license-compliance-auditor

Validate dependency licenses against an approved whitelist and generate compliance reports.

2|1|Updated Jan 25, 2026

Search Tags:#audit #compliance #license #whitelist #CI #dependency #SPDX

Ready to run

npx skills add https://github.com/jorgealves/agent_skills --skill license-compliance-auditor

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: license-compliance-auditor
Source: https://github.com/jorgealves/agent_skills/tree/main/license-compliance-auditor
Command: npx skills add https://github.com/jorgealves/agent_skills --skill license-compliance-auditor

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill ensures software projects remain legally compliant by automatically verifying that all dependencies use licenses approved by the organization, preventing accidental inclusion of restricted licenses.

Core Features & Use Cases

License validation: Checks direct and transitive dependencies against a whitelist of allowed licenses.
CI/CD integration: Enforces license compliance as part of pull requests, builds, and release pipelines.
Audit & reporting: Generates a clear compliance report showing compliant and violating packages with reasons.

Quick Start

Run the license-compliance-auditor on your project path with an allowed licenses list and ecosystem. Example: project_path: "./my-app", allowed_licenses: ["MIT","Apache-2.0"], ecosystem: "npm".

Frequently Asked Questions about license-compliance-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check dependency licenses against a whitelist during CI?▼

License compliance auditing is the process of validating a project's dependency graph against an approved license whitelist. It checks direct and transitive dependencies to prevent accidental inclusion of restricted licenses, ensuring software projects remain legally compliant during onboarding, CI gates, or release audits.

How do I audit transitive dependencies for restricted licenses in npm?▼

You can audit transitive dependencies for restricted licenses by running an automated check with your project path, allowed licenses list, and specified ecosystem. The validator scans the dependency graph, identifies packages violating the whitelist, and outputs a structured compliance report detailing all status and violations.

Does the license compliance auditor support Python and Go ecosystems?▼

Yes, the license compliance auditor supports Python and Go ecosystems alongside npm, cargo, and maven. You specify the ecosystem when running the audit, and the validator checks your dependency manifests against the approved license whitelist to generate a structured compliance report.

What inputs are needed to generate a license compliance report?▼

To generate a license compliance report, you need to provide the project path and a list of allowed licenses. You also specify the package ecosystem, such as npm or pip, so the validator can accurately parse manifests, check transitive dependencies against the whitelist, and output a structured compliance report.

Can I enforce SPDX license whitelists in pull request pipelines?▼

Yes, you can enforce SPDX license whitelists in pull request pipelines by integrating this validation into your CI gates. By checking direct and transitive dependencies against approved SPDX identifiers, it blocks restricted licenses from merging and outputs a compliance report detailing any violations.