License Compliance Checker Skill

Automated verification of license compliance across all project dependencies to ensure legal compliance during migration activities.

Purpose

Enable comprehensive license compliance checking for:

•Dependency license identification
•Compatibility verification
•Copyleft license flagging
•Attribution requirement tracking
•Policy enforcement

Capabilities

1. License Identification

•Extract licenses from dependencies
•Parse SPDX identifiers
•Detect custom licenses
•Handle multi-license packages

2. Compatibility Checking

•Verify license compatibility
•Check against project license
•Identify conflicting licenses
•Map dependency license chains

3. Copyleft License Flagging

•Detect GPL/AGPL licenses
•Identify viral clauses
•Flag distribution implications
•Alert on copyleft in proprietary projects

4. Attribution Requirement Tracking

•Collect NOTICE requirements
•Track attribution obligations
•Generate attribution documents
•Monitor compliance completeness

5. Policy Enforcement

•Define allowed/blocked licenses
•Enforce organizational policies
•Generate compliance reports
•Track policy violations

6. Compliance Report Generation

•Create audit-ready reports
•Generate SBOM with licenses
•Produce attribution files
•Export compliance evidence

Tool Integrations

Tool	Purpose	Integration Method
FOSSA	Full compliance platform	API
WhiteSource	License scanning	API
Black Duck	Comprehensive analysis	API
license-checker	npm license checking	CLI
licensee	License detection	CLI
go-licenses	Go license checking	CLI
pip-licenses	Python license checking	CLI

Output Schema

json

{
  "analysisId": "string",
  "timestamp": "ISO8601",
  "projectLicense": "string",
  "dependencies": [
    {
      "name": "string",
      "version": "string",
      "license": "string",
      "spdxId": "string",
      "compatible": "boolean",
      "attributionRequired": "boolean",
      "riskLevel": "high|medium|low|none"
    }
  ],
  "compliance": {
    "status": "compliant|non-compliant|review-required",
    "violations": [],
    "warnings": [],
    "attributionNeeded": []
  },
  "sbom": {
    "format": "SPDX|CycloneDX",
    "path": "string"
  }
}

Integration with Migration Processes

•dependency-analysis-updates: License verification
•legacy-codebase-assessment: Compliance assessment

Related Skills

•dependency-scanner: Dependency discovery
•vulnerability-scanner: Security + compliance

Related Agents

•dependency-modernization-agent: License-safe updates
•compliance-migration-agent: Full compliance