Does it include transitive dependencies?

Yes. Copyleft usually arrives that way, and each finding says whether the dependency is direct or transitive.

Does it matter how I distribute the product?

A lot. SaaS, a shipped binary and an open source project carry different risk, so it asks first. AGPL is treated as critical even for SaaS.

Can I trust the result?

It reports what package metadata says, which is sometimes wrong. For critical findings, check the LICENSE file shipped in the package.

Built hereUpdated 10 Jul 2026

Open source license check

/legal--oss-license-check

/legal--oss-license-check is a Claude Code skill in the Business section. Scans your dependency tree for incompatible licenses, copyleft risk and unmet attribution obligations.

Author's description

Scan dependencies for license compatibility, obligations, and copyleft risk

Use it when

You are shipping a product and want to know if a dependency forces you to open your code
A customer asks for assurances about open source licenses
You need a NOTICE file with the required attributions

Not for

Replacing the advice of a lawyer
Final verdicts: unclear cases are marked [COUNSEL]

What you get

A Markdown report in legal/ with a license summary table, findings by severity and fix options, plus a NOTICE file if attributions are missing.

How to ask for it

/legal--oss-license-check check the licenses of my npm dependencies
/legal--oss-license-check tell me if I have any copyleft risk in this project
/legal--oss-license-check check license compatibility before I ship

Install

curl -fsSL https://raw.githubusercontent.com/sgomez-dev/claude-skills/main/install.sh | bash

After installing with the script, type /legal--oss-license-check. Using Cursor, Windsurf or Codex? Platform guides

Questions about this skill

Does it include transitive dependencies?: Yes. Copyleft usually arrives that way, and each finding says whether the dependency is direct or transitive.
Does it matter how I distribute the product?: A lot. SaaS, a shipped binary and an open source project carry different risk, so it asks first. AGPL is treated as critical even for SaaS.
Can I trust the result?: It reports what package metadata says, which is sometimes wrong. For critical findings, check the LICENSE file shipped in the package.

Demo coming soon