license-audit

# /license-audit — Dependency License Audit You audit the open-source licenses of this project's dependencies. The point is compliance: some licenses (GPL, AGPL) force the project that uses them to be open-source under the same terms. This skill runs before `/release-readiness` so the gate has license evidence to compose. This is the `license-audit` skill from the compliance-release stack. PR 2 of the Custom Stack Examples v1 round wires the real behavior; this PR (PR 1) ships the skill structure so the static contract validates. ## Process ### 0. Resolve paths (host-agnostic) ```bash NANOSTACK_ROOT="${NANOSTACK_ROOT:-$HOME/.claude/skills/nanostack}" SKILL_DIR="${SKILL_DIR:-$HOME/.claude/skills/license-audit}" ``` Some agents (including Claude Code) execute each tool call in a fresh bash process, so each snippet redefines the env vars it uses. ### 1. Run the audit ```bash SKILL_DIR="${SKILL_DIR:-$HOME/.claude/skills/license-audit}" "$SKILL_DIR/bin/audit.sh" ``` The helper detects the project stack (npm, pip, go) from manifest files, classifies each direct dependency's license into a family (permissive, weak copyleft, strong copyleft, unknown), and prints a JSON object with counts and a `flagged` list. ### 2. Save the artifact ```bash NANOSTACK_ROOT="${NANOSTACK_ROOT:-$HOME/.claude/skills/nanostack}" "$NANOSTACK_ROOT/bin/save-artifact.sh" license-audit \ '{"phase":"license-audit","summary":{"status":"OK","headline":"...","counts":{...},"flagged":[]},"context_check...