrecy = Tier 1 crown jewels.

2. Reconstruction Cost Test: What would it cost a competitor to independently develop this information? Reconstruction cost exceeding $1M or 12 months of R&D suggests Tier 1.

3. Loss-of-Advantage Test: What would happen to the company's competitive position if this information became public tomorrow? If the answer is "material harm to market position," it is a crown jewel.

4. Competitor-Interest Test: What information do sophisticated competitor recruiters and intelligence operations specifically seek? This is often the crown jewels.

5. DTSA Particularity Screen: Could the organization identify this information with sufficient particularity to survive a motion to dismiss a misappropriation claim? If not, the information may lack the specificity required under DTSA / UTSA.

Classification Tiers:

CRITICAL CHECK: A court will dismiss a trade secret claim if the plaintiff cannot identify the trade secret with particularity before discovery. Document each Tier 1 and Tier 2 asset with: (a) description, (b) date of creation/acquisition, (c) competitive value basis, (d) measures taken to protect it, (e) persons who have access.

Step 5: Reasonable Measures Assessment

Assess whether the organization has taken "reasonable measures" to maintain secrecy — the threshold legal requirement under DTSA § 1839(3)(A), UTSA § 1(4)(ii), and EU Directive Art. 2(1)(b).

The legal standard: Courts apply a fact-intensive, context-dependent analysis. There is no fixed list of required measures; courts ask whether the measures taken were reasonable under the circumstances. Key principle from Rockwell Graphic Systems, Inc. v. DEV Industries, Inc., 925 F.2d 174 (7th Cir. 1991): perfection is not required, but a meaningful effort must be shown. Courts weigh the value of the secret against the cost of protection.

5a. Physical Security Assessment

5b. IT and Digital Security Assessment

Access Controls:

Data Loss Prevention (DLP):

Encryption and Device Management:

Pre/Post-Departure Monitoring:

5c. HR Program Assessment

At Hire:

During Tenure:

At Exit:

5d. Classification and Marking Program Assessment

⟁ CLARIFY — If documents are not consistently marked, ask: "Are employees instructed to apply 'Confidential' markings when in doubt, or do they apply markings only on explicit direction?" Absence of a default-to-confidential instruction is a HIGH finding.

Step 6: Contractual Portfolio Review

Assess whether the organization's contract portfolio provides adequate legal protection for trade secrets.

⟁ CLARIFY — If no contracts are available for review, perform a policy-level assessment of whether the types of agreements described below are systematically in place.

6a. Employee Agreements

DTSA § 1833(b) Whistleblower Immunity — Critical Compliance Point: An employer that fails to provide the required immunity notice "in any contract or agreement with an employee that is entered into or updated after the date of enactment" (May 11, 2016) forfeits the right to exemplary damages and attorneys' fees in a DTSA action, even if the misappropriation is willful. [18 U.S.C. § 1833(b)(3)] [VERIFY current text]. Review ALL employment agreements, contractor agreements, and NDAs entered after May 11, 2016 for this notice.

6b. Vendor and Supplier Agreements

6c. Consulting and Contractor Agreements

6d. Customer Agreements

6e. M&A and Partnership Agreements

Step 7: Employee Departure Protocol Assessment

Departing employees represent the highest-frequency vector for trade secret misappropriation. Assess the organization's departure protocol against best practices.

⟁ CLARIFY — If a specific departure is under review, ask:

• When did the employee depart (or when is the expected departure date)?
• What level of crown jewel access did the employee have (Tier 1, 2, or 3)?
• Is the successor employer known? If so, is it a direct competitor?
• Were any anomalies detected in the employee's access behavior before departure?

7a. Pre-Departure Phase Assessment

7b. Departure Day Protocol Assessment

7c. Post-Departure Phase Assessment

7d. Inevitable Disclosure Doctrine Analysis

[JURISDICTION-SPECIFIC] The inevitable disclosure doctrine allows a court to enjoin a former employee from working for a competitor even absent direct evidence of misappropriation, on the theory that the employee "inevitably" will use or disclose trade secrets in the new role.

