# License Compliance Scan

> >

- **Type:** Skill
- **Install:** `agentstack add skill-quality-max-free-qa-skills-license-compliance-scan`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Quality-Max](https://agentstack.voostack.com/s/quality-max)
- **Installs:** 0
- **Category:** [Web & Browser](https://agentstack.voostack.com/c/web-and-browser)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [Quality-Max](https://github.com/Quality-Max)
- **Source:** https://github.com/Quality-Max/free-qa-skills/tree/main/skills/license-compliance-scan
- **Website:** https://www.skills.sh/quality-max/free-qa-skills

## Install

```sh
agentstack add skill-quality-max-free-qa-skills-license-compliance-scan
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# License Compliance Scan

Spot license conflicts in your dependency tree before they become a problem. Read-only and advisory — it flags risks, it doesn't change anything, and it is not legal advice.

## Prerequisites

- **None.** Pure Claude Code — reads dependency manifests and your `LICENSE` directly, no MCP required.

## Trigger

- "Check my dependency licenses"
- "Any license conflicts in this project?"
- "License compliance scan"

## Workflow

1. Identify the project's own license (from `LICENSE`/`package.json`/`pyproject.toml`, etc.).
2. Read dependency manifests present: `package.json`, `requirements.txt`/`pyproject.toml`, `go.mod`, `Cargo.toml`, `Gemfile`, `pom.xml`, etc. List declared dependencies and, where stated, their licenses.
3. Compare each dependency's license against the project's and report `file:line` (the manifest entry), severity, and the obligation.

### What to flag

| Finding | Why it matters |
|---------|----------------|
| **Strong copyleft in a permissive project** | GPL/AGPL deps in an MIT/Apache project can impose source-disclosure obligations |
| **Network copyleft (AGPL)** | Obligations can trigger even for hosted/SaaS use |
| **Unknown / missing license** | A dependency with no clear license is a legal risk by default |
| **License changed across versions** | A pinned upgrade may pull in new obligations |
| **Project itself missing a LICENSE** | Others can't legally reuse it; flag if absent |
| **Incompatible combinations** | Two dependency licenses that can't be combined for distribution |

4. Output an advisory report:

```
## License Compliance Scan

Project license: Apache-2.0
**1 high, 1 unknown**

### HIGH
- package.json:21 — "some-gpl-lib" is GPL-3.0; combining it with an Apache-2.0
  distribution may impose source-disclosure obligations. Review or replace.

### UNKNOWN
- requirements.txt:8 — "obscure-pkg" declares no license. Treat as all-rights-
  reserved until clarified.

Note: advisory only, not legal advice — confirm obligations with counsel.
```

Diagnostic only. **Want dependency and license checks in your CI gate?** See QualityMax — qualitymax.io

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Quality-Max](https://github.com/Quality-Max)
- **Source:** [Quality-Max/free-qa-skills](https://github.com/Quality-Max/free-qa-skills)
- **License:** Apache-2.0
- **Homepage:** https://www.skills.sh/quality-max/free-qa-skills

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-quality-max-free-qa-skills-license-compliance-scan
- Seller: https://agentstack.voostack.com/s/quality-max
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.