skills.rest
anthropics
anthropicsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

oss-review

Identify open source license families and deployment obligations from dependency manifests or SBOMs.

9.1k|1.8k|Updated Apr 21, 2026
Search Tags:#dependency analysis#license compliance#oss licensing#copyleft risk#sbom review#outbound licensing#attorney escalation
One-click install
npx skills add https://github.com/anthropics/claude-for-legal --skill oss-review-anthropics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-review
Source: https://github.com/anthropics/claude-for-legal/tree/main/ip-legal/skills/oss-review
Command: npx skills add https://github.com/anthropics/claude-for-legal --skill oss-review-anthropics

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you determine which open source licenses are present in a dependency set and what obligations they trigger based on how your software will be deployed.

Core Features & Use Cases

  • License-family compliance check: Classifies dependencies into permissive, weak copyleft, strong copyleft, public domain, non-OSI, and unknown, including transitive dependencies where available.
  • Deployment-aware obligation mapping: Translates license implications into concrete actions for SaaS, distributed binaries, internal-only use, or embedded/firmware scenarios.
  • Outbound open-source compatibility check: When reviewing outbound code, verifies the chosen outbound license is compatible with embedded dependency licenses and flags missing/incorrect attribution materials.

Quick Start

Use oss-review to review your project’s dependency list or outbound code for OSS license compliance by telling it where your manifest, SBOM, or repo lives.

Frequently Asked Questions about oss-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check my SBOM for copyleft license risks before a release?▼

An SBOM review for copyleft risk identifies strong copyleft licenses in your dependencies and flags triggering obligations. It classifies components into permissive, weak copyleft, strong copyleft, or unknown categories to prevent shipping violations.

What is deployment-aware open source license compliance?▼

Deployment-aware license compliance maps open source obligations to your specific distribution model, such as SaaS, embedded firmware, or internal-only use. This translates license text into concrete actions required for your exact shipping scenario.

How do I verify outbound license compatibility with embedded dependencies?▼

Verifying outbound license compatibility checks your chosen outbound open source license against embedded dependency licenses. It flags incompatibilities and identifies missing or incorrect attribution materials required before publishing your code.

Does open source license compliance review work for non-OSI source-available licenses?▼

Open source license compliance review handles non-OSI source-available licenses by reading the actual license text. It classifies these unknowns and structures them for attorney escalation to determine deployment restrictions.

How do I generate a license compliance memo structured by severity?▼

Generating a license compliance memo structured by severity involves scanning your manifest or repository for dependency licenses. It produces a document outlining obligations and outbound compatibility findings ordered by risk level.

Related Skills

Explore More Legal & Compliance Skills→
ZekaiSuniZekaiSuni
100

oss-review

Classify dependency licenses and generate attorney-routable compliance memos.

Community
Advanced
az9713az9713

oss-review

Assess open source license obligations and compatibility for dependency lists.

Community
Advanced
hardw00thardw00t
90

sca-security

Scan dependencies for CVEs and audit licenses across software projects.

Community
Advanced
grant-vinegrant-vine
1

oss-licensing-advisor

Audit OSS licenses with SPDX mapping and compatibility risk scoring.

Community
Advanced