skills.rest
stakwork
stakworkOFFICIAL
Explore all skills by this author →
GitHub

oss-review

Analyze open source dependencies for license obligations and compatibility risks.

109|20|Updated Mar 7, 2025
Search Tags:#license compatibility#license compliance#copyleft#dependency review#legal risk#open source licensing#sbom analysis
One-click install
npx skills add https://github.com/stakwork/stakgraph --skill oss-review-stakwork
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-review
Source: https://github.com/stakwork/stakgraph/tree/main/mcp/skills/ip-legal/oss-review
Command: npx skills add https://github.com/stakwork/stakgraph --skill oss-review-stakwork

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill identifies open source license obligations and compatibility risks before dependencies ship or code is released, helping teams avoid accidental copyleft violations, missing attribution, and non-OSI licensing conflicts.

Core Features & Use Cases

  • Dependency License Classification: Reviews manifests, SBOMs, lockfiles, individual libraries, and repositories to classify permissive, weak copyleft, strong copyleft, public domain, non-OSI, and unknown licenses.
  • Deployment-Aware Risk Analysis: Maps license obligations to SaaS, distributed binary, internal, and embedded deployment models, including linking, subprocess, and network-use considerations.
  • Actionable Compliance Memo: Flags unknown or conflicting licenses, evaluates outbound licensing compatibility, identifies required notices and source disclosures, and routes issues for attorney review.
  • Use Case: Before releasing a CLI product, provide its dependency manifest and deployment model to identify GPL, AGPL, LGPL, source-available, and attribution obligations that must be resolved before shipping.

Quick Start

Use the oss-review skill to review the provided dependency manifest, determine its licenses and obligations for the intended deployment model, and prepare a compliance memo with prioritized recommendations.

Frequently Asked Questions about oss-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check open source license compliance for my project dependencies?▼

Open source license compliance is checked by analyzing dependency manifests or SBOMs to classify permissive, copyleft, and non-OSI licenses, mapping obligations to your deployment model, and generating a memo of required actions.

What is copyleft license compatibility and when does it matter for software distribution?▼

Copyleft license compatibility determines whether obligations like source disclosure apply to your outbound code, varying by SaaS, binary, or embedded deployment models and requiring legal review for contested issues.

How do I analyze an SBOM for GPL and AGPL obligations before shipping a CLI product?▼

SBOM analysis for GPL and AGPL obligations involves loading the practice profile, reading applicable license texts, classifying dependencies conservatively, and preparing a compliance memo with prioritized recommendations for shipping.

Can I use weak copyleft libraries in proprietary software without triggering source disclosure?▼

Weak copyleft libraries in proprietary software require mapping linking and subprocess considerations against your specific consumption model to determine if source disclosure obligations are triggered or avoidable.

What should I do if my dependency review finds unknown or non-OSI licenses?▼

Dependency reviews finding unknown or non-OSI licenses must classify them conservatively, flag them as conflicting, evaluate outbound licensing compatibility, and route the issues for attorney review.

Best way to evaluate open source license risks for embedded deployment models?▼

Evaluating open source license risks for embedded deployment requires analyzing dependency manifests, mapping copyleft obligations to embedded consumption models, and identifying required notices and source disclosures before release.

Related Skills

Explore More Legal & Compliance Skills→
Veloxia-agencyVeloxia-agency

dependency-auditor

Audit software dependencies for vulnerabilities, license conflicts, and upgrade risk.

Community
Advanced
PolliticalSolutionsPolliticalSolutions

oss-review

Classifies license families and maps compliance obligations to a deployment model, returning a structured legal memo.

Community
Advanced
NickCrewNickCrew
29

security-testing-patterns

Identify and mitigate security vulnerabilities in CI/CD pipelines.

Community
Advanced
highflame-aihighflame-ai
4

license-audit

Generate software bills of materials and verify dependency license policies across toolchains.

Official
Advanced