# License Check

> Inventory all dependency licenses across package.json, requirements.txt, go.mod, Cargo.toml, pubspec.yaml and flag incompatible or unknown licenses.

- Skill: `kasimmj/license-check` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kasimmj/license-check`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kasimmj/license-check/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: kasimmj (https://skillmd.com/u/kasimmj)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kasimmj/license-check

---


# License Check Skill

You are performing a **dependency license audit**. Output is a table — make it readable and actionable.

## Step 1 — Find all manifests

Look for and parse:
- `package.json` + `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml`
- `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `pyproject.toml`
- `go.mod` / `go.sum`
- `Cargo.toml` / `Cargo.lock`
- `pubspec.yaml` / `pubspec.lock`
- `Gemfile.lock`
- `composer.lock`

## Step 2 — Resolve license for each dep

For each direct + transitive dependency:
- Read from lockfile if license metadata is there
- Otherwise: hit the registry (npm, PyPI, crates.io, pub.dev)
- Fall back to "UNKNOWN" — don't guess

## Step 3 — Classify

| Class | Examples | OK for proprietary? |
|-------|----------|---------------------|
| 🟢 Permissive | MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense | ✅ Yes |
| 🟡 Weak copyleft | LGPL-2.1, LGPL-3.0, MPL-2.0 | ⚠️ With caveats (dynamic linking, file-level) |
| 🔴 Strong copyleft | GPL-2.0, GPL-3.0, AGPL-3.0 | ❌ No — would force open-sourcing |
| ⚪ Source-available | BSL, SSPL, Elastic v2 | ⚠️ Often forbidden for SaaS |
| ❓ Unknown / Missing | — | ⚠️ Must resolve before shipping |

## Step 4 — Output

```
LICENSE AUDIT REPORT
─────────────────────
Total dependencies: 1,247 (direct: 38, transitive: 1,209)

🔴 BLOCKERS (must remove or replace)
  - <package@version> — <license> — <reason>

⚠️ WARNINGS (review with legal)
  - <package@version> — <license> — <reason>

❓ UNKNOWN (resolve before release)
  - <package@version> — <repo URL to investigate>

🟢 CLEAN (1,239 packages)
  ✓ MIT       : 894
  ✓ Apache-2.0 : 218
  ✓ BSD-3-Clause: 71
  ✓ ISC        : 56
```

## Step 5 — Suggest fixes

For each blocker, **suggest a permissive replacement** if you know one:
- `mariadb` (GPL) → `mysql2` (MIT)
- `readline` (GPL) → `linenoise` (BSD)

## When NOT to use

- The project is OSS itself with a GPL license — copyleft deps are fine then
- You only need a security audit (use `security-audit` skill)

## Failure modes

- ⚠️ License *strings* in metadata are not always accurate. Always cross-check with the actual LICENSE file in the upstream repo for anything critical.
- ⚠️ Dual-licensed projects (e.g., MPL + GPL) need careful handling — note the dual nature and recommend the permissive option.