When assessing inevitable disclosure exposure:

• Identify the new role: is the employee in a position where trade secret use is genuinely inevitable?
• Assess specificity of trade secrets: broad categories (e.g., "marketing strategies") are harder to protect; specific technical formulas are stronger candidates
• Review restrictive covenants: a valid non-compete in an enforcement-friendly jurisdiction is the stronger remedy

Step 8: Litigation Readiness Assessment

Assess whether the organization's documentation is sufficient to prove reasonable measures in litigation — distinct from whether measures exist.

Courts require proof that is: (1) specific (names specific assets, controls, and policies), (2) documented (paper trail exists), and (3) consistently enforced (not merely paper policies).

8a. Trade Secret Asset Register

8b. Documentation of Measures

⟁ CLARIFY — If the organization has policies but enforcement is inconsistent, ask: "Can you provide examples of the policy being enforced — e.g., a disciplinary action for a classification violation, or an access revocation log?" Courts look skeptically at paper policies that were not consistently enforced. Inconsistent enforcement is a HIGH or CRITICAL finding depending on the frequency and significance.

8c. DTSA Seizure Readiness

[JURISDICTION-SPECIFIC — US only] DTSA § 1836(b)(2) provides for an extraordinary ex parte civil seizure order, available in extraordinary circumstances when a TRO would be inadequate (e.g., the defendant is about to flee the country, or is unlikely to preserve evidence in response to a TRO). Assessment:

Step 9: AI/ML Trade Secret Considerations

AI and machine learning assets raise novel trade secret issues that the standard audit framework may underweight.

⟁ CLARIFY — Ask: "Does the organization develop, use, or license AI/ML models or training data assets?" If yes, assess the following:

Severity Classification

Every audit finding is classified using the following four-tier system:

CRITICAL — Existential Risk

Findings that directly threaten the legal existence of trade secret protection or expose the organization to immediate and severe harm. Requires immediate action (within 5 business days).

Automatic CRITICAL triggers:

• Crown jewels publicly disclosed (website, conference, patent application, open source release) — trade secret status destroyed
• Active evidence of misappropriation with no preservation or litigation hold in place
• Complete absence of NDAs with employees having Tier 1 access
• No reasonable measures whatsoever (no classification, no access controls, no contractual obligations) — claim would not survive pleading stage
• Devices wiped or accounts deleted rather than preserved when misappropriation suspected
• DTSA § 1833(b) immunity notice absent from all agreements — forfeits exemplary damages and attorneys' fees
• Evidence of ongoing unauthorized disclosure (e.g., crown jewels currently accessible to unauthorized parties)

HIGH — Material Risk

Findings that significantly weaken trade secret protection and legal position but do not immediately destroy trade secret status. Requires remediation within 30 days.

Automatic HIGH triggers:

• Systematic NDA gaps: material population of Tier 1–2 access employees without executed NDAs
• No DLP or access logging for crown jewel systems
• No exit protocol for Tier 1 access employees (no exit interview, no forensic imaging, no UAM during notice period)
• Classification program absent or unenforced in practice
• No trade secret register — organization cannot identify secrets with specificity
• Known high-risk departure to competitor with no investigation and no responsive action
• DTSA § 1833(b) immunity notice absent from agreements signed after May 11, 2016
• IT access not revoked within 24 hours of departure for Tier 1 employees
• No forensic imaging of returned devices from Tier 1 access employees
• Vendor NDAs absent for vendors receiving Tier 1 information

MEDIUM — Significant Gap

Findings that weaken the program in ways that may affect litigation position and leave the organization exposed to incremental risk. Requires remediation within 90 days.

