Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add laurigates/claude-plugins --skill code-license-positiongit clone --depth 1 https://github.com/laurigates/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/laurigates/claude-plugins/code-license-position)<a href="https://agentmods.dev/skills/laurigates/claude-plugins/code-license-position"><img src="https://agentmods.dev/badge/skills/laurigates/claude-plugins/code-license-position/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/laurigates/claude-plugins/code-license-position"><img src="https://agentmods.dev/badge/skills/laurigates/claude-plugins/code-license-position.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01116 |
| Opus 5.5 | $0.00013 | $0.00446 |
| Sonnet 5.5 | $0.00007 | $0.00223 |
| Haiku 4.5 | $0.00003 | $0.00112 |
Grade A, and why
code-license-position scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s https://huggingface.co/api/models/<owner>/<repo> | jq -r '.siblings[].rfilename' | grep -iE 'licen|faq|qa|terms' How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verify the Licensing Position, Not Just the LICENSE File
When to Use This Skill
| Use this skill when... | Use something else when... |
|---|---|
A LICENSE for an open-weights model or source-available dependency seems to forbid your use (territory, entity, field-of-use carve-out) |
Auditing a whole dependency tree for licence compatibility — use code-quality-plugin:code-dep-audit |
| A licence conclusion is about to land in a public issue, PR, or doc | Deciding whether to contribute upstream at all — use git-plugin:git-issue-scoping |
A LICENSE reads complete and authoritative, so a restriction found in it gets
reported as settled fact. But for source-available models and dependencies the
vendor's actual position routinely lives in two other places in the same
repo: a licence FAQ, and the discussion tab. Read the licence, then go find
those, before telling anyone a licence blocks the work.
Canonical break (2026-08,
MiniMaxAI/MiniMax-H3):LICENSE§I.5 excludes the EU, UK, South Korea and USA from the "Applicable Territory", and §V.4 bars use — even distribution of Outputs — outside it. That was reported as a hard blocker in a public issue. The same repo'sdocs/QA-about-License.mdframes the carve-out as regulatory caution, "not yet, not ever", and links an application form; a maintainer in HF discussion #12 wrote "apply will auto get access" and told individuals to putPersonal/Nonein the mandatory Company Name field. The blocker was a form. Corrected twice, publicly.
Execution
-
List the repo's own licence docs alongside
LICENSE:curl -s https://huggingface.co/api/models/<owner>/<repo> | jq -r '.siblings[].rfilename' | grep -iE 'licen|faq|qa|terms'GitHub analogue:
gh api repos/<owner>/<repo>/contentsfor a licence FAQ. -
Read the discussion threads that mention the licence:
curl -s https://huggingface.co/api/models/<owner>/<repo>/discussions/<n> | jq -r '.events[] | select(.type=="comment") | "=== \(.author.name)\n\(.data.latest.raw)\n"'
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago First seen · 89 lines · 33 tokens per session scan A aa2416baebf0
code-license-position is a skill published in the GitHub repository laurigates/claude-plugins (59 stars, last pushed today), licensed MIT. It adds 33 tokens to every session and 1,116 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-30.
Other skills, from other repositories
governance
Manage openEHR specification governance: releases, change requests (CR/PR), versioning, and lifecycle states (Planning, Development, Trial, Stable, Paused, Retired). This skill should be used when the user asks to create, tag, or fix a release, update release entries in manifest.json, raise or progress a CR/PR…
systemprompt-tools
Call the free systemprompt.io tools API from any agent: EU AI Act risk classification, CLAUDE.md scoring, llms.txt/AGENTS.md generation and validation, GitHub Actions permissions, and AI ROI calculation. No API key, no signup.
compliance-management
Master compliance management with GDPR, SOC 2, ISO 27001, audit preparation, and regulatory requirements.
security-documentation
Master security documentation with security policies, incident response plans, security procedures, and compliance documentation.
legal-hold
Issue, refresh, release, or report on legal holds — drafts the hold notice as .docx, updates legalhold fields in log.yaml, and calendars the next refresh. Use when the user says "issue a hold", "refresh hold", "release hold", or asks for a portfolio-wide hold status report.
specification-writing
A workflow for writing complete patent specifications from patent claims and an invention disclosure. It adapts the document to a chosen jurisdiction, such as the US, Europe, or China.