Dependency License Audit

该 Skill 通过 Python 脚本扫描项目依赖（npm、pip、Go、Rust、Ruby）的许可证，按 permissive、weak-copyleft、any-open 或自定义策略分类许可，识别强 copyleft、专有与未知许可，输出 text、JSON 或 Markdown 报告，并支持 --ci 退出码用于 CI 许可证门禁。

charlie-morrison

热度 54.13

最近更新 2026-05-11 17:42:01

分类：安全依赖：代码执行 / 读写文件应用场景：DevOps / 报告撰写 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add dependency-license-audit

Metadata

name: dependency-license-audit
description: Scan project dependencies for license compatibility issues, GPL contamination, and compliance violations. Supports npm, pip, Go, Rust, and Ruby ecosystems. Use when asked to audit licenses, check license compliance, find GPL contamination, verify dependency licensing, generate license reports, or ensure open-source compliance before shipping. Also use for CI/CD license gates.

Dependency License Audit

Scan project dependencies for license compatibility issues across multiple ecosystems.

Quick Start

# Basic scan (permissive policy)
python3 scripts/license_audit.py /path/to/project

# Strict enterprise scan with CI exit codes
python3 scripts/license_audit.py /path/to/project --policy permissive --ci --format markdown

# Allow weak copyleft (LGPL, MPL)
python3 scripts/license_audit.py /path/to/project --policy weak-copyleft

# Include transitive deps (npm)
python3 scripts/license_audit.py /path/to/project --include-transitive

# JSON output for tooling
python3 scripts/license_audit.py /path/to/project --format json

Supported Ecosystems

Ecosystem	Files Parsed	License Source
npm	package.json, package-lock.json, node_modules/*/package.json	Package metadata
pip	requirements.txt, Pipfile, pyproject.toml	Installed package metadata
Go	go.mod	Manual/UNKNOWN (no local metadata)
Rust	Cargo.toml	Manual/UNKNOWN (no local metadata)
Ruby	Gemfile	Manual/UNKNOWN (no local metadata)

npm and pip auto-detect licenses from installed packages. Go/Rust/Ruby report UNKNOWN unless packages are installed — review manually.

Policies

Policy	Allows	Use When
`permissive` (default)	MIT, Apache-2.0, BSD, ISC, etc.	Proprietary/commercial projects
`weak-copyleft`	+ LGPL, MPL, EPL	Library consumers (dynamic linking)
`any-open`	All OSI-approved	Open-source projects
`custom`	User-defined	Enterprise with specific requirements

For custom policy setup, see references/custom-policy.md.

Output Formats

text — Human-readable terminal output (default)
json — Machine-readable for CI pipelines and tooling
markdown — Report with tables, suitable for PRs or documentation

CI Exit Codes

With --ci flag:

0 — No issues
1 — Warnings only (unknown licenses)
2 — Policy violations found

License Classifications

The scanner classifies licenses into categories:

permissive — MIT, Apache-2.0, BSD, ISC, Unlicense, CC0, etc.
weak-copyleft — LGPL, MPL, EPL, CDDL (modifications must be shared, but linking is OK)
strong-copyleft — GPL, AGPL, SSPL (derivative works inherit the license)
proprietary — UNLICENSED or commercial indicators
unknown — Not recognized; manual review needed

SPDX expressions (MIT OR Apache-2.0, MIT AND BSD-3-Clause) are evaluated: OR picks most permissive, AND picks most restrictive.

Workflow

Run audit against project directory
Review violations and warnings in output
For each violation, follow the recommendations provided
Optionally create .license-policy.json for custom rules
Add --ci flag to CI pipeline for automated enforcement