Produce a license inventory of the project's dependencies and judge it against how the project is actually distributed — because the same license can be fine for one project and a blocker for another. This skill enumerates direct and transitive dependency licenses, classifies each by obligation, and flags the ones that conflict with your project's own license and distribution model (a closed-source SaaS, a distributed binary/app, or an open-source library have very different constraints).
[!IMPORTANT]
This is an engineering aid, not legal advice. It surfaces likely conflicts and obligations so a human — and, for anything material, a lawyer — can make the call. Never assert that a particular use is "legal"; report the license, the obligation, and the risk.
When to use this skill
- Before a release, an open-sourcing, or shipping a distributed binary/app.
- When adding or upgrading a dependency and you want to know what it drags in.
- When legal, security, or procurement asks for a Software Bill of Materials or license list.
- When a dependency has no license, an ambiguous one, or a copyleft license you didn't expect.
Instructions
- Establish the project's own terms. Read the project's
LICENSE and package manifest license field, and determine the distribution model: closed-source SaaS, distributed proprietary binary/app, or open-source library. This decides which dependency licenses are actually a problem.
- Enumerate dependency licenses. Use the ecosystem's native tooling over the installed tree (which includes transitives):
- Node:
npx license-checker --summary (or --json), or npm ls --all.
- Python:
pip-licenses (or read package metadata).
- Go:
go-licenses report ./....
- Rust:
cargo license / cargo deny check licenses.
- Java: the Maven/Gradle license plugin.
Capture the package, version, and declared license (SPDX id where possible).
- Classify each license by obligation:
- Permissive — MIT, BSD-2/3, ISC, Apache-2.0, Zlib. Low risk; Apache-2.0 adds NOTICE-file and patent terms to honor.
- Weak copyleft — LGPL, MPL-2.0, EPL. File- or library-scoped reciprocity; usually OK if you don't modify the library and link it dynamically, but note the obligation.
- Strong copyleft — GPL-2.0/3.0, AGPL-3.0. Reciprocal over the whole combined work; AGPL extends to network use. High risk for proprietary/SaaS.
- Unknown / missing / custom / proprietary — treat as high risk until resolved; "no license" means no grant of rights by default.
- Judge against the distribution model. Flag the real conflicts: AGPL in a SaaS; GPL in a distributed proprietary product; copyleft incompatible with your library's own license; missing/unknown licenses anywhere; Apache-2.0 NOTICE/patent obligations left unmet. Don't flag permissive licenses that fit.
- Propose remediation per flagged item. Options in order of preference: replace with a permissively-licensed equivalent; isolate the component (separate process/service with its source offered) so reciprocity doesn't reach your code; move a build-only tool out of the shipped artifact; comply with the obligation (publish source, add NOTICE); or escalate to legal with the specifics.
- Report as risk tiers. Group findings High → Medium → Low with, for each, the package, version, license, why it conflicts with this project, and the recommended action. Include a one-line inventory summary (counts per license class).
Examples
A closed-source SaaS whose dependency tree includes an AGPL-3.0 library and two packages with no license field:
HIGH
- chart-lib@2.1.0 — AGPL-3.0 — network-use reciprocity conflicts with closed-source SaaS.
→ Replace with an MIT/Apache charting lib, or isolate behind a separate service that offers its source.
- odd-utils@0.3.2 — NO LICENSE — no rights granted by default; cannot rely on it as-is.
→ Contact maintainer / find a licensed alternative before shipping.
MEDIUM
- fast-parse@1.4.0 — MPL-2.0 — file-level copyleft; fine if unmodified, but note the obligation.
LOW
- 214 packages MIT/BSD/ISC/Apache-2.0. Ensure Apache-2.0 NOTICE files are aggregated in the distribution.
State clearly that findings are informational and material conflicts should be confirmed with legal counsel.
