dependency-license-audit

by charlie-morrison

Install this Skill

curl -fsSL -o dependency-license-audit.zip https://skill.seembox.com/api/v1/skills/dependency-license-audit/download && unzip dependency-license-audit.zip

Download dependency-license-audit.zip

SKILL.md About

---
name: dependency-license-audit
description: Scan project dependencies for license compatibility issues, GPL contamination, and compliance violations. Supports npm, pip, Go, Rust, and Ruby ecosystems. Use when asked to audit licenses, check license compliance, find GPL contamination, verify dependency licensing, generate license reports, or ensure open-source compliance before shipping. Also use for CI/CD license gates.
---

# Dependency License Audit

Scan project dependencies for license compatibility issues across multiple ecosystems.

## Quick Start

```bash
# Basic scan (permissive policy)
python3 scripts/license_audit.py /path/to/project

# Strict enterprise scan with CI exit codes
python3 scripts/license_audit.py /path/to/project --policy permissive --ci --format markdown

# Allow weak copyleft (LGPL, MPL)
python3 scripts/license_audit.py /path/to/project --policy weak-copyleft

# Include transitive deps (npm)
python3 scripts/license_audit.py /path/to/project --include-transitive

# JSON output for tooling
python3 scripts/license_audit.py /path/to/project --format json
```

## Supported Ecosystems

| Ecosystem | Files Parsed | License Source |
|-----------|-------------|----------------|
| npm | package.json, package-lock.json, node_modules/*/package.json | Package metadata |
| pip | requirements.txt, Pipfile, pyproject.toml | Installed package metadata |
| Go | go.mod | Manual/UNKNOWN (no local metadata) |
| Rust | Cargo.toml | Manual/UNKNOWN (no local metadata) |
| Ruby | Gemfile | Manual/UNKNOWN (no local metadata) |

npm and pip auto-detect licenses from installed packages. Go/Rust/Ruby report UNKNOWN unless packages are installed — review manually.

## Policies

| Policy | Allows | Use When |
|--------|--------|----------|
| `permissive` (default) | MIT, Apache-2.0, BSD, ISC, etc. | Proprietary/commercial projects |
| `weak-copyleft` | + LGPL, MPL, EPL | Library consumers (dynamic linking) |
| `any-open` | All OSI-approved | Open-source projects |
| `custom` | User-defined | Enterprise with specific requirements |

For custom policy setup, see [references/custom-policy.md](references/custom-policy.md).

## Output Formats

- `text` — Human-readable terminal output (default)
- `json` — Machine-readable for CI pipelines and tooling
- `markdown` — Report with tables, suitable for PRs or documentation

## CI Exit Codes

With `--ci` flag:
- `0` — No issues
- `1` — Warnings only (unknown licenses)
- `2` — Policy violations found

## License Classifications

The scanner classifies licenses into categories:

- **permissive** — MIT, Apache-2.0, BSD, ISC, Unlicense, CC0, etc.
- **weak-copyleft** — LGPL, MPL, EPL, CDDL (modifications must be shared, but linking is OK)
- **strong-copyleft** — GPL, AGPL, SSPL (derivative works inherit the license)
- **proprietary** — UNLICENSED or commercial indicators
- **unknown** — Not recognized; manual review needed

SPDX expressions (`MIT OR Apache-2.0`, `MIT AND BSD-3-Clause`) are evaluated: OR picks most permissive, AND picks most restrictive.

## Workflow

1. Run audit against project directory
2. Review violations and warnings in output
3. For each violation, follow the recommendations provided
4. Optionally create `.license-policy.json` for custom rules
5. Add `--ci` flag to CI pipeline for automated enforcement

_meta.json Metadata

{
  "ownerId": "kn7d5eszdfwftk153ymhdm4qhs83qsqy",
  "publishedAt": 1775864691492,
  "slug": "dependency-license-audit",
  "version": "1.0.0"
}