Examples of MEDIUM findings:

• Inconsistent classification marking (many documents unmarked or inconsistently marked)
• NDAs exist but signed after start date for some employees
• Annual trade secret training not completed by a material percentage of employees
• Access control reviews not conducted in the past 12 months
• Contractor/consultant NDA coverage incomplete (gaps, not systematic absence)
• No written acceptable use policy covering third-party AI tools
• M&A integration NDAs not updated after acquisition
• Non-compete agreements not reviewed for enforceability in applicable states following FTC rule developments
• Vendor audit rights absent from vendor NDAs

LOW — Best Practice Gap

Findings that represent deviations from best practice but do not materially affect trade secret status or litigation position. Remediate within 180 days or next policy review cycle.

Examples of LOW findings:

• Physical security at non-crown-jewel areas slightly below best practice
• Annual access review conducted every 14 months rather than 12
• Garden leave provisions absent in employment agreements (not universally required; jurisdiction-specific)
• Visitor NDA procedures not followed in offices without crown jewel access
• Document template classification markings absent on lower-sensitivity templates
• Training completion rate at 90% rather than 100%

Remediation Framework

For each finding, generate a remediation action using this format:

**Finding ID**: [TS-001, TS-002, ...]
**Domain**: [Crown Jewels / Reasonable Measures / Contractual / Departure Protocol / Litigation Readiness / AI/ML]
**Severity**: [CRITICAL / HIGH / MEDIUM / LOW]
**Finding**: [Specific gap described in factual terms]
**Legal Risk**: [Specific legal consequence if not remediated — cite applicable provision or case]
**Remediation Action**: [Specific, actionable steps — not vague guidance]
**Owner**: [Legal / CISO / HR / Procurement / Corp Dev]
**Deadline**: [5 / 30 / 90 / 180 days based on severity]
**Litigation Readiness Impact**: [How this finding would affect the organization's position if a trade secret claim were filed today]

Prioritization Framework

Tier 1 — Do First (CRITICAL findings; all within 5 business days):

• Preserve evidence of any suspected misappropriation
• Address trade-secret-destroying disclosures (remove publicly accessible crown jewels where possible)
• Execute NDAs with all Tier 1 access employees missing them
• Add DTSA § 1833(b) immunity notices to current agreements via amendment or policy cross-reference
• Activate forensic imaging for any pending high-risk departures

Tier 2 — Do Next (HIGH findings; all within 30 days):

• Implement systematic NDA execution tracking
• Deploy or expand DLP tooling for crown jewel systems
• Establish exit protocol for Tier 1 employees (written procedure, training, checklists)
• Create or update the trade secret register
• Ensure all Tier 1 agreements signed after May 2016 contain DTSA immunity notice

Tier 3 — Roadmap (MEDIUM findings; within 90 days):

• Roll out consistent classification marking program
• Conduct access control review sweep
• Complete NDA execution gap remediation for Tier 2 employees
• Update acceptable use policy for AI tools
• Review non-compete enforceability across applicable states

Tier 4 — Policy Cycle (LOW findings; within 180 days or next policy review):

• Best practice improvements to physical security
• Garden leave provision drafting
• Visitor NDA consistency improvements
• Training completion rate improvements

Quality Assurance Framework

Citation Quality Gates

Run these 5 gates silently before delivering any output:

Self-Interrogation for CRITICAL Findings

For any finding classified CRITICAL, apply this 3-pass review before delivering:

Pass 1 — Legal Chain Integrity:

• Does the risk assessment follow logically from the statute or case law cited?
• Would a court in this jurisdiction actually reach this conclusion on these facts?
• Is the "trade secret status destroyed" conclusion really warranted, or is the information merely weakened?

Pass 2 — Completeness:

• Have all available protective measures been considered? (An organization without a formal classification policy may still have enforceable NDAs and access controls.)
• Are there compensating controls that partially offset the gap?
• Have all relevant DTSA / UTSA / EU Directive elements been analyzed?

Pass 3 — Challenge:

• What is the strongest argument that this organization's measures ARE reasonable under the circumstances?
• Under what circumstances might a court accept a less formal program as "reasonable"? (Note: Rockwell Graphic Systems suggests that even imperfect measures can satisfy the standard if the owner made a genuine effort.)
• Is CRITICAL classification proportionate, or should this be HIGH with expedited remediation?

