oss-review

Classifies dependency licenses and maps copyleft obligations to deployment models.

Updated Jun 17, 2026
One-click install
npx skills add https://github.com/tk1cntt/PhapChe --skill oss-review-tk1cntt
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: oss-review
Source: https://github.com/tk1cntt/PhapChe/tree/main/docs/claude-for-legal-main/ip-legal/skills/oss-review
Command: npx skills add https://github.com/tk1cntt/PhapChe --skill oss-review-tk1cntt

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Legal and engineering teams need to know what licenses are in their dependency tree, what obligations those licenses trigger given how the software is deployed, and what to do about each one before shipping or open-sourcing code. ## Core Features & Use Cases - License Classification: Classifies every dependency into permissive, weak copyleft, strong copyleft, public domain, non-OSI source-available, or unknown buckets by reading actual license text rather than package metadata. - Deployment-Aware Obligation Mapping: Maps obligations to the deployment model (SaaS, distributed binary, internal only, embedded) since the same dependency triggers different obligations in each context. - Risk-Flagged Memo Output: Produces a structured memo with severity ratings, top-of-memo flags for license-unknown and non-OSI packages, outbound license compatibility checks, and attorney approval routing. - Use Case: Point it at a package.json or SBOM before a release to learn that a transitive AGPL dependency in your SaaS product requires attorney review before shipping. ## Quick Start Ask the assistant to run an OSS license review on your project's package.json file and tell it how the software will be deployed.

Frequently Asked Questions about oss-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check open source license compliance for my dependencies?

Provide a manifest file like package.json, requirements.txt, go.mod, or an SBOM, and state your deployment model. The review classifies each dependency by license family, maps obligations to how you deploy, and recommends comply, replace, remove, or attorney review per package.

What is the difference between permissive and copyleft licenses?

Permissive licenses like MIT, BSD, and Apache-2.0 mainly require attribution and license preservation. Copyleft licenses like GPL, LGPL, MPL, and AGPL require source disclosure of modifications or combined works, with AGPL extending the trigger to network use in SaaS deployments.

Does AGPL apply to SaaS applications?

Yes, AGPL's network-interaction clause means serving modified AGPL software over a network counts as distribution, so SaaS deployments trigger source-offer obligations. This is a contested legal question, so strong copyleft findings in SaaS are flagged for attorney review before shipping.

Can I use SSPL or BUSL licensed packages as open source?

No, SSPL, BUSL, Commons Clause, and Elastic License are source-available licenses, not OSI-approved open source. They restrict commercial or competing-service use, so the review flags them separately and recommends reading the specific license or seeking a commercial license.

What happens when a dependency has an unknown license?

License-unknown packages are flagged as needs review rather than defaulted to permissive. An unclassified dependency should stop a ship decision, since assuming permissive can turn into a source-disclosure obligation later.

What should I check before open-sourcing my own code?

Confirm the outbound license is compatible with every embedded dependency, LICENSE and NOTICE files are present and correct, third-party license texts are bundled, and no proprietary code, customer data, or credentials remain in the repo history.