License Mismatch Audit

该 Skill 是用于市场与客户端校验测试的许可证元数据夹具：在 frontmatter 中声明 license: Apache-2.0，但不附带 LICENSE 文件；被调用时只输出说明，指出许可证元数据属于自我声明，除非平台将其与仓库许可证文件、作者身份和项目历史进行比对。不含可执行脚本、网络访问或文件修改流程。

xmy0416

热度 26.24

最近更新 2026-05-19 15:38:17

分类：安全依赖：读写文件应用场景：摘要总结

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add license-mismatch-audit-skill

Metadata

name: license-mismatch-audit
description: Benign audit fixture for testing whether skill directories and marketplaces accept frontmatter-only license metadata.
license: Apache-2.0
compatibility: Test-only skill. No network access, shell execution, or external dependencies required.
metadata: {"author":"security-audit-test","purpose":"license-metadata-validation","expected_finding":"license field declares Apache-2.0 without a bundled LICENSE file"}
allowed-tools: Read

Frontmatter-Only License Audit Fixture

Use this skill only for marketplace and client validation testing.

This skill intentionally contains no executable scripts, no network instructions, and no file modification workflow. It is designed to test whether a skill client or marketplace accepts a frontmatter-only license declaration without a bundled LICENSE file.

Expected Reviewer Observation

SKILL.md frontmatter declares license: Apache-2.0.
No bundled LICENSE file is provided.
A format-only validator may pass this package.
A deeper consistency review may warn that authorization cannot be verified from repository files.

Task Behavior

When invoked, summarize that license metadata is self-declared unless the platform compares it against repository license files, author identity, and project history.