license-comply

To audit Python dependencies for open-source license compliance, use this Skill to scan project directories, map detected license strings to SPDX identifiers, and classify risk against your policy. It outputs findings for engineering and counsel review.

SPDX identifier mapping for license risk classification is the process of standardizing detected license strings into SPDX format, then applying allow, restricted, or flagged rules to assign low, medium, high, or unknown risk bands.

Yes, you can gate CI/CD builds on high-risk dependencies. The Skill generates compliance reports and supports CI gating configurations that fail builds when high-risk license findings are detected.

Available report formats for open-source compliance documentation include JSON, CSV, HTML, and Markdown. These outputs support audit trails and SBOM-oriented documentation for engineering and counsel review.

No, this compliance reporting tool does not clear licenses for production use. It produces risk bands and escalation guidance to support a counsel-in-the-loop review process rather than acting as legal clearance.

Python dependencies are classified as unknown risk in compliance reporting when their license terms cannot be detected or mapped to SPDX identifiers, requiring manual review to determine policy adherence.