jorgealves/agent_skills

license-compliance-auditor

Scans project dependencies and verifies licenses against a whitelist of approved open-source licenses. Use to ensure legal compliance in software projects and prevent the introduction of restricted licenses.

First seen Jan 30, 2026

Installation

$ npx skills add jorgealves/agent_skills --skill license-compliance-auditor

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

Also in this package

Other skills from jorgealves/agent_skills · top by installs.

npx skills add jorgealves/agent_skills

Browse all from jorgealves/agent_skills

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Also listed on

Alternate registries and mirrors of this skill.

Repository health

Stars 2
License license-compliance-auditor
Default branch main
Open issues 1
Status Active

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 1,683 B
  • docs SUMMARY.md 1,658 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 229 installs

SKILL.md

License Compliance Auditor

Purpose and Intent

The license-compliance-auditor ensures that software projects remain legally compliant by automatically verifying that all direct and transitive dependencies use licenses approved by the organization.

When to Use

  • Dependency Onboarding: Run when adding a new library to a project.
  • CI/CD Gates: Use as a blocking step in pipelines to prevent merging code with non-compliant licenses (e.g., preventing GPL in a proprietary product).
  • Release Preparation: Audit the entire dependency tree before a major release.

When NOT to Use

  • Legal Advice: This tool provides technical checks based on metadata; it does not replace professional legal counsel.
  • Custom Licenses: It may struggle with proprietary or highly customized license text not found in SPDX registries.

Error Conditions and Edge Cases

  • Missing Metadata: If a package doesn't define a license in its manifest, it will be flagged as "Unknown".
  • Dual Licensing: Packages with multiple licenses (e.g., "MIT OR GPL") will require manual review.
  • Unsupported Ecosystems: Attempting to run on a language not supported by the ecosystem input will fail.

Security and Data-Handling Considerations

  • ReadOnly: The tool only reads manifest files.
  • Privacy: No source code is uploaded; only package names and versions are used to check license registries.