oss-review

Analyze SBOM dependency lists for copyleft license compliance risks.

6|Updated May 21, 2026

Search Tags:#open source #license compliance #sbom #copyleft #gpl agpl lgpl #patent retaliation #china copyright law

Ready to run

npx skills add https://github.com/oxunafufa55/claude-for-legal-china-IP --skill oss-review-oxunafufa55

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oss-review
Source: https://github.com/oxunafufa55/claude-for-legal-china-IP/tree/main/skills/oss-review
Command: npx skills add https://github.com/oxunafufa55/claude-for-legal-china-IP --skill oss-review-oxunafufa55

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

它帮助企业在使用开源软件组件时，快速识别许可证合规风险与“传染性”义务，并输出可落地的整改建议，降低因违规披露或许可冲突而带来的法律与商业风险。

Core Features & Use Cases

SBOM 解析与许可证识别：从 SBOM/依赖清单中归一化许可证标识（含 Dual License / Unknown / 自定义许可证）。
Copyleft 传染路径分析：基于软件使用方式（静态链接、动态链接、源码修改、SaaS/网络交互等）评估 GPL/AGPL/LGPL 风险边界。
中国法与披露义务对照：结合《著作权法》《计算机软件保护条例》与中国司法认定，检查保留声明、提供许可证副本与源代码/要约等义务，并评估 Apache-2.0 等专利条款风险。
输出《开源软件合规审查意见书》：形成高/中/低风险分级清单、整改计划与持续合规建议，便于法务审批与研发落地。

Quick Start

将你的 SBOM/依赖清单文件路径提供给该 Skill，然后让它生成“开源软件合规审查意见书”用于审批与整改。

Frequently Asked Questions about oss-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check SBOM dependencies for GPL copyleft contagion risk?▼

To check SBOM dependencies for GPL copyleft contagion risk, parse standard SBOM formats, normalize license identifiers to SPDX, and evaluate static linking, dynamic linking, source code modification, and SaaS interaction scenarios to identify disclosure obligations.

What open source license compliance obligations apply under China copyright law?▼

Open source license compliance obligations under China copyright law involve checking the Copyright Law and Computer Software Protection Regulations to verify copyright notices, license copies, source code offers, and patent retaliation clauses in licenses like Apache-2.0.

How do I generate an open source compliance opinion report for enterprise software?▼

You generate an open source compliance opinion report by analyzing SBOM dependency lists for copyleft contagion and disclosure obligations, assessing patent retaliation clauses, and producing a structured report with high, medium, and low risk tiers alongside remediation steps.

Does AGPL copyleft apply to SaaS and network interaction scenarios?▼

AGPL copyleft does apply to SaaS and network interaction scenarios. Evaluating open source compliance involves analyzing these specific software use cases to determine if AGPL triggers source code disclosure obligations for distributed or network-served enterprise software.

Can I normalize dual license and unknown SPDX identifiers from an SBOM dependency list?▼

You can normalize dual license, unknown, and custom license identifiers from an SBOM dependency list. The compliance process parses standard SBOM formats and normalizes these license identifiers to SPDX standards to accurately assess downstream copyleft risks.

What are the limitations of automated open source license compliance analysis?▼

Limitations of automated open source license compliance analysis include the complexity of accurately mapping custom or unknown licenses to SPDX identifiers and determining exact contagion paths for heavily modified code within dynamic SaaS environments without manual legal interpretation.