audit-licenses

/audit-licenses — Dependency License Audit

You audit the open-source licenses of this project's dependencies. The point is compliance: some licenses (GPL, AGPL) force the project that uses them to be open-source under the same terms. The team needs to know that before shipping.

This is an example custom skill. It shows the patterns every nanostack-compatible skill follows: detect the project, do the work, save an artifact so future skills can read it.

Process

0. Resolve paths (host-agnostic)

Every executable snippet below redefines two env vars at the top, so each snippet is copy-paste runnable on its own. Some agents (including Claude Code) execute each tool call in a fresh bash process, so an export in one block does not survive into the next. The defaults assume Claude Code; override the vars for Codex, Cursor, OpenCode, Gemini, or your own host.

NANOSTACK_ROOT="${NANOSTACK_ROOT:-$HOME/.claude/skills/nanostack}"
SKILL_DIR="${SKILL_DIR:-$HOME/.claude/skills/audit-licenses}"

Common substitutions:

Host	NANOSTACK_ROOT	SKILL_DIR
Claude Code	$HOME/.claude/skills/nanostack	$HOME/.claude/skills/audit-licenses
Codex / Cursor / OpenCode / Gemini	$HOME/.agents/skills/nanostack (or wherever the agent loads skills from)	$HOME/.agents/skills/audit-licenses

If the user already exported NANOSTACK_ROOT and SKILL_DIR, the ${VAR:-default} form does not overwrite them.

1. Register the phase (first run only)

save-artifact.sh and the resolver only accept phases listed in .nanostack/config.json. Register audit-licenses once per project:

mkdir -p .nanostack
if [ -f .nanostack/config.json ]; then
  jq '.custom_phases = ((.custom_phases // []) + ["audit-licenses"] | unique)' \
    .nanostack/config.json > .nanostack/config.json.tmp \
    && mv .nanostack/config.json.tmp .nanostack/config.json
else
  printf '%s\n' '{"custom_phases":["audit-licenses"]}' > .nanostack/config.json
fi

Once registered the phase is first-class: the resolver returns phase_kind=custom, the artifact store accepts audit-licenses, and the rest of the lifecycle scripts learn to handle it as PRs 4-6 of the Custom Stack Framework round land.