License Check

License Check Skill

You are performing a dependency license audit. Output is a table — make it readable and actionable.

Step 1 — Find all manifests

Look for and parse:

• package.json + package-lock.json / yarn.lock / pnpm-lock.yaml
• requirements.txt, Pipfile.lock, poetry.lock, pyproject.toml
• go.mod / go.sum
• Cargo.toml / Cargo.lock
• pubspec.yaml / pubspec.lock
• Gemfile.lock
• composer.lock

Step 2 — Resolve license for each dep

For each direct + transitive dependency:

• Read from lockfile if license metadata is there
• Otherwise: hit the registry (npm, PyPI, crates.io, pub.dev)
• Fall back to "UNKNOWN" — don't guess

Step 3 — Classify

| Class | Examples | OK for proprietary? | |-------|----------|---------------------| | 🟢 Permissive | MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense | ✅ Yes | | 🟡 Weak copyleft | LGPL-2.1, LGPL-3.0, MPL-2.0 | ⚠️ With caveats (dynamic linking, file-level) | | 🔴 Strong copyleft | GPL-2.0, GPL-3.0, AGPL-3.0 | ❌ No — would force open-sourcing | | ⚪ Source-available | BSL, SSPL, Elastic v2 | ⚠️ Often forbidden for SaaS | | ❓ Unknown / Missing | — | ⚠️ Must resolve before shipping |

Step 4 — Output

LICENSE AUDIT REPORT
─────────────────────
Total dependencies: 1,247 (direct: 38, transitive: 1,209)

🔴 BLOCKERS (must remove or replace)
  -  —  — 

⚠️ WARNINGS (review with legal)
  -  —  — 

❓ UNKNOWN (resolve before release)
  -  — 

🟢 CLEAN (1,239 packages)
  ✓ MIT       : 894
  ✓ Apache-2.0 : 218
  ✓ BSD-3-Clause: 71
  ✓ ISC        : 56

Step 5 — Suggest fixes

For each blocker, suggest a permissive replacement if you know one:

• mariadb (GPL) → mysql2 (MIT)
• readline (GPL) → linenoise (BSD)

When NOT to use

• The project is OSS itself with a GPL license — copyleft deps are fine then
• You only need a security audit (use security-audit skill)

Failure modes

• ⚠️ License strings in metadata are not always accurate. Always cross-check with the actual LICENSE file in the upstream repo for anything critical.
• ⚠️ Dual-licensed projects (e.g., MPL + GPL) need careful handling — note the dual nature and recommend the permissive option.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: kasimmj
• Source: kasimmj/claude-skills-mega
• License: MIT
• Homepage: https://kasimmj.github.io/claude-skills-mega/

Install and usage instructions live in the source repository linked above.