360 Secure SkillHub
360 安全技能中心

Dependency License Audit

核心功能：支持npm、pip等5种技术生态，扫描依赖的许可证兼容性、GPL污染及合规违规，可按宽松、弱copyleft等策略检查，输出文本、JSON、Markdown三种格式，CI模式返回对应退出码。典型场景：开源合规验证、项目交付前审计、CI/CD许可证门禁。输入为项目路径及可选参数，输出审计报告或CI状态码。

charlie-morrison
charlie-morrison
热度 54.14
最近更新 2026-05-11 17:42:01
分类：安全依赖：代码执行 / 读写文件应用场景：法律文档 / DevOps

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add dependency-license-audit
Metadata
name
dependency-license-audit
description
Scan project dependencies for license compatibility issues, GPL contamination, and compliance violations. Supports npm, pip, Go, Rust, and Ruby ecosystems. Use when asked to audit licenses, check license compliance, find GPL contamination, verify dependency licensing, generate license reports, or ensure open-source compliance before shipping. Also use for CI/CD license gates.

Dependency License Audit

Scan project dependencies for license compatibility issues across multiple ecosystems.

Quick Start

# Basic scan (permissive policy)
python3 scripts/license_audit.py /path/to/project

# Strict enterprise scan with CI exit codes
python3 scripts/license_audit.py /path/to/project --policy permissive --ci --format markdown

# Allow weak copyleft (LGPL, MPL)
python3 scripts/license_audit.py /path/to/project --policy weak-copyleft

# Include transitive deps (npm)
python3 scripts/license_audit.py /path/to/project --include-transitive

# JSON output for tooling
python3 scripts/license_audit.py /path/to/project --format json

Supported Ecosystems

Ecosystem Files Parsed License Source
npm package.json, package-lock.json, node_modules/*/package.json Package metadata
pip requirements.txt, Pipfile, pyproject.toml Installed package metadata
Go go.mod Manual/UNKNOWN (no local metadata)
Rust Cargo.toml Manual/UNKNOWN (no local metadata)
Ruby Gemfile Manual/UNKNOWN (no local metadata)

npm and pip auto-detect licenses from installed packages. Go/Rust/Ruby report UNKNOWN unless packages are installed — review manually.

Policies

Policy Allows Use When
permissive (default) MIT, Apache-2.0, BSD, ISC, etc. Proprietary/commercial projects
weak-copyleft + LGPL, MPL, EPL Library consumers (dynamic linking)
any-open All OSI-approved Open-source projects
custom User-defined Enterprise with specific requirements

For custom policy setup, see references/custom-policy.md.

Output Formats

  • text — Human-readable terminal output (default)
  • json — Machine-readable for CI pipelines and tooling
  • markdown — Report with tables, suitable for PRs or documentation

CI Exit Codes

With --ci flag:

  • 0 — No issues
  • 1 — Warnings only (unknown licenses)
  • 2 — Policy violations found

License Classifications

The scanner classifies licenses into categories:

  • permissive — MIT, Apache-2.0, BSD, ISC, Unlicense, CC0, etc.
  • weak-copyleft — LGPL, MPL, EPL, CDDL (modifications must be shared, but linking is OK)
  • strong-copyleft — GPL, AGPL, SSPL (derivative works inherit the license)
  • proprietary — UNLICENSED or commercial indicators
  • unknown — Not recognized; manual review needed

SPDX expressions (MIT OR Apache-2.0, MIT AND BSD-3-Clause) are evaluated: OR picks most permissive, AND picks most restrictive.

Workflow

  1. Run audit against project directory
  2. Review violations and warnings in output
  3. For each violation, follow the recommendations provided
  4. Optionally create .license-policy.json for custom rules
  5. Add --ci flag to CI pipeline for automated enforcement