dependency-license-scanner

该 Skill 读取一个简单的 name==version 或 name==version|LicenseName 依赖列表文件，逐行输出 name | license，并将缺失许可证标记为 UNKNOWN。它不下载包、不查询注册表，也不判断许可证兼容性，适合在添加依赖前做快速许可证清点。

hmahmadcs

热度 25.33

最近更新 2026-10-20 01:25:30

分类：安全依赖：代码执行 / 读写文件应用场景：数据处理 / 法律文档 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add hmahmadcs/dependency-license-scanner

Metadata

name: dependency-license-scanner
description: Summarize declared licenses from a package manifest snippet. Use when checking OSS license risk before adding a dependency.
metadata: {"clawdbot":{"emoji":"⚖️","requires":{"bins":["python3"]}}}

Dependency License Scanner

Purpose / Overview

Parses a simple name==version list and prints license field if provided alongside each line as name | license.

When to Use

Vendoring decisions; SBOM draft from a hand-built list.

Usage / Instructions

Save lines as name==version|LicenseName or bare name==version.
Run python3 scripts/scan_licenses.py <file>.
Highlight unknown licenses as UNKNOWN.

Examples

python3 scripts/scan_licenses.py ./deps.txt

Requirements / Dependencies

python3.

Limitations / Caveats

Does not download packages or call package registries.

Security / Permissions

Reads only the list file path given. No network.

Attribution / License

MIT-0

Description

Summarize declared licenses from a package manifest snippet.

Use case

Intended for practitioners who need help with: Summarize declared licenses from a package manifest snippet.

Risks and mitigations

References

SPDX License List: https://spdx.org/licenses/

Ethical considerations

Illegal use is not allowed. Activity that violates national statutes or international norms is unacceptable; The publisher will not be accountable for illegal use. Do not use this skill for stalking, doxxing, or other privacy invasions that break the law. Do not use outputs to commit fraud or deceive regulated processes.