# Check Licenses

> >

- **Type:** Skill
- **Install:** `agentstack add skill-lorem-dev-skillkeeper-check-licenses`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [lorem-dev](https://agentstack.voostack.com/s/lorem-dev)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [lorem-dev](https://github.com/lorem-dev)
- **Source:** https://github.com/lorem-dev/skillkeeper/tree/main/.agents/skills/check-licenses
- **Website:** https://lorem-dev.github.io/skillkeeper/

## Install

```sh
agentstack add skill-lorem-dev-skillkeeper-check-licenses
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# check-licenses

Verify that every direct dependency -- cargo crates and npm packages alike --
is license-compatible with Apache 2.0 and keep the Third-Party Notices section
of `LICENSE` up to date. SkillKeeper is a Rust workspace (crates + the Tauri
backend) plus the `packages/i18n` and `apps/desktop` npm packages, so both
ecosystems must be checked.

## Steps

1. **Collect all direct dependencies (both ecosystems).**

   **Cargo (Rust):** for the workspace `Cargo.toml` and each member's
   `Cargo.toml` (`crates/*/Cargo.toml`, `apps/desktop/src-tauri/Cargo.toml`),
   collect the crate names under `[dependencies]` (and any
   `[workspace.dependencies]`). Do not include `[dev-dependencies]` or
   `[build-dependencies]` (they do not ship to end users). Resolve each crate's
   license from crates.io metadata; a reliable approach is:

   ```bash
   cargo license 2>/dev/null || cargo metadata --format-version=1
   ```

   `cargo metadata` returns every resolved package with its `license` (SPDX)
   field; filter to the direct dependencies you collected from the manifests.

   **npm (TypeScript):** for each `package.json` in the monorepo (root,
   `packages/*/package.json`, `apps/*/package.json`), collect the package names
   under `dependencies` and `optionalDependencies`. Do not include
   `devDependencies`.

   ```bash
   # Example: list npm packages with their installed license field
   pnpm licenses list --prod 2>/dev/null || \
     node -e "
       const fs = require('fs');
       const lock = JSON.parse(fs.readFileSync('pnpm-lock.yaml', 'utf8'));
       // fallback: read node_modules//package.json for each dep
     "
   ```

   A reliable npm fallback is to read `node_modules//package.json` for
   each direct dependency and extract the `license` field. Use `pnpm list
   --prod --depth 0 --json` to enumerate direct npm dependencies.

2. **Check each license against the policy (from CONTRIBUTING.md).**

   The policy applies identically to cargo crates and npm packages.

   NOT acceptable:
   - GPL-2.0, GPL-3.0, AGPL-3.0
   - LGPL-2.1 (the desktop app bundles its dependencies statically, so LGPL's
     dynamic-linking exception does not apply)
   - SSPL-1.0, BSL-1.1
   - Any Creative Commons -NC- variant
   - Any license containing a "Commons Clause" addendum

   Acceptable examples (not exhaustive): MIT, BSD-2-Clause, BSD-3-Clause,
   ISC, Apache-2.0, 0BSD, CC0-1.0. Note that many crates declare a dual
   license such as `MIT OR Apache-2.0`; a dual license is acceptable if at
   least one of its options is on the acceptable list.

3. **Flag any disallowed license.**
   If any dependency carries a disallowed license, report it clearly and
   STOP -- do not update `LICENSE`. The developer must replace or remove the
   dependency before the check can pass.

4. **Build the Third-Party Notices table.**
   For each direct production dependency (cargo and npm), collect:
   - Package name and version
   - Ecosystem (cargo or npm)
   - License identifier (SPDX)
   - Copyright line: for npm from `node_modules//package.json` or the
     package's LICENSE file; for cargo from the crate's `authors`/LICENSE via
     `cargo metadata` or the crates.io page.

5. **Update LICENSE.**
   Under `## Third-Party Notices`, update ONLY the `### Software dependencies`
   subsection's table -- replace from its `| Package |` header row to the end of
   file. The table lists BOTH ecosystems (cargo crates and npm packages), cargo
   entries first then npm, each alphabetical:

   ```
   | Package | Ecosystem | Version | License | Copyright |
   |---|---|---|---|---|
   |  | cargo / npm |  |  |  |
   ...
   ```

   Preserve everything else verbatim: the Apache 2.0 license text, the
   `## Third-Party Notices` heading, the `### Bundled fonts` subsection (the
   OFL fonts are NOT a package-manager dependency -- never drop it), and the
   intro paragraph above the table. Do NOT alter any content above the
   `### Software dependencies` table.

6. **Report.**
   Print the final table and confirm:
   - "All N direct dependencies (C cargo, M npm) are license-compatible."
   - "LICENSE Third-Party Notices updated."

   Or, if any dependency failed: "BLOCKED:  uses  which is
   not compatible with Apache 2.0. Replace or remove it before merging."

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [lorem-dev](https://github.com/lorem-dev)
- **Source:** [lorem-dev/skillkeeper](https://github.com/lorem-dev/skillkeeper)
- **License:** Apache-2.0
- **Homepage:** https://lorem-dev.github.io/skillkeeper/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** yes
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-lorem-dev-skillkeeper-check-licenses
- Seller: https://agentstack.voostack.com/s/lorem-dev
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.