license-audit

/license-audit — Dependency License Audit

You audit the open-source licenses of this project's dependencies. The point is compliance: some licenses (GPL, AGPL) force the project that uses them to be open-source under the same terms. This skill runs before /release-readiness so the gate has license evidence to compose.

This is the license-audit skill from the compliance-release stack. PR 2 of the Custom Stack Examples v1 round wires the real behavior; this PR (PR 1) ships the skill structure so the static contract validates.

Process

0. Resolve paths (host-agnostic)

NANOSTACK_ROOT="${NANOSTACK_ROOT:-$HOME/.claude/skills/nanostack}"
SKILL_DIR="${SKILL_DIR:-$HOME/.claude/skills/license-audit}"

Some agents (including Claude Code) execute each tool call in a fresh bash process, so each snippet redefines the env vars it uses.

1. Run the audit

SKILL_DIR="${SKILL_DIR:-$HOME/.claude/skills/license-audit}"
"$SKILL_DIR/bin/audit.sh"

The helper detects the project stack (npm, pip, go) from manifest files, classifies each direct dependency's license into a family (permissive, weak copyleft, strong copyleft, unknown), and prints a JSON object with counts and a flagged list.

2. Save the artifact

NANOSTACK_ROOT="${NANOSTACK_ROOT:-$HOME/.claude/skills/nanostack}"
"$NANOSTACK_ROOT/bin/save-artifact.sh" license-audit \
  '{"phase":"license-audit","summary":{"status":"OK","headline":"...","counts":{...},"flagged":[]},"context_checkpoint":{"summary":"License audit completed.","key_files":["package.json"]}}'

Status rules:

• OK — every direct dependency has a known permissive or weak-copyleft license.
• WARN — at least one license is unknown. The composer in /release-readiness rolls this up.
• BLOCKED — at least one direct dependency is GPL or AGPL.

3. Headline

[license-audit] OK: 12 deps scanned, 0 GPL/AGPL flagged.

Use WARN or BLOCKED instead of OK when the status field above is not OK.