License check

Skill kasimmj/claude-skills-mega/skills/license-check

🤖 The ultimate curated collection of production-ready Claude Code skills with a framework to build your own.

Install

npx -y skills add kasimmj/claude-skills-mega --skill license-check

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Inventory all dependency licenses across package.json, requirements.txt, go.mod, Cargo.toml, pubspec.yaml and flag incompatible or unknown licenses.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, as published. Nobody here has run it

License Check Skill

You are performing a dependency license audit. Output is a table — make it readable and actionable.

Step 1 — Find all manifests

Look for and parse:

package.json + package-lock.json / yarn.lock / pnpm-lock.yaml
requirements.txt, Pipfile.lock, poetry.lock, pyproject.toml
go.mod / go.sum
Cargo.toml / Cargo.lock
pubspec.yaml / pubspec.lock
Gemfile.lock
composer.lock

Step 2 — Resolve license for each dep

For each direct + transitive dependency:

Read from lockfile if license metadata is there
Otherwise: hit the registry (npm, PyPI, crates.io, pub.dev)
Fall back to "UNKNOWN" — don't guess

Step 3 — Classify

Class	Examples	OK for proprietary?
🟢 Permissive	MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense	✅ Yes
🟡 Weak copyleft	LGPL-2.1, LGPL-3.0, MPL-2.0	⚠️ With caveats (dynamic linking, file-level)
🔴 Strong copyleft	GPL-2.0, GPL-3.0, AGPL-3.0	❌ No — would force open-sourcing
⚪ Source-available	BSL, SSPL, Elastic v2	⚠️ Often forbidden for SaaS
❓ Unknown / Missing	—	⚠️ Must resolve before shipping

Step 4 — Output

LICENSE AUDIT REPORT
─────────────────────
Total dependencies: 1,247 (direct: 38, transitive: 1,209)

🔴 BLOCKERS (must remove or replace)
  - <package@version> — <license> — <reason>

⚠️ WARNINGS (review with legal)
  - <package@version> — <license> — <reason>

❓ UNKNOWN (resolve before release)
  - <package@version> — <repo URL to investigate>

🟢 CLEAN (1,239 packages)
  ✓ MIT       : 894
  ✓ Apache-2.0 : 218
  ✓ BSD-3-Clause: 71
  ✓ ISC        : 56

Step 5 — Suggest fixes

For each blocker, suggest a permissive replacement if you know one:

mariadb (GPL) → mysql2 (MIT)
readline (GPL) → linenoise (BSD)

When NOT to use

The project is OSS itself with a GPL license — copyleft deps are fine then
You only need a security audit (use security-audit skill)

Failure modes

⚠️ License strings in metadata are not always accurate. Always cross-check with the actual LICENSE file in the upstream repo for anything critical.
⚠️ Dual-licensed projects (e.g., MPL + GPL) need careful handling — note the dual nature and recommend the permissive option.