license-check

# Vulnetix License Check Skill ## Use when - Pre-release: confirm no copyleft contaminants in a permissive-licensed product. - Vetting a new dep's license before adoption. - Building an OSS attribution document (NOTICE file). - Producing a customer-facing license disclosure. - Quarterly compliance review with `--policy strict` to catch any non-allowlisted licenses. ## Don't use for - Vulnerability scanning — use `/vulnetix:sca-scan`. - License text retrieval — use the package manager directly (`npm view <pkg> license`). ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. ## Step 1: Run license analysis ```bash vulnetix license -o json-spdx > .vulnetix/licenses.${TIMESTAMP}.spdx.json ``` ## Step 2: Apply policy Default policy: - **permissive**: flag GPL-*, AGPL-*, LGPL-* against MIT/Apache-2.0/BSD codebase - **copyleft-aware**: flag AGPL-* and SSPL-1.0 - **strict**: flag any non-allowlisted license; allowlist = MIT, Apache-2.0, BSD-2/3-Clause, ISC, MPL-2.0 User can override via `--policy`. Accept user-supplied allowlist via `.vulnetix/license-policy.yaml` if present. ## S...