license-check

Package license analysis — detect copyleft conflicts against a permissive policy, surface AGPL / SSPL / GPL contaminants, output SPDX SBOM with per-package license findings.

Arguments: [--policy permissive|copyleft-aware|strict]

Grants: Bash(vulnetix:*) Read Grep Glob

Vulnetix License Check Skill

Use when

  • Pre-release: confirm no copyleft contaminants in a permissive-licensed product.
  • Vetting a new dep’s license before adoption.
  • Building an OSS attribution document (NOTICE file).
  • Producing a customer-facing license disclosure.
  • Quarterly compliance review with --policy strict to catch any non-allowlisted licenses.

Don’t use for

  • Vulnerability scanning — use vulnetix scan --sca.
  • License text retrieval — use the package manager directly (npm view <pkg> license).

Conventions

Follows skills/_lib/contract.md. In short: use the vulnetix_* MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes.

Step 1: Run license analysis

vulnetix license -o json-spdx > .vulnetix/licenses.${TIMESTAMP}.spdx.json

Step 2: Apply policy

Default policy:

  • permissive: flag GPL-, AGPL-, LGPL-* against MIT/Apache-2.0/BSD codebase
  • copyleft-aware: flag AGPL-* and SSPL-1.0
  • strict: flag any non-allowlisted license; allowlist = MIT, Apache-2.0, BSD-2/3-Clause, ISC, MPL-2.0

User can override via --policy. Accept user-supplied allowlist via .vulnetix/license-policy.yaml if present.

Step 3: Render

| Package | Version | License | Policy verdict | Action |

Conflicts highlighted. Suggest replacement packages for blocked licenses (consult vulnetix vdb packages search <name> --license <permitted> if needed).

Step 4: Compliance bundle hint

If --bundle flag provided, also output the file path so the compliance-bundler agent can pick it up.

Memory update

.vulnetix/licenses/<timestamp>.summary.yaml with conflict counts.

Edge cases & gotchas

  • --policy permissive flags GPL-* / AGPL-* / LGPL-* against an MIT/Apache codebase; --policy strict allowlists only MIT, Apache-2.0, BSD-2/3-Clause, ISC, MPL-2.0.
  • Custom allowlist via .vulnetix/license-policy.yaml overrides the built-in policy.
  • License detection uses package metadata; dual-licensed packages (MIT OR Apache-2.0) are reported as the FIRST license unless the policy file says otherwise.
  • SPDX expression parsing handles common patterns (MIT, Apache-2.0, BSD-3-Clause) but not custom non-SPDX strings like “see LICENSE file” — those flag as “Unknown”.
  • Transitive deps are included by default; pass --direct-only to scope to top-level packages.
  • License findings DO NOT include legal review — flag them for legal counsel, do not auto-approve based on the skill output.