skills.rest
Sir-chawakorn
Sir-chawakornCOMMUNITY
Explore all skills by this author →
GitHub

audit-license-compliance

Audit open-source license compliance across transitive dependency trees and classify copyleft exposure.

9|3|Updated Jun 13, 2026
Search Tags:#audit#compliance#license#attribution#ci#opensource
One-click install
npx skills add https://github.com/Sir-chawakorn/sanook-cli --skill audit-license-compliance
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-license-compliance
Source: https://github.com/Sir-chawakorn/sanook-cli/tree/main/skills/audit-license-compliance
Command: npx skills add https://github.com/Sir-chawakorn/sanook-cli --skill audit-license-compliance

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automates the complex process of auditing open-source license compliance across a project's entire transitive dependency tree, preventing legal risks from copyleft exposure and ensuring attribution requirements are met.

Core Features & Use Cases

  • Transitive Dependency Scanning: Identifies licenses across the full dependency tree, not just direct packages.
  • Distribution-Model Classification: Evaluates license risk based on your specific distribution model, such as SaaS versus distributed binaries.
  • CI Enforcement: Automatically gates builds by failing on forbidden licenses or unknown dependencies.
  • Attribution Generation: Automatically creates and maintains NOTICE or THIRD-PARTY-LICENSES files.

Quick Start

Run the audit-license-compliance skill to scan the current project dependencies and generate a third-party attribution file.

Frequently Asked Questions about audit-license-compliance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit open-source license compliance across my entire transitive dependency tree?▼

Automated license compliance scans the full transitive dependency tree and resolves SPDX identifiers for every package. It evaluates copyleft exposure based on your distribution model and generates attribution notices automatically.

Can I use a license compliance gate to fail CI builds on forbidden dependencies?▼

Yes, you can enforce license compliance by gating CI builds to fail when forbidden licenses or unknown dependencies are detected. This prevents non-compliant artifacts from passing release pipelines.

How do I automatically generate and maintain attribution notices for third-party licenses?▼

Automated attribution generation creates and maintains NOTICE or THIRD-PARTY-LICENSES files by scanning resolved dependencies. This ensures all third-party license attribution requirements are satisfied without manual tracking.

Does copyleft exposure evaluation differ between SaaS and distributed binary models?▼

Copyleft exposure classification evaluates license risk against specific distribution models like SaaS versus distributed binaries. This ensures compliance checks reflect how software is actually released and distributed.

What is the best way to enforce an OSS license allowlist in a release pipeline?▼

Enforcing an OSS license allowlist requires resolving SPDX identifiers across transitive dependencies and failing builds for unapproved packages. Automated CI policy enforcement prevents forbidden licenses from entering releases.

Why does transitive dependency scanning catch copyleft licenses that direct package checks miss?▼

Transitive dependency scanning resolves SPDX identifiers throughout the entire dependency tree, unlike direct checks that miss inherited licenses. This ensures full copyleft exposure visibility across all nested packages.

Related Skills

Explore More Legal & Compliance Skills→
FrogAiFrogAi
1

license-compatibility-auditor

Audit OSS license compatibility across dependency trees with SPDX evidence.

Community
Advanced
choxoschoxos

licensing

Guide R package license selection and configuration for CRAN submission.

Community
Intermediate
lookatitudelookatitude
6

devops-ci-cd-pipeline

Automate CI/CD pipeline design with multi-stage workflows and gate matrices.

Community
Advanced
Serg28Serg28

security-reviewer

Automate security audits with semgrep, trivy, gitleaks, and dependency scanners.

Community
Intermediate