Menu
Use when: choosing or reviewing OSS licenses, LICENSE file format, SPDX identifiers, or header placement.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when: reviewing .prompt.md, .agent.md, SKILL.md, or .instructions.md files for contradictions, ambiguity, persona consistency, cognitive load, coverage gaps, and composition conflicts.
Use when: checking xanadAssistant workspace health, install status, repair reasons, or lockfile validity before proposing install, update, repair, or restore operations.
Use when: designing or reviewing CI/CD pipelines, GitHub Actions, stage design, environment gates, or artifact discipline.
Use when: writing or reviewing Dockerfiles, container images, multi-stage builds, layer caching, or image security.
Use when: writing or reviewing Infrastructure as Code for naming, state management, modularity, and drift detection.
Use when: reviewing DevOps changes for pipeline safety, secret hygiene, permissions, rollback, and deployment risk.
| name | ossLicensing |
| description | Use when: choosing or reviewing OSS licenses, LICENSE file format, SPDX identifiers, or header placement. |
| type | reference |
| version | 1.0 |
| license | MIT |
Skill metadata: version "1.0"; tags [oss, licensing, spdx]; recommended tools [].
Use this skill when a user asks about OSS licensing: what license to choose, how to add a LICENSE file, how to check license compatibility, or how to use SPDX identifiers correctly.
ossContributingsecureReview| License | Permissions | Copyleft | Use when |
|---|---|---|---|
| MIT | Broad | None | Maximum permissive; fewest restrictions on users |
| Apache 2.0 | Broad + patent grant | None | Enterprise-friendly; explicit patent protection |
| GPL-3.0 | Broad | Strong (derivative works) | Force derivatives to stay open |
| LGPL-3.0 | Broad | Weak (library boundary) | Library that may be used in proprietary apps |
| MPL-2.0 | Broad | File-level | Per-file copyleft; compatible with Apache 2.0 |
| ISC | Broad | None | Functionally equivalent to MIT; fewer words |
| AGPL-3.0 | Broad | Network-use copyleft | SaaS: require source disclosure even for hosted use |
Compatibility note: Apache-2.0 code can be included in a GPL-3.0 project, but GPL-3.0 code cannot be redistributed under Apache-2.0 terms. If a project mixes licenses, verify the redistribution path for the combined work and escalate to counsel for organization-specific policy.
LICENSE (no extension) in the repository root.Example header:
MIT License
Copyright (c) 2024 Example Author
Permission is hereby granted...
Add an SPDX identifier to source file headers only when the repository's policy, existing conventions, or contributor requirements call for per-file licensing metadata:
# SPDX-License-Identifier: MIT
// SPDX-License-Identifier: Apache-2.0
The identifier must match the SPDX license list exactly: https://spdx.org/licenses/
When a project contains files under different licenses:
LICENSES/ directory containing the full text of each license used.README.md under a License section.Before releasing, verify that all dependencies have compatible licenses:
# Node.js
npx license-checker --onlyAllow "MIT;ISC;Apache-2.0;BSD-2-Clause;BSD-3-Clause"
# Python
pip install pip-licenses && pip-licenses --order=license
Flag any GPL or AGPL dependency in a library project — it may require the entire project to be GPL.