| name | checking-license-compliance |
| description | Audit a project's dependency licenses against an explicit policy
(allow-list / deny-list / review-required) and flag incompatibilities
before they ship to production. Reads SPDX license identifiers from
npm package manifests, Python METADATA / PKG-INFO files, and
pyproject.toml; classifies each license by family (permissive,
weak-copyleft, strong-copyleft, proprietary, unknown); detects
copyleft contamination and SPDX-incompatible license combinations.
Use when: pre-release legal review, M&A code-audit due diligence,
preparing an OSS attribution NOTICE file, or switching a project's
own license.
Threshold: any GPL-family license in a project declaring MIT or
Apache-2.0; any UNKNOWN-license package; any metadata-vs-source
license mismatch.
Trigger with: "check licenses", "license compliance audit",
"SPDX scan", "GPL contamination check".
|
| allowed-tools | ["Read","Bash(python3:*)","Bash(pip:*)","Bash(npm:*)","Glob"] |
| disallowed-tools | ["Bash(rm:*)","Bash(curl:*)","Bash(wget:*)","Write(.env)","Edit(.env)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","licensing","spdx","compliance","pentest"] |
Checking License Compliance
Overview
License compliance is a security concern only in the indirect sense
that an unintended license obligation can force you to release
proprietary source code, retroactively invalidate a customer
contract, or render an M&A transaction infeasible. The cost is
legal and contractual rather than exploitative — but the
consequence ladder is real.
The most-stepped-on landmine is copyleft contamination:
unintentionally including a GPL or AGPL-licensed package in a
codebase the rest of which is permissively licensed (MIT, Apache-2.0,
BSD). The terms of the GPL family say that any project distributing
GPL code MUST itself release source under a GPL-compatible license.
If your package.json says MIT and one of your transitive deps is
GPL-2.0, you may be obligated to either re-license your code or
remove the dep.
This skill audits the resolved dependency tree against an explicit
policy file and emits findings for:
- Direct deps with deny-listed licenses
- Transitive deps with deny-listed licenses
- Packages with UNKNOWN license metadata (no SPDX identifier)
- License conflicts between metadata and source headers
- Combinations of licenses that are mutually incompatible (e.g.
GPL-2.0 + Apache-2.0 without a patent grant)
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| Strong-copyleft in permissive project | CRITICAL | GPL-2.0/3.0, AGPL-3.0, or similar in a project declaring MIT/Apache-2.0/BSD | (legal) |
| Weak-copyleft requiring source disclosure | HIGH | LGPL family in a project where the obligation isn't being met (no source-availability commitment) | (legal) |
| Custom / non-SPDX license | HIGH | License field doesn't match SPDX expression syntax; requires legal review | (legal) |
| Unknown license | MEDIUM | Package has no license field, no LICENSE file detected | (legal) |
| Deny-listed license (per policy) | HIGH | Package license is in the explicit deny-list in the policy file | (legal) |
| Review-required license (per policy) | MEDIUM | Package license is in the review-list (e.g. MPL-2.0) |
