license-check

# Vulnetix License Check Skill ## Use when - Pre-release: confirm no copyleft contaminants in a permissive-licensed product. - Vetting a new dep's license before adoption. - Building an OSS attribution document (NOTICE file). - Producing a customer-facing license disclosure. - Quarterly compliance review with `--policy strict` to catch any non-allowlisted licenses. ## Don't use for - Vulnerability scanning — use `vulnetix scan --sca`. - License text retrieval — use the package manager directly (`npm view <pkg> license`). ## Conventions Follows `skills/_lib/contract.md`. In short: use the `vulnetix_*` MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes. ## Step 1: Run license analysis ```bash vulnetix license -o json-spdx > .vulnetix/licenses.${TIMESTAMP}.spdx.json ``` ## Step 2: Apply policy Default policy: - **permissive**: flag GPL-*, AGPL-*, LGPL-* against MIT/Apache-2.0/BSD codebase - **copyleft-aware**: flag AGPL-* and SSPL-1.0 - **strict**: flag any non-allowlisted license; allowlist = MIT, Apache-2.0, BSD-2/3-Clause, ISC, MPL-2.0 User can override via `--policy`. Accept user-supplied allowlist via `.vulnetix/license-policy.yaml` if present. ## Step 3: Render ``` | Package | Version | License | Policy verdict | Action | ``` Conflicts highlighted. Suggest replacement packages for blocked licenses (consult `vulnetix vdb packages search <name> --license <permitted>` if needed). ## Step 4: Compliance bundle hint If `--bundle` flag provided, also output the file path so the `compliance-bundler` agent can pick it up. ## Memory update `.vulnetix/licenses/<timestamp>.summary.yaml` with conflict counts. ## Edge cases & gotchas - `--policy permissive` flags GPL-* / AGPL-* / LGPL-* against an MIT/Apache codebase; `--policy strict` allowlists only MIT, Apache-2.0, BSD-2/3-Clause, ISC, MPL-2.0. - Custom allowlist via `.vulnetix/license-policy.yaml` overrides the built-in policy. - License detection uses package metadata; dual-licensed packages (MIT OR Apache-2.0) are reported as the FIRST license unless the policy file says otherwise. - SPDX expression parsing handles common patterns (MIT, Apache-2.0, BSD-3-Clause) but not custom non-SPDX strings like "see LICENSE file" — those flag as "Unknown". - Transitive deps are included by default; pass `--direct-only` to scope to top-level packages. - License findings DO NOT include legal review — flag them for legal counsel, do not auto-approve based on the skill output.