1---2name: license-compliance-checker3description: Audit the licenses of a project's dependencies for compatibility with how the project is distributed — flagging copyleft (GPL/AGPL/LGPL), missing or unknown licenses, and other obligations that conflict with your own license or SaaS/proprietary model. Use before shipping or open-sourcing, when adding a dependency, or when legal/procurement asks for a license inventory. This is a licensing review, not a vulnerability scan.4---56Produce a license inventory of the project's dependencies and judge it against how the project is actually distributed — because the same license can be fine for one project and a blocker for another. This skill enumerates direct and transitive dependency licenses, classifies each by obligation, and flags the ones that conflict with your project's own license and distribution model (a closed-source SaaS, a distributed binary/app, or an open-source library have very different constraints).78> [!IMPORTANT]9> This is an engineering aid, not legal advice. It surfaces likely conflicts and obligations so a human — and, for anything material, a lawyer — can make the call. Never assert that a particular use is "legal"; report the license, the obligation, and the risk.1011## When to use this skill1213- Before a release, an open-sourcing, or shipping a distributed binary/app.14- When adding or upgrading a dependency and you want to know what it drags in.15- When legal, security, or procurement asks for a Software Bill of Materials or license list.16- When a dependency has no license, an ambiguous one, or a copyleft license you didn't expect.1718## Instructions19201. **Establish the project's own terms.** Read the project's `LICENSE` and package manifest license field, and determine the distribution model: closed-source SaaS, distributed proprietary binary/app, or open-source library. This decides which dependency licenses are actually a problem.212. **Enumerate dependency licenses.** Use the ecosystem's native tooling over the *installed* tree (which includes transitives):22 - Node: `npx license-checker --summary` (or `--json`), or `npm ls --all`.23 - Python: `pip-licenses` (or read package metadata).24 - Go: `go-licenses report ./...`.25 - Rust: `cargo license` / `cargo deny check licenses`.26 - Java: the Maven/Gradle license plugin.27 Capture the package, version, and declared license (SPDX id where possible).283. **Classify each license by obligation:**29 - **Permissive** — MIT, BSD-2/3, ISC, Apache-2.0, Zlib. Low risk; Apache-2.0 adds NOTICE-file and patent terms to honor.30 - **Weak copyleft** — LGPL, MPL-2.0, EPL. File- or library-scoped reciprocity; usually OK if you don't modify the library and link it dynamically, but note the obligation.31 - **Strong copyleft** — GPL-2.0/3.0, AGPL-3.0. Reciprocal over the whole combined work; AGPL extends to network use. High risk for proprietary/SaaS.32 - **Unknown / missing / custom / proprietary** — treat as high risk until resolved; "no license" means no grant of rights by default.334. **Judge against the distribution model.** Flag the real conflicts: AGPL in a SaaS; GPL in a distributed proprietary product; copyleft incompatible with your library's own license; missing/unknown licenses anywhere; Apache-2.0 NOTICE/patent obligations left unmet. Don't flag permissive licenses that fit.345. **Propose remediation per flagged item.** Options in order of preference: replace with a permissively-licensed equivalent; isolate the component (separate process/service with its source offered) so reciprocity doesn't reach your code; move a build-only tool out of the shipped artifact; comply with the obligation (publish source, add NOTICE); or escalate to legal with the specifics.356. **Report as risk tiers.** Group findings High → Medium → Low with, for each, the package, version, license, why it conflicts with *this* project, and the recommended action. Include a one-line inventory summary (counts per license class).3637## Examples3839A closed-source SaaS whose dependency tree includes an AGPL-3.0 library and two packages with no license field:4041```text42HIGH43- chart-lib@2.1.0 — AGPL-3.0 — network-use reciprocity conflicts with closed-source SaaS.44 → Replace with an MIT/Apache charting lib, or isolate behind a separate service that offers its source.45- odd-utils@0.3.2 — NO LICENSE — no rights granted by default; cannot rely on it as-is.46 → Contact maintainer / find a licensed alternative before shipping.4748MEDIUM49- fast-parse@1.4.0 — MPL-2.0 — file-level copyleft; fine if unmodified, but note the obligation.5051LOW52- 214 packages MIT/BSD/ISC/Apache-2.0. Ensure Apache-2.0 NOTICE files are aggregated in the distribution.53```5455State clearly that findings are informational and material conflicts should be confirmed with legal counsel.
imtiazrayhan