License Check Skill
You are performing a dependency license audit. Output is a table — make it readable and actionable.
Step 1 — Find all manifests
Look for and parse:
package.json + package-lock.json / yarn.lock / pnpm-lock.yamlrequirements.txt, Pipfile.lock, poetry.lock, pyproject.tomlgo.mod / go.sumCargo.toml / Cargo.lockpubspec.yaml / pubspec.lockGemfile.lockcomposer.lock
Step 2 — Resolve license for each dep
For each direct + transitive dependency:
- Read from lockfile if license metadata is there
- Otherwise: hit the registry (npm, PyPI, crates.io, pub.dev)
- Fall back to "UNKNOWN" — don't guess
Step 3 — Classify
| Class |
Examples |
OK for proprietary? |
| 🟢 Permissive |
MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense |
✅ Yes |
| 🟡 Weak copyleft |
LGPL-2.1, LGPL-3.0, MPL-2.0 |
⚠️ With caveats (dynamic linking, file-level) |
| 🔴 Strong copyleft |
GPL-2.0, GPL-3.0, AGPL-3.0 |
❌ No — would force open-sourcing |
| ⚪ Source-available |
BSL, SSPL, Elastic v2 |
⚠️ Often forbidden for SaaS |
| ❓ Unknown / Missing |
— |
⚠️ Must resolve before shipping |
Step 4 — Output
LICENSE AUDIT REPORT
─────────────────────
Total dependencies: 1,247 (direct: 38, transitive: 1,209)
🔴 BLOCKERS (must remove or replace)
- <package@version> — <license> — <reason>
⚠️ WARNINGS (review with legal)
- <package@version> — <license> — <reason>
❓ UNKNOWN (resolve before release)
- <package@version> — <repo URL to investigate>
🟢 CLEAN (1,239 packages)
✓ MIT : 894
✓ Apache-2.0 : 218
✓ BSD-3-Clause: 71
✓ ISC : 56
Step 5 — Suggest fixes
For each blocker, suggest a permissive replacement if you know one:
mariadb (GPL) → mysql2 (MIT)readline (GPL) → linenoise (BSD)
When NOT to use
- The project is OSS itself with a GPL license — copyleft deps are fine then
- You only need a security audit (use
security-audit skill)
Failure modes
- ⚠️ License strings in metadata are not always accurate. Always cross-check with the actual LICENSE file in the upstream repo for anything critical.
- ⚠️ Dual-licensed projects (e.g., MPL + GPL) need careful handling — note the dual nature and recommend the permissive option.
1---2name: license-check3description: Inventory all dependency licenses across package.json, requirements.txt, go.mod, Cargo.toml, pubspec.yaml and flag incompatible or unknown licenses.4license: MIT5---67# License Check Skill89You are performing a **dependency license audit**. Output is a table — make it readable and actionable.1011## Step 1 — Find all manifests1213Look for and parse:14- `package.json` + `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml`15- `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `pyproject.toml`16- `go.mod` / `go.sum`17- `Cargo.toml` / `Cargo.lock`18- `pubspec.yaml` / `pubspec.lock`19- `Gemfile.lock`20- `composer.lock`2122## Step 2 — Resolve license for each dep2324For each direct + transitive dependency:25- Read from lockfile if license metadata is there26- Otherwise: hit the registry (npm, PyPI, crates.io, pub.dev)27- Fall back to "UNKNOWN" — don't guess2829## Step 3 — Classify3031| Class | Examples | OK for proprietary? |32|-------|----------|---------------------|33| 🟢 Permissive | MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense | ✅ Yes |34| 🟡 Weak copyleft | LGPL-2.1, LGPL-3.0, MPL-2.0 | ⚠️ With caveats (dynamic linking, file-level) |35| 🔴 Strong copyleft | GPL-2.0, GPL-3.0, AGPL-3.0 | ❌ No — would force open-sourcing |36| ⚪ Source-available | BSL, SSPL, Elastic v2 | ⚠️ Often forbidden for SaaS |37| ❓ Unknown / Missing | — | ⚠️ Must resolve before shipping |3839## Step 4 — Output4041```42LICENSE AUDIT REPORT43─────────────────────44Total dependencies: 1,247 (direct: 38, transitive: 1,209)4546🔴 BLOCKERS (must remove or replace)47 - <package@version> — <license> — <reason>4849⚠️ WARNINGS (review with legal)50 - <package@version> — <license> — <reason>5152❓ UNKNOWN (resolve before release)53 - <package@version> — <repo URL to investigate>5455🟢 CLEAN (1,239 packages)56 ✓ MIT : 89457 ✓ Apache-2.0 : 21858 ✓ BSD-3-Clause: 7159 ✓ ISC : 5660```6162## Step 5 — Suggest fixes6364For each blocker, **suggest a permissive replacement** if you know one:65- `mariadb` (GPL) → `mysql2` (MIT)66- `readline` (GPL) → `linenoise` (BSD)6768## When NOT to use6970- The project is OSS itself with a GPL license — copyleft deps are fine then71- You only need a security audit (use `security-audit` skill)7273## Failure modes7475- ⚠️ License *strings* in metadata are not always accurate. Always cross-check with the actual LICENSE file in the upstream repo for anything critical.76- ⚠️ Dual-licensed projects (e.g., MPL + GPL) need careful handling — note the dual nature and recommend the permissive option.
kasimmj