license-check
Skill9 starsChanged 6 days agoApache-2.0View on GitHub
Package license analysis — detect copyleft conflicts against a permissive policy, surface AGPL / SSPL / GPL contaminants, output SPDX SBOM with per-package license findings. Use when auditing a release for license compliance, vetting a new dependency''s license, building an OSS-attribution document, or producing a customer-facing license disclosure.
3 other projects use a version of this.
Adopted by
Most recently taken up by
- usk6666/yorishiro-proxytheir own version, first seen Oct 25, 2026
- manastalukdar/ai-devstudiotheir own version, first seen Oct 13, 2026
- kasimmj/claude-skills-megatheir own version, first seen May 22, 2026
Other versions3 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 3
- usk6666/yorishiro-proxy★ 19same name
- kasimmj/claude-skills-mega★ 1same name
- manastalukdar/ai-devstudio★ 1same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository18 other files it gives its agents.
- AGENTS.mdAGENTS.md
- container-scanSkill
- dashboardSkill
- dependency-choiceSkill
- dep-resolveSkill
- detection-rulesSkill
- eol-checkSkill
- exploit-testSkill
- fixSkill
- iac-scanSkill
- repo-impactSkill
- sast-scanSkill
- sbom-generateSkill
- secret-scanSkill
- secure-code-writeSkill
- typosquat-checkSkill
- verify-fixSkill
- vex-publishSkill
The file
We split this skill into the rules it gives an agent
1 rule. About 0 are common, 0 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈0
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 57
If --bundle flag provided, also output the file path so the compliance-bundler agent can pick it up.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Vulnetix License Check Skill
Use when
- Pre-release: confirm no copyleft contaminants in a permissive-licensed product.
- Vetting a new dep's license before adoption.
- Building an OSS attribution document (NOTICE file).
- Producing a customer-facing license disclosure.
- Quarterly compliance review with
--policy strictto catch any non-allowlisted licenses.
Don't use for
- Vulnerability scanning — use
vulnetix scan --sca. - License text retrieval — use the package manager directly (
npm view <pkg> license).
Conventions
Follows skills/_lib/contract.md. In short: use the vulnetix_* MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes.
Step 1: Run license analysis
vulnetix license -o json-spdx > .vulnetix/licenses.${TIMESTAMP}.spdx.jsonStep 2: Apply policy
Default policy:
- permissive: flag GPL-, AGPL-, LGPL-* against MIT/Apache-2.0/BSD codebase
- copyleft-aware: flag AGPL-* and SSPL-1.0
- strict: flag any non-allowlisted license; allowlist = MIT, Apache-2.0, BSD-2/3-Clause, ISC, MPL-2.0
User can override via --policy. Accept user-supplied allowlist via .vulnetix/license-policy.yaml if present.
Step 3: Render
| Package | Version | License | Policy verdict | Action |Conflicts highlighted. Suggest replacement packages for blocked licenses (consult vulnetix vdb packages search <name> --license <permitted> if needed).
Step 4: Compliance bundle hint
If --bundle flag provided, also output the file path so the compliance-bundler agent can pick it up.
Memory update
.vulnetix/licenses/<timestamp>.summary.yaml with conflict counts.
Edge cases & gotchas
--policy permissiveflags GPL-* / AGPL-* / LGPL-* against an MIT/Apache codebase;--policy strictallowlists only MIT, Apache-2.0, BSD-2/3-Clause, ISC, MPL-2.0.- Custom allowlist via
.vulnetix/license-policy.yamloverrides the built-in policy. - License detection uses package metadata; dual-licensed packages (MIT OR Apache-2.0) are reported as the FIRST license unless the policy file says otherwise.
- SPDX expression parsing handles common patterns (MIT, Apache-2.0, BSD-3-Clause) but not custom non-SPDX strings like "see LICENSE file" — those flag as "Unknown".
- Transitive deps are included by default; pass
--direct-onlyto scope to top-level packages. - License findings DO NOT include legal review — flag them for legal counsel, do not auto-approve based on the skill output.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.