Confidence Scoring

Glass Box Audit Trail

Every trade secret audit output MUST include this section:

glass_box:
  skill_name: "legalcode-trade-secret-audit"
  engagement_type: "[Proactive / M&A buy-side / M&A sell-side / Pre-litigation / Post-incident / Regulatory]"
  organization_type: "[Industry]"
  jurisdiction_primary: "[US / EU / US+EU / Other]"
  state_utsa: "[Applicable state(s) if US]"
  inevitable_disclosure_applies: "[Yes / No / Uncertain — state: ___]"
  crown_jewels_identified: "[Number of Tier 1 assets; Number of Tier 2 assets; 'Not identified']"
  reasonable_measures_domains_assessed: "[Physical / IT / HR / Contractual / Classification — list assessed]"
  total_findings: "[Number]"
  critical_findings: "[Number]"
  high_findings: "[Number]"
  medium_findings: "[Number]"
  low_findings: "[Number]"
  dtsa_immunity_notice_status: "[Compliant / Non-compliant / Partial / Not assessed]"
  legalcode_mcp: "[Connected / Not connected]"
  authority_reference_file: "[path or 'Not created']"
  statutes_consulted:
    - "18 U.S.C. §§ 1836–1839 (DTSA) — [VERIFIED / UNVERIFIED]"
    - "EU Directive 2016/943 — [VERIFIED / UNVERIFIED]"
    - "[State UTSA citation] — [VERIFIED / UNVERIFIED]"
  cases_consulted:
    - "[Case name and citation] — [VERIFIED / UNVERIFIED]"
  citations_verified: "[number VERIFIED] / [number UNVERIFIED]"
  self_interrogation: "[PASS / REVISED / NOT APPLICABLE (no CRITICAL items)]"
  confidence: "[HIGH / MEDIUM / LOW] — [rationale]"
  limitations:
    - "[Any scope limitations, assumptions, documentation gaps, or caveats]"
  reviewer: "AI-assisted — requires qualified trade secret counsel review"

Case Law Reference

Key cases for reasonable measures and related trade secret issues [all citations require [VERIFY]]:

[JURISDICTION-SPECIFIC] Search legalcode-mcp for jurisdiction-specific cases in the applicable US state or EU member state. The above list is not exhaustive and requires independent verification.

Anti-Patterns

Explicit catalogue of what NOT to do in trade secret protection and trade secret auditing:

1. Treating NDAs as the whole program — An NDA is necessary but not sufficient. Courts have rejected reasonable measures arguments where the only protective measure was an NDA with no classification, no access controls, and no consistent enforcement. The NDA is one layer; the program requires multiple overlapping layers.

2. Vague trade secret identification — Claiming everything is a trade secret without being able to identify specific assets with particularity. Courts routinely dismiss trade secret claims (at summary judgment and on 12(b)(6) motions) where the plaintiff cannot identify the specific trade secret at issue. The audit must identify assets specifically, not categorically.

3. Overlooking the DTSA § 1833(b) immunity notice — Failing to include the whistleblower immunity notice in employment agreements, NDAs, and contractor agreements signed after May 11, 2016. This single omission forfeits the right to exemplary damages (up to 2x actual damages) and attorneys' fees under DTSA § 1836(b)(3)(C), even in cases of willful misappropriation. It is the easiest fix with the highest payoff.

4. Paper policies without consistent enforcement — Having a beautifully drafted classification policy that no one follows. Courts in 2024–2025 have consistently looked skeptically at policies that were not enforced in practice. Document enforcement actions, not just polic

Truncated - read the full file at https://github.com/RobertHH-IS/legalcode-skills/blob/e8c1f7c1eccab8c5ed48bf8363605e8033cb549c/skills/legalcode-trade-secret-audit/SKILL.md.