One AGPL-3.0 package in node_modules can oblige a closed-source SaaS to offer its own source code to every user, and one CC-BY-NC icon set makes a paid product break its license. This skill finds those and nine other license problems in your project and its dependencies before you ship, and tells you what to check for each one.

Your agent runs a scanner on your project folder. It first reads the project's own license (package.json, pyproject.toml, composer.json, Cargo.toml and the LICENSE file text) and works out whether the project is closed source (UNLICENSED, proprietary, no license) or open source ("private": true alone only means "do not publish to npm"), then reads every installed dependency: node_modules (npm, pnpm, Yarn, Bun), *.dist-info/METADATA in a virtualenv, Composer's vendor folder, or package-lock.json and composer.lock when nothing is installed. It understands SPDX expressions (for "A OR B" you may pick the more permissive one; "A AND B" means both apply; GPL linking exceptions count as weak copyleft), npm's old license objects and SEE LICENSE IN, Python License-Expression, License and classifiers, and dev-only dependencies. It never runs npm, pip or composer, and never uses the network. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. It is not legal advice.

What it checks

BLOCK (closed-source projects) - L01: AGPL, SSPL, EUPL, OSL and other network copyleft runtime dependencies - L02: non-commercial licenses (CC-BY-NC, PolyForm Noncommercial, Commons Clause) - L03: Business Source License (BUSL-1.1) packages before their Change Date

REVIEW (check before release)

• L11: GPL dependencies, and network copyleft in open-source projects or dev tools

• L12: LGPL, MPL, EPL and other weak copyleft runtime dependencies in closed-source projects

• L13: Elastic-2.0, PolyForm Small Business, JSON and other use-restricted licenses

• L14: dependencies with no license, a custom license or an unrecognized one

• L15: a publishable package that declares no license

• L16: an open-source license declared with no LICENSE file

• L17: a project license that is not a valid SPDX expression ("Apache 2.0", "GPLv3")

• L18: a LICENSE file or second manifest that disagrees with the declared license

What's included

• The scanner (Python 3.9+, standard library only), with the SPDX license list built in

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (npm lockfile, Python packages and Composer), and the real report the scanner produces on the risky one

Limits

It reads license metadata as written: license headers in source files, how a dependency is used (bundled, linked, separate program), compatibility between two open-source licenses, Rust, Go, Java, .NET and Ruby dependencies, and Yarn Plug'n'Play caches are not checked. Whether the project is closed source is inferred from its manifests. It is not legal advice, and NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 39 files: SKILL.md, the scanner in scripts/ (7 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (29 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.