القائمة
Legal and licensing patterns for open-source content. Apply to any content that touches license terms, contributor agreements, patents, third-party dependencies, or attribution.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | oss-legal-guardrails |
| description | Legal and licensing patterns for open-source content. Apply to any content that touches license terms, contributor agreements, patents, third-party dependencies, or attribution. |
| metadata | {"version":"1.0.0","type":"always-active"} |
Canonical license: YClaw is released under AGPL-3.0 per
LICENSEandREADME.md. If you see content that says "Apache 2.0" or any other license, flag it — it's wrong.
Legal content that goes out publicly sets expectations that are hard to unwind. This skill is Reviewer's OSS-legal screening pass.
LICENSE in the repo rootmain, squash-merged, conventional commit
prefix, passing CI.github/workflows/**, packages/core/src/safety/**,
packages/core/src/review/**) and explain they require human-approved labelCONTRIBUTING.md for detailed workflowai-authored labelAGPL-3.0 includes an implicit patent grant (section 11). Do NOT make claims that imply a different patent grant — stronger or weaker:
When discussing patents at all, defer to the license text. Do not paraphrase.
When content references dependencies (explicitly or implicitly):
| Requirement | Check |
|---|---|
| Named dependencies | Correct spelling, correct license (verify via npm view <pkg> license) |
| "Built on OpenClaw" (per mission_statement.md) | Always include attribution when describing architecture |
| Model providers (Anthropic, OpenAI, etc.) | Reference as "supports X" — not "powered by X" (implies endorsement) |
| External data sources | Credit the source + its license (e.g., CSV data under CC-BY requires attribution) |
Flag any ™ or ® symbols on YClaw in public content until trademark registration status is confirmed.
If content makes claims about user data handling:
| Claim | Required backing |
|---|---|
| "Your data stays with you" | True for self-hosted; flag if said about any hosted version |
| "Encrypted at rest" | Cite the mechanism (MongoDB encryption, volume encryption, etc.) |
| "Audit logs for every agent execution" | True per docs/ARCHITECTURE.md; safe to claim |
| "GDPR compliant" | Requires legal signoff; flag until Elon/legal approves |
| "SOC 2" / "HIPAA" | Requires formal certification; flag unless certified |
For any submission touching legal/licensing:
If any step fails → reviewer:flagged with severity: high and specific rewrite.
If the submission is in an always-escalate category (e.g., "we're HIPAA certified")
→ escalate to Elon via #yclaw-alerts before publishing.
brand-enforcement skill.claims-risk skill.channel-standards skill.Detect and prevent product-specific terminology contamination across skills/ and prompts/. Run after any bulk content update, skill import from another project, or agent config change. Applied as a shared skill across all agents.
When and how Architect delegates tasks to AO, Mechanic, and Designer.
Checklist and rules for reviewing deployment requests. Architect assesses but NEVER executes.
Rules for triaging new issues, classifying severity, and routing to the correct agent.
How to classify and respond to CI/pipeline failures.
Rules for detecting and managing stale issues and PR reviews.