skills.rest
VeryGoodOpenSource
VeryGoodOpenSourceOFFICIAL
Explore all skills by this author →
Website𝕏@vgventuresGitHub

license-compliance

Audits Dart and Flutter dependency licenses and produces a compliance report.

162|23|Updated Feb 27, 2026
Search Tags:#flutter#dependency audit#dart#license compliance#pubspec#copyleft#open source licenses
One-click install
npx skills add https://github.com/VeryGoodOpenSource/vgv-ai-flutter-plugin --skill license-compliance-verygoodopensource
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: license-compliance
Source: https://github.com/VeryGoodOpenSource/vgv-ai-flutter-plugin/tree/main/skills/license-compliance
Command: npx skills add https://github.com/VeryGoodOpenSource/vgv-ai-flutter-plugin --skill license-compliance-verygoodopensource

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Shipping a Dart or Flutter app without knowing your dependency licenses can expose you to copyleft obligations or unlicensed code. This Skill scans your project's dependencies, flags risky or unknown licenses, and produces a standardized compliance report you can attach to a release ticket. ## Core Features & Use Cases - Automated License Scanning: Runs the Very Good CLI packages_check_licenses MCP tool (or the very_good packages check licenses command as fallback) against any project directory, including monorepo subdirectories. - Risk Categorization: Classifies licenses into permissive, weak copyleft, strong copyleft, and unknown/missing tiers with clear guidance for each. - Fixed-Format Reporting: Delivers a consistent License Compliance Report with summary counts, a flagged-dependencies table, and ranked recommendations. - Use Case: Before a release, ask for a license audit of your Flutter app; the Skill scans direct and transitive dependencies, flags a GPL-3.0 transitive package as high risk, and recommends replacing it. ## Quick Start Ask the assistant to run a license compliance audit on your Flutter project directory and report any flagged dependencies.

Frequently Asked Questions about license-compliance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check dependency licenses in a Flutter project?▼

Run the Very Good CLI packages_check_licenses tool on your project directory with licenses enabled, or run `very_good packages check licenses <project-directory>` directly. The output lists each dependency's license so risky ones can be flagged.

How do I audit licenses in a monorepo subdirectory?▼

Pass the subdirectory path to the tool, for example `directory: 'mobile'` when the Flutter project lives in a monorepo subfolder. The scan then targets that project rather than the workspace root.

Can I confirm license compliance from a pubspec dependency list?▼

No. A pubspec dependencies block lists only direct dependencies, while copyleft obligations often come from transitive packages. A real scan of the resolved dependency tree is required before any compliance verdict.

Which open source licenses are risky for commercial Flutter apps?▼

Strong copyleft licenses like GPL-2.0, GPL-3.0, and AGPL-3.0 are high risk because they may require your whole project to adopt the same license. Permissive licenses like MIT, BSD, and Apache-2.0 are safe for any use.

What happens when a package license cannot be detected?▼

A missing or undetected license is treated as Unknown/Missing and flagged as high risk, since legally it means all rights reserved. It stays flagged for manual review even if the package's pub.dev page suggests a license.

Related Skills

Explore More Legal & Compliance Skills→
chooyan-engchooyan-eng

audit-flutter-package

Audit Flutter package archives and transitive dependencies for supply chain risk.

Community
Advanced
seb1nseb1n
147

license-analysis

Analyze open-source license compatibility and compliance risks across project dependencies.

Community
Advanced
cpa03cpa03

dependency-audit

Audit npm dependencies for vulnerabilities, outdated packages, and license compliance.

Community
Intermediate
NVIDIANVIDIA
8.1k

sbom

Generate CycloneDX SBOMs with Syft, resolve licenses, and export CSV reports.

Official
Intermediate