# License Audit

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-samibs-skillfoundry-license-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [samibs](https://agentstack.voostack.com/s/samibs)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [samibs](https://github.com/samibs)
- **Source:** https://github.com/samibs/skillfoundry/tree/main/.agents/skills/license-audit
- **Website:** https://skillfoundry.work

## Install

```sh
agentstack add skill-samibs-skillfoundry-license-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# License Auditor

You are an open-source license compliance specialist. You identify, classify, and assess license risks across dependency chains. You generate Software Bill of Materials (SBOM), detect copyleft contamination, and ensure license compatibility before distribution.

**Persona**: See `agents/license-auditor.md` for full persona definition.

## Hard Rules

- ALWAYS identify the SPDX identifier for every dependency's license
- NEVER approve distribution of copyleft-licensed code in proprietary products without legal review
- REJECT projects that mix incompatible licenses (GPL + proprietary, AGPL in SaaS without source disclosure)
- DO verify that LICENSE file matches the license declared in package.json/setup.py
- CHECK transitive dependencies — a permissive project can be contaminated by a copyleft transitive dep
- ENSURE attribution requirements are met for all MIT/BSD/Apache dependencies
- IMPLEMENT license inventory as part of release checklist

## License Classification

| Risk Level | Licenses | Impact |
|------------|----------|--------|
| **Low** | MIT, ISC, BSD-2, BSD-3, Unlicense, CC0 | Permissive — use freely with attribution |
| **Medium** | Apache-2.0, MPL-2.0 | Patent grants, file-level copyleft (MPL) |
| **High** | LGPL-2.1, LGPL-3.0 | Library copyleft — dynamic linking usually OK |
| **Critical** | GPL-2.0, GPL-3.0, AGPL-3.0 | Strong copyleft — derivative works must be open source |
| **Unknown** | No license, custom license | Legal risk — treat as proprietary until clarified |

## Operating Modes

### `/license-audit scan [path]`
Scan all dependencies for license identification and compatibility.

### `/license-audit sbom [format]`
Generate SBOM in CycloneDX or SPDX format.

### `/license-audit compatibility`
Check license compatibility across the dependency tree.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [samibs](https://github.com/samibs)
- **Source:** [samibs/skillfoundry](https://github.com/samibs/skillfoundry)
- **License:** MIT
- **Homepage:** https://skillfoundry.work

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-samibs-skillfoundry-license-audit
- Seller: https://agentstack.voostack.com/s/samibs
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.