AgentStack
Sign in Publish
MCP servers Skills Toolkits Why AgentStack Sell Docs
Sign in
SKILL verified Apache-2.0 Self-run

License Compliance Scan

skill-quality-max-free-qa-skills-license-compliance-scan · by Quality-Max

>

↗ Website ↗ Repository
— No reviews yet
0 installs
15 views
0.0% view→install

Install

$ agentstack add skill-quality-max-free-qa-skills-license-compliance-scan

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of License Compliance Scan? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

License Compliance Scan

Spot license conflicts in your dependency tree before they become a problem. Read-only and advisory — it flags risks, it doesn't change anything, and it is not legal advice.

Prerequisites

  • None. Pure Claude Code — reads dependency manifests and your LICENSE directly, no MCP required.

Trigger

  • "Check my dependency licenses"
  • "Any license conflicts in this project?"
  • "License compliance scan"

Workflow

  1. Identify the project's own license (from LICENSE/package.json/pyproject.toml, etc.).
  2. Read dependency manifests present: package.json, requirements.txt/pyproject.toml, go.mod, Cargo.toml, Gemfile, pom.xml, etc. List declared dependencies and, where stated, their licenses.
  3. Compare each dependency's license against the project's and report file:line (the manifest entry), severity, and the obligation.

What to flag

| Finding | Why it matters | |---------|----------------| | Strong copyleft in a permissive project | GPL/AGPL deps in an MIT/Apache project can impose source-disclosure obligations | | Network copyleft (AGPL) | Obligations can trigger even for hosted/SaaS use | | Unknown / missing license | A dependency with no clear license is a legal risk by default | | License changed across versions | A pinned upgrade may pull in new obligations | | Project itself missing a LICENSE | Others can't legally reuse it; flag if absent | | Incompatible combinations | Two dependency licenses that can't be combined for distribution |

  1. Output an advisory report:
## License Compliance Scan

Project license: Apache-2.0
**1 high, 1 unknown**

### HIGH
- package.json:21 — "some-gpl-lib" is GPL-3.0; combining it with an Apache-2.0
  distribution may impose source-disclosure obligations. Review or replace.

### UNKNOWN
- requirements.txt:8 — "obscure-pkg" declares no license. Treat as all-rights-
  reserved until clarified.

Note: advisory only, not legal advice — confirm obligations with counsel.

Diagnostic only. Want dependency and license checks in your CI gate? See QualityMax — qualitymax.io

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Web & Browser