How do I install the Licensing Review skill?

Run npx skillmds@latest add jakeselby/licensing-review in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Licensing Review safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Licensing Review?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Licensing Review free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Licensing Review?

JakeSelby (@jakeselby) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Licensing Review by jakeselby — Agent Skill

Name: Licensing Review
Rating: 4.2 (5 reviews)
Author: JakeSelby

Licensing Review

Verify a third-party library, asset, model, font, dataset or copied snippet is safe to ship under the project's licensing stance, and record it correctly. Use before adding or upgrading any dependency, before downloading any asset, and before a release.

JakeSelby Updated Sep 22, 2026

File contents

The always-on prohibitions live in the selected licensing stance. Resolve its shared source with harness stances --json; runtime projections carry the same policy. This is the procedure.

Before adopting or upgrading

Read the authoritative license, not the marketplace blurb or the README badge. Check the exact version you are taking.
Inspect the actual package, including transitive dependencies and any separately licensed textures, data, fonts or bundled code inside it.
For dual licensing, record which qualifying option you are taking. Where terms are combined rather than alternative, all of them must comply.
Check authorship and provenance. An uploader's claim does not establish ownership. Reject game rips, unlicensed copies, and anything with missing, conflicting or suspect rights.
Recheck on upgrade. Terms change between versions. Pin a floor you have actually run against.
No new third-party dependency without a reason the reviewer will accept. In a shared repo that means an issue or a note in the PR; in a solo repo it means one sentence in the commit.

If nothing compliant fits, adapt a compliant base or create original work. Do not weaken the policy to use a download. Catalog availability is not asset clearance.

Record it

Every incorporated component goes in the project's third-party manifest with:

Source URL
Creator or rightsholder
Exact version, or asset hash
License identifier, and the preserved license text
Modifications made
Required attribution

Notices that actually ship

Keep THIRD_PARTY_NOTICES and any credits screen current.
Preserve copyright, license and disclaimer text. Include required NOTICE content and license links. Identify modifications where the license requires it.
A repo-only notice is insufficient if recipients do not receive it. Verify the notices are in the actual distribution before release.
Maintain this automatically. Do not hand routine compliance work to the user.

CC BY specifically

Preserve the recipient's licensed rights. Review EULA and DRM packaging, and do not apply additional restrictions to that content. If the intended distribution cannot comply within this policy, choose another asset. Never claim that one credit line alone satisfies every license.

At release

Verify every shipped third-party component has a recorded qualifying license and that notices are present in the built artifact. Report unresolved items plainly. Do not delete existing work to clear a finding, and do not claim an audit happened when it did not.

---name: licensing-reviewdescription: Verify a third-party library, asset, model, font, dataset or copied snippet is safe to ship under the project's licensing stance, and record it correctly. Use before adding or upgrading any dependency, before downloading any asset, and before a release.---The always-on prohibitions live in the selected `licensing` stance. Resolve its shared sourcewith `harness stances --json`; runtime projections carry the same policy. This is the procedure.## Before adopting or upgrading1. **Read the authoritative license**, not the marketplace blurb or the README badge. Check the exact version you are taking.2. **Inspect the actual package**, including transitive dependencies and any separately licensed textures, data, fonts or bundled code inside it.3. **For dual licensing**, record which qualifying option you are taking. Where terms are combined rather than alternative, all of them must comply.4. **Check authorship and provenance.** An uploader's claim does not establish ownership. Reject game rips, unlicensed copies, and anything with missing, conflicting or suspect rights.5. **Recheck on upgrade.** Terms change between versions. Pin a floor you have actually run against.6. **No new third-party dependency without a reason the reviewer will accept.** In a shared repo that means an issue or a note in the PR; in a solo repo it means one sentence in the commit.If nothing compliant fits, adapt a compliant base or create original work. Do not weaken thepolicy to use a download. Catalog availability is not asset clearance.## Record itEvery incorporated component goes in the project's third-party manifest with:- Source URL- Creator or rightsholder- Exact version, or asset hash- License identifier, and the preserved license text- Modifications made- Required attribution## Notices that actually ship- Keep `THIRD_PARTY_NOTICES` and any credits screen current.- Preserve copyright, license and disclaimer text. Include required NOTICE content and license links. Identify modifications where the license requires it.- **A repo-only notice is insufficient if recipients do not receive it.** Verify the notices are in the actual distribution before release.- Maintain this automatically. Do not hand routine compliance work to the user.## CC BY specificallyPreserve the recipient's licensed rights. Review EULA and DRM packaging, and do not applyadditional restrictions to that content. If the intended distribution cannot comply withinthis policy, choose another asset. Never claim that one credit line alone satisfies everylicense.## At releaseVerify every shipped third-party component has a recorded qualifying license and that noticesare present in the built artifact. Report unresolved items plainly. Do not delete existingwork to clear a finding, and do not claim an audit happened when it did not.

Frequently asked questions