القائمة
Use when auditing open-source dependency licenses in Python projects, generating compliance reports, or checking license risk in your codebase.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
EU AI Act Quick Assessment — fast 15-25 minute triage for preliminary classification and compliance assessment. This skill should be used when the user asks to "do a quick AI Act assessment", "check if the AI Act applies to us", "run a preliminary classification", "do an AI Act triage", "quick check", "preliminary assessment", "Schnellprüfung", "Ersteinschätzung", or needs a fast initial assessment before committing to full analysis.
Use this skill when the user needs to review, draft, or redline a Data Processing Agreement (DPA / Auftragsverarbeitungsvertrag / AVV) under Art. 28 GDPR, or to prepare a Joint Controller Arrangement under Art. 26 GDPR. Triggers include "DPA", "AVV", "Auftragsverarbeitung", "Auftragsverarbeitungsvertrag", "Art. 28 contract", "data processing agreement", "processor agreement", "Art. 26 arrangement", "joint controller agreement", "JCA", "review this DPA", "draft a DPA", "redline this DPA", or any request involving controller-processor / joint-controller contracting. Supports bilingual output (DE/EN), both controller- and processor-side perspectives, and both quick (Art. 28(3)(a)–(h) coverage) and negotiation-grade (clause-by-clause risk scoring) review depths.
NIS2 Compliance Navigator — scope classification, Art. 21 gap analysis (0-4 maturity scoring), and compliance roadmap under EU Directive 2022/2555 with deep German BSIG-neu coverage and profiles for Italy, France, Netherlands, Austria, Spain. Use when: (1) User mentions "NIS2", "NIS-2", "BSIG", "BSIG-neu", "NIS2UmsuCG", "Cyberbeveiligingswet", "Loi Résilience", "NISG", "decreto legislativo 138", (2) User asks if their organization falls under NIS2 or needs a cybersecurity compliance assessment, (3) User mentions essential/important entities, Annex I/II, BSI registration, § 30 BSIG, incident reporting, management body liability, supply chain security, (4) User wants a NIS2 gap analysis, readiness assessment, or compliance roadmap, (5) User asks about NIS2 fines, enforcement, or Nachweispflicht, (6) User asks about NIS2 in any EU Member State.
Draft GDPR/DSGVO-compliant privacy notices as .docx for any EU/EEA jurisdiction and audience. Use when user asks to create a privacy policy/notice, mentions "Datenschutzerklärung", "politique de confidentialité", "privacy notice", needs Art. 13/14 disclosures, AI Act transparency, cookie policy, or notices for applicants ("Bewerber-Datenschutz"), employees ("Beschäftigten-Datenschutz"), B2B partners, or B2C customers. Covers DE (DSGVO+BDSG+TDDDG), FR (RGPD+LIL+LCEN), AT, IT, ES, NL, BE, IE, UK GDPR. Five notice types: Website/App, Applicant, Employee, Business Partner, B2C Customer.
Use whenever the user is working on document production in international arbitration: drafting requests to produce, raising or replying to objections, or preparing the schedule for the tribunal to rule on. Builds and maintains the request-to-produce table (the Redfern Schedule) for the requesting party, the producing party, or the tribunal. Applies the IBA Rules (2020) Article 3.3 admissibility checklist and the Article 9.2 objection grounds, raises a content-based political and institutional sensitivity prompt for State or state-owned parties, and writes an internal memo flagging the user's own weak requests. Trigger it even when the user does not say Redfern Schedule but mentions requests to produce, document production in an arbitration, IBA objections, Article 3.3 or 9.2, or a tribunal ruling on production. It enforces form and does not decide materiality or whether an objection will succeed.
Apply the NIST AI Risk Management Framework (NIST AI 100-1 + the NIST AI 600-1 Generative AI Profile) to a specific AI system, governance question, or impact assessment. Three modes — consult, governance plan, full assessment — all cite Subcategories (`GOVERN 1.1`) and Profile Action IDs (`GV-1.2-001`) verbatim. Use when the user mentions the AI RMF, NIST RMF, NIST AI 100-1, NIST AI 600-1, GenAI Profile, the four functions (Govern / Map / Measure / Manage), the trustworthy AI characteristics, the 12 GAI risks (confabulation, harmful bias, information integrity, CBRN, data privacy, etc.), or asks "what does NIST say about X" for an AI system.
| name | license-comply |
| description | Use when auditing open-source dependency licenses in Python projects, generating compliance reports, or checking license risk in your codebase. |
| author | Sam Clearwater |
| jurisdiction | US |
| version | 1.0.0 |
| last_reviewed | 2026-05 |
| last_reviewed_by | LegalQuants (QA remediation) |
| tags | ["open-source","license","compliance","cli","python","security"] |
Audience: non-lawyer engineers running a CI-gated dependency scan, and the in-house counsel / open-source review function those engineers escalate to. Not intended as a stand-alone clearance tool for engineering teams without a counsel-in-the-loop on flagged findings.
Work shape: Pattern-Matched Review for license detection (license string -> SPDX -> policy band). The "AI executive summary" and "plain-English explanations" features are advisory framing, not judgment work, and must not be relied on as legal advice or as a substitute for counsel review.
This skill provides legal support, not legal advice. A "low risk" classification means "the detected SPDX identifier is on the configured allow-list" — it does not mean "this dependency is safe to ship in your product," "this license is compatible with the rest of your stack," or "your use of this code is compliant."
Three legal failure modes this skill explicitly addresses:
--fail-on=high flag exits non-zero but can be silently bypassed in CI configuration, and the AI executive summary lets leadership consume a license posture with no counsel in the loop. Review required by qualified open-source / IP counsel before merging changes flagged Medium or High. The CI gate is not a substitute for that review.Scans Python projects for dependency license risks using a customizable policy engine.
pip install license-comply
# Scan current directory
license-comply scan .
# CI mode (exit non-zero on violations)
license-comply scan . --fail-on=high
# Generate HTML report
license-comply scan . --format=html --output=report.html
# Custom policy
license-comply scan . --policy=/path/to/policy.yaml
Define your organization's license policy:
allowed_licenses:
- MIT
- Apache-2.0
- BSD-3-Clause
restricted_licenses:
- AGPL-3.0
- CC-BY-NC-4.0
flagged_licenses:
- GPL-2.0: "Consult legal before use"
flagged_licenses policy bucket). Counsel review required before merge. Do not rely on the plain-English explanation as clearance.--fail-on=high trigger. Counsel review required before merge. Escalate. CI gate must not be bypassed.low. Counsel review required before merge. Escalate.Output is advisory, not legal advice, regardless of band.
Stop, do not merge, and route to qualified open-source / IP counsel when:
--fail-on gate trips;When escalating, include: package name, version pin, license text as detected, dependency-graph location (direct vs. transitive, parent package), and the business use of the package.
Original author: Sam Clearwater. LegalQuants remediated this skill on 2026-05 against the Legal Skill Design Framework, addressing the three legal failure modes (legal advice vs. legal support, privilege implications, accountability gap), adding explicit audience / work shape / confidence-band / out-of-scope / escalation sections, and inserting an explicit "qualified open-source / IP counsel review required before merging Medium or High findings" gate to close the accountability gap for non-lawyer engineers running the CI tool. Technical content (installation, usage, policy engine) is unchanged. Output remains advisory, not legal advice.