License compliance

Skill mguttmann/code-audit-suite/skills/license-compliance

This skill should be used when the user asks to "run ScanCode", "check license compliance", "Lizenz-Compliance", "Lizenzen scannen", "find copyrights", "Copyright prüfen", "OSPO/legal license audit", "detect disallowed licenses (GPL/AGPL)", or wants text-level license/copyright detection with a pass/fail policy gate. Runs ScanCode Toolkit in Docker and gates on a license policy, processed directly in Claude Code.From its SKILL.md

Install

npx -y skills add mguttmann/code-audit-suite --skill license-compliance

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.6 KB, as published. Nobody here has run it

License Compliance

Purpose

ScanCode performs text-level license, copyright and provenance detection — comparing actual file contents against a database of license texts. This finds what Trivy's package-metadata license scan misses: licenses in vendored code, copied snippets, and undeclared/ambiguous files.

Relation to Trivy (similar but more): Trivy reports declared dependency licenses from manifests. ScanCode reads the source itself, adding file-level detection Trivy cannot do. Use ScanCode when real license compliance matters; for a quick dependency-license view, Trivy is enough.

What it actually outputs (important)

By default the scan does not leave a JSON in your repo. It mounts the project read-only, writes the full result to a temporary directory, evaluates a license policy against it, prints a verdict, and deletes the temp JSON on exit. So the normal output is the PASS / FAIL / REVIEW verdict, not a per-file file in the tree. To keep the full per-file JSON for review, opt in with SCANCODE_KEEP_JSON=/path/out.json.

The license policy gate

SCANCODE_DENY is a case-insensitive regex of disallowed license expressions. Default: GPL/AGPL (copyleft) — LGPL is allowed.
A detected disallowed license → RESULT: FAIL, exit 1 (a finding; in the suite this turns the verdict to FINDINGS).
No disallowed license → RESULT: PASS, exit 0.
SCANCODE_DENY="" → review-only mode: detect + report, never gate (RESULT: REVIEW, exit 0).

Because the suite runs ScanCode on every project, a single GPL/AGPL file flips the whole suite to FINDINGS — that is intentional. Adjust SCANCODE_DENY if a given copyleft license is acceptable for your project.

Core Workflow

Scan:
```
~/.claude/skills/license-compliance/scripts/scan.sh [TARGET_DIR]
```
First run builds the scancode-local image (downloads ScanCode, a few minutes).
On FAIL, the verdict lists the disallowed license expression(s) and an example file. Replace/remove the offending dependency or file, or — if the license is acceptable — widen SCANCODE_DENY.
For a deep per-file review (copyrights, provenance, ambiguous files), re-run with SCANCODE_KEEP_JSON=/tmp/scancode.json and inspect that JSON.
Re-run until RESULT: PASS.

Notes

Project is mounted read-only; the result JSON lives in a temp dir and is removed on exit — nothing is written into the scanned tree.
Scanning is CPU-intensive; node_modules, .git, */test/*, dist, build and megalinter-reports are ignored by default. Add globs via SCANCODE_IGNORE.
SCANCODE_PROCESSES controls parallelism (default 4). SCANCODE_PLATFORM defaults to linux/amd64 (ScanCode's native libs are amd64 wheels).

Resources

scripts/Dockerfile — builds a minimal ScanCode image from PyPI.
scripts/scan.sh — builds the image if needed, runs ScanCode (license + copyright + package) to a temp JSON, evaluates the license policy, and exits 0/1 (or 125 on an operational error). Env: SCANCODE_DENY, SCANCODE_KEEP_JSON, SCANCODE_IGNORE, SCANCODE_PROCESSES, SCANCODE_PLATFORM, SCANCODE_IMAGE.