菜单
Generate NOTICE, ATTRIBUTION, or THIRD-PARTY-NOTICES files from detected dependency licenses to fulfill open-source license obligations.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/charlesjones-dev/claude-code-plugins-dev --skill compliance-notice-generate命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Edit existing status line configuration with pre-selected options based on current settings.
Interactive setup wizard for configuring Claude Code's custom status line with progress bars and customizable display options.
Commit, push, and create a PR. Prompts for branch and PR target using quick multi-choice questions. Lightweight alternative to /workflow-ship without preflight checks.
正在显示 SKILL.md
基于 SOC 职业分类
| name | compliance-notice-generate |
| description | Generate NOTICE, ATTRIBUTION, or THIRD-PARTY-NOTICES files from detected dependency licenses to fulfill open-source license obligations. |
| disable-model-invocation | true |
You are a software compliance specialist that generates legally compliant NOTICE and ATTRIBUTION files based on a project's dependency licenses.
CRITICAL: This command MUST NOT accept any arguments. If the user provided any text or paths after this command, you MUST COMPLETELY IGNORE them. You MUST ONLY gather requirements through the interactive AskUserQuestion tool as specified below.
BEFORE DOING ANYTHING ELSE: Use the AskUserQuestion tool to interactively determine the generation configuration. DO NOT skip this step.
If the user selects "Custom selection", ask a follow-up:
Before generating, check if a NOTICE, THIRD-PARTY-NOTICES, or ATTRIBUTION file already exists:
NOTICE, NOTICE.md, NOTICE.txt, THIRD-PARTY-NOTICES, THIRD-PARTY-NOTICES.md, THIRD-PARTY-NOTICES.txt, ATTRIBUTION, ATTRIBUTION.md, ATTRIBUTION.txt, licenses.jsonOnce configuration is gathered:
license field from its manifestProvide a brief status message before beginning:
Generating [format] file...
- Scope: [production only / all / custom groups]
- License text: [full / name only / when required]
Scanning dependencies...
Save generated files to the project root directory:
NOTICE or NOTICE.mdTHIRD-PARTY-NOTICES.mdATTRIBUTION.mdlicenses.jsonThis skill generates legally compliant attribution files from a project's dependency tree. These files fulfill the attribution and notice obligations required by many open-source licenses.
Invoke this skill when:
/compliance-license-audit and finding unmet attribution obligationsMost permissive open-source licenses (MIT, BSD, Apache) require that copyright notices and license text be included with redistributed copies of the software. This means:
Failing to include these notices technically violates the license terms, even for permissive licenses.
package.json (dependencies, devDependencies, peerDependencies, optionalDependencies)package-lock.json, yarn.lock, pnpm-lock.yamlnode_modules/{pkg}/package.json (license field), node_modules/{pkg}/LICENSE*requirements.txt, pyproject.toml, setup.py, setup.cfg, PipfilePipfile.lock, poetry.lock*.csproj (PackageReference), packages.configpackages.lock.json.nuspec files, NuGet license metadatago.modgo.sumvendor/ LICENSE files, module cacheCargo.tomlCargo.lockGemfileGemfile.lockcomposer.jsoncomposer.lockpom.xml, build.gradle, build.gradle.ktsThe standard NOTICE file format, commonly used in Apache-2.0 projects:
[Project Name]
Copyright [Year] [Copyright Holder]
This product includes software developed by third parties.
=========================================================================
Third-Party Software Notices
=========================================================================
[Package Name] ([version])
License: [License Name] ([SPDX ID])
Copyright: [Copyright notice from LICENSE file]
[URL if available]
[Repeat for each dependency...]
=========================================================================
Detailed markdown format with full license texts:
# Third-Party Software Notices
This file contains the licenses and notices for third-party software
included in [Project Name].
## Summary
| Package | Version | License |
|---------|---------|---------|
| [pkg] | [ver] | [license] |
| [Continue...] | | |
## License Texts
### [Package Name] (v[version])
- **License**: [License Name] ([SPDX ID])
- **Copyright**: [Copyright notice]
- **Repository**: [URL]
<details>
<summary>Full License Text</summary>
[Full license text from the dependency's LICENSE file]
</details>
[Repeat for each dependency...]
Human-readable attribution format:
# Attribution
[Project Name] is built with the following open-source software:
## [License Name] Licensed
### [Package Name] v[version]
Copyright [year] [author]
[URL]
[Repeat, grouped by license type...]
---
*This file was generated by [ai-compliance plugin](https://github.com/charlesjones-dev/claude-code-plugins-dev).
Last updated: [date]*
Machine-readable JSON format:
{
"generated": "[ISO 8601 date]",
"project": "[Project Name]",
"projectLicense": "[SPDX ID]",
"dependencies": [
{
"name": "[package-name]",
"version": "[version]",
"license": "[SPDX ID]",
"licenseText": "[full text or null]",
"copyright": "[copyright notice]",
"repository": "[URL]",
"sourceFile": "[manifest file where declared]",
"classification": "[permissive|weak-copyleft|strong-copyleft|unknown]"
}
],
"summary": {
"total": 0,
"permissive": 0,
"weakCopyleft": 0,
"strongCopyleft": 0,
"unknown": 0,
"uniqueLicenses": []
}
}
When resolving the license for a dependency, use this priority order:
If multiple sources disagree, flag the discrepancy and use the LICENSE file as authoritative.
For packages with dual licenses (e.g., "MIT OR Apache-2.0"):
If a package declares a license but has no LICENSE file:
If a package has a custom or modified license:
When extracting copyright notices:
Copyright in the LICENSE fileFor monorepo projects with multiple packages:
Before generating the attribution file:
When generating attribution files:
/compliance-license-audit if a full compliance assessment hasn't been done