license-checklisted

Runs an end-to-end license-compliance check on the current project per spec/project/license-check/ and produce a license-check audit artifact. Dispatches license-check-scanner agent for the read-only inventory (SBOM with resolved licenses, SPDX identification, category classification), then applies the permissive-leaning allow/review/deny policy gate against the project's own outbound license, drives per-finding remediation (replace / exception with rationale / satisfy the obligation), verifies attribution/NOTICE and REUSE, records AI provenance, and writes the artifact under .audits/license-check/. Invoke when the user asks to "run a license check," "check license compliance," "audit licenses," "do a Lizenzcheck," "prüfe die Lizenzen," or for a pre-PR / pre-release license gate. Don't use for CVE / vulnerability scanning (that's dependency-audit) or for choosing the project's own outbound license. Supports resume on re-invocation per spec/claude/resumable-work/.
nolte/claude-shared · ★ 0 · AI & Automation · score 76

Install: claude install-skill nolte/claude-shared

# License Check Run the end-to-end license-compliance process on the current project and produce a single license-check audit artifact. This skill reports, gates, and (with confirmation) drives remediation; it never edits a `LICENSE`, allowlist, or dependency on its own. Implements `spec/project/license-check/` — the spec defines the pipeline, the SPDX anchoring, the license categories and their obligations, the compatibility rules, the default policy, and the AI-provenance requirements. This skill is the license-compliance **authority**; `dependency-audit`'s license pass implements this spec's policy for the dependency slice only. ## German trigger phrases This skill also triggers on equivalent German-language requests, including: - "Lizenzcheck durchführen" / "ausführlichen Lizenzcheck machen" - "Lizenz-Compliance prüfen" - "Lizenzen auditieren" ## User-language policy Detect the user's language from their message and respond in it. The audit artifact uses English section headings (so downstream tooling can parse it reliably); prose around it is localised. ## Inputs - **Repo root**: default is the current working directory. - **Outbound license**: read from the root `LICENSE`. This is the compatibility anchor; every conveyed dependency is checked against it. Stop and ask when no `LICENSE` exists rather than guessing. - **Policy**: the permissive-leaning default from `spec/project/license-check/` §Default policy, overridable only by a recorded, rationale-bearing rep