skills.rest
uk-agents
uk-agentsOFFICIAL
Explore all skills by this author →
GitHub

oss-review

Classify open source licences and map obligations for dependency reviews.

9|Updated May 18, 2026
Search Tags:#open source#SBOM#license compliance#SPDX#dependency review#copyleft risk#SaaS obligations
One-click install
npx skills add https://github.com/uk-agents/uk-legal-plugins --skill oss-review-uk-agents
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oss-review
Source: https://github.com/uk-agents/uk-legal-plugins/tree/main/ip-legal-uk/skills/oss-review
Command: npx skills add https://github.com/uk-agents/uk-legal-plugins --skill oss-review-uk-agents

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents legal and commercial surprises by identifying open source licences in a dependency list and mapping their obligations to how your software is deployed.

Core Features & Use Cases

  • Licence classification with escalation: Classifies each dependency into permissive, weak copyleft, strong copyleft, public domain, non-OSI source-available, or unknown, and routes strong copyleft/unknown cases for attorney review.
  • Deployment-aware obligation mapping: Tailors which licence obligations matter based on whether the output is used as SaaS, distributed binaries, internal-only, or embedded/firmware.
  • Outbound open-sourcing compatibility check: When reviewing your own code for release, verifies compatibility between the proposed outbound licence and embedded dependencies, and flags missing or incomplete attribution packaging.
  • Decision-oriented memo output: Produces a structured memo that summarises blocks, risks, and recommended actions (comply, replace, remove, seek legal review, or seek commercial licence).

Quick Start

Run oss-review on your dependency manifest by telling the plugin to review a package.json file for a SaaS deployment and return a memo with any licences that need legal review.

Frequently Asked Questions about oss-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check open source license compliance for my project dependencies?▼

Open source license compliance is verified by classifying dependencies into permissive, copyleft, or unknown categories and mapping obligations to your specific deployment model. This Skill analyzes dependency manifests and SBOMs to generate a structured compliance memo.

How do SBOM and SPDX reviews work for SaaS deployment models?▼

SBOM and SPDX reviews for SaaS deployments map license obligations based on how the software is hosted rather than distributed. The review classifies dependencies and evaluates if SaaS usage triggers copyleft conditions or attribution requirements for the provided manifest.

Does copyleft license risk affect shipping binaries and firmware differently than SaaS?▼

Copyleft license risk affects binaries and firmware differently than SaaS because distribution triggers obligations that network hosting often avoids. This Skill performs deployment-aware obligation mapping to identify if strong copyleft licenses require source disclosure for your specific distribution model.

How do I verify outbound license compatibility before open-sourcing my code?▼

Outbound license compatibility is verified by cross-referencing your proposed license against the licenses of embedded dependencies. This Skill checks for conflicts between your chosen outbound license and dependency licenses, flagging missing attribution packaging or incompatible copyleft terms.

What happens when a dependency has an unknown or non-OSI source-available license?▼

When a dependency has an unknown or non-OSI source-available license, the review escalates the item for attorney review rather than clearing it. The Skill requires reading the actual license text instead of relying on package metadata to determine obligations.

Do I need to manually read license text or is package metadata enough for a dependency review?▼

A dependency review requires reading the actual license text rather than relying on package metadata alone. This Skill mandates verifying the real license file to accurately classify strong copyleft conditions and map deployment-specific obligations.

Related Skills

Explore More Legal & Compliance Skills→
anthropicsanthropics
9.1k

oss-review

Identify open source license families and deployment obligations from dependency manifests or SBOMs.

Official
Advanced
Sir-chawakornSir-chawakorn
33

license-checker

Check and validate project dependency licenses for NPM and Python packages.

Community
Intermediate
MayaDispelerMayaDispeler
3

devsecops

Apply security checks across CI/CD pipelines with GitLeaks, Semgrep, Snyk, Trivy, and cosign.

Community
Advanced
tractorjuicetractorjuice

arckit-eu-dsa

Assess EU Digital Services Act compliance obligations for online intermediary services.

Community
Advanced