checking-license-compliance

name	checking-license-compliance
description	Audit a project's dependency licenses against an explicit policy (allow-list / deny-list / review-required) and flag incompatibilities before they ship to production. Reads SPDX license identifiers from npm package manifests, Python METADATA / PKG-INFO files, and pyproject.toml; classifies each license by family (permissive, weak-copyleft, strong-copyleft, proprietary, unknown); detects copyleft contamination and SPDX-incompatible license combinations. Use when: pre-release legal review, M&A code-audit due diligence, preparing an OSS attribution NOTICE file, or switching a project's own license. Threshold: any GPL-family license in a project declaring MIT or Apache-2.0; any UNKNOWN-license package; any metadata-vs-source license mismatch. Trigger with: "check licenses", "license compliance audit", "SPDX scan", "GPL contamination check".
allowed-tools	["Read","Bash(python3:*)","Bash(pip:*)","Bash(npm:*)","Glob"]
disallowed-tools	["Bash(rm:*)","Bash(curl:*)","Bash(wget:*)","Write(.env)","Edit(.env)"]
version	3.30.0
author	Jeremy Longshore <[e-mail]>
license	MIT
compatibility	Designed for Claude Code
tags	["security","licensing","spdx","compliance","pentest"]

Checking License Compliance

Overview

License compliance is a security concern only in the indirect sense that an unintended license obligation can force you to release proprietary source code, retroactively invalidate a customer contract, or render an M&A transaction infeasible. The cost is legal and contractual rather than exploitative — but the consequence ladder is real.

The most-stepped-on landmine is copyleft contamination: unintentionally including a GPL or AGPL-licensed package in a codebase the rest of which is permissively licensed (MIT, Apache-2.0, BSD). The terms of the GPL family say that any project distributing GPL code MUST itself release source under a GPL-compatible license. If your package.json says MIT and one of your transitive deps is GPL-2.0, you may be obligated to either re-license your code or remove the dep.

This skill audits the resolved dependency tree against an explicit policy file and emits findings for:

• Direct deps with deny-listed licenses
• Transitive deps with deny-listed licenses
• Packages with UNKNOWN license metadata (no SPDX identifier)
• License conflicts between metadata and source headers
• Combinations of licenses that are mutually incompatible (e.g. GPL-2.0 + Apache-2.0 without a patent grant)

When the skill produces findings

Finding	Severity	Threshold	Affected control
Strong-copyleft in permissive project	CRITICAL	GPL-2.0/3.0, AGPL-3.0, or similar in a project declaring MIT/Apache-2.0/BSD	(legal)
Weak-copyleft requiring source disclosure	HIGH	LGPL family in a project where the obligation isn't being met (no source-availability commitment)	(legal)
Custom / non-SPDX license	HIGH	License field doesn't match SPDX expression syntax; requires legal review	(legal)
Unknown license	MEDIUM	Package has no license field, no LICENSE file detected	(legal)
Deny-listed license (per policy)	HIGH	Package license is in the explicit deny-list in the policy file	(legal)
Review-required license (per policy)	MEDIUM	Package license is in the review-list (e.g. MPL-2.0)