oss-review

Analyze dependency licenses and recommend compliance actions.

Updated Jun 30, 2026

Search Tags:#dependency analysis #license compliance #oss review #open source license #license verification

Ready to run

npx skills add https://github.com/Bossmann007/claude-legal-br --skill oss-review-bossmann007

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-review
Source: https://github.com/Bossmann007/claude-legal-br/tree/main/ip-legal/skills/oss-review
Command: npx skills add https://github.com/Bossmann007/claude-legal-br --skill oss-review-bossmann007

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires claude-for-legal, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps in verifying the compliance of open source licenses for a list of dependencies, a single library, or output code, aiding in the review of manifests, SBOMs, or repositories for copyleft obligations and license compatibility.

Core Features & Use Cases

License Compliance Check: Verifies open source license compliance against a practice profile.
Dependency Analysis: Classifies dependencies by license family, maps obligations to deployment models, and identifies unknown licenses.
Action Recommendations: Recommends actions such as fulfilling, replacing, removing, or seeking legal review.
Use Case: Use this Skill to review a project's package.json file for license compliance before deployment.

Quick Start

Run /ip-legal:oss-review ~/code/meu-projeto/package.json to check license compliance of your project's dependencies.

Frequently Asked Questions about oss-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check open source license compliance for project dependencies?▼

To check open source license compliance, you can run a review against a manifest file like package.json. The Skill analyzes your list of dependencies, classifies their license families, and identifies copyleft obligations or unknown licenses to ensure compliance.

What is the best way to verify license compatibility before deployment?▼

The best way to verify license compatibility is by analyzing the license profile and deployment model of your dependencies. This process maps specific license obligations to your deployment scenario and recommends actions like fulfilling, replacing, or removing problematic libraries.

How does dependency analysis handle unknown open source licenses?▼

Dependency analysis handles unknown open source licenses by flagging them during the classification process. It identifies these gaps in your SBOM or manifest and explicitly recommends seeking a formal legal review to mitigate compliance risks before deployment.

Can I use this to review an SBOM for copyleft obligations?▼

Yes, you can use this to review an SBOM for copyleft obligations. It processes software bills of materials and repository files to verify license compliance against a configured practice profile, ensuring all open source obligations are accurately mapped.

Do I need to configure a practice profile to analyze open source licenses?▼

Yes, you need to configure a practice profile to analyze open source licenses. The practice profile defines the specific compliance rules and deployment models used to classify dependencies, map obligations, and generate accurate action recommendations.

What actions are recommended when a dependency violates license compliance?▼

When a dependency violates license compliance, recommended actions include fulfilling the license obligations, replacing the library with a compatible alternative, removing the dependency entirely, or seeking a formal legal review to resolve complex scenarios.