Vulnetix License Check Skill

Use when

• Pre-release: confirm no copyleft contaminants in a permissive-licensed product.
• Vetting a new dep's license before adoption.
• Building an OSS attribution document (NOTICE file).
• Producing a customer-facing license disclosure.
• Quarterly compliance review with --policy strict to catch any non-allowlisted licenses.

Don't use for

• Vulnerability scanning — use vulnetix scan --sca.
• License text retrieval — use the package manager directly (npm view <pkg> license).

Conventions

Follows skills/_lib/contract.md. In short: use the vulnetix_* MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes.

Step 1: Run license analysis

vulnetix license -o json-spdx > .vulnetix/licenses.${TIMESTAMP}.spdx.json

Step 2: Apply policy

Default policy:

• permissive: flag GPL-, AGPL-, LGPL-* against MIT/Apache-2.0/BSD codebase
• copyleft-aware: flag AGPL-* and SSPL-1.0
• strict: flag any non-allowlisted license; allowlist = MIT, Apache-2.0, BSD-2/3-Clause, ISC, MPL-2.0

User can override via --policy. Accept user-supplied allowlist via .vulnetix/license-policy.yaml if present.

Step 3: Render

| Package | Version | License | Policy verdict | Action |

Conflicts highlighted. Suggest replacement packages for blocked licenses (consult vulnetix vdb packages search <name> --license <permitted> if needed).

Step 4: Compliance bundle hint

If --bundle flag provided, also output the file path so the compliance-bundler agent can pick it up.

Memory update

.vulnetix/licenses/<timestamp>.summary.yaml with conflict counts.

Edge cases & gotchas

• --policy permissive flags GPL-* / AGPL-* / LGPL-* against an MIT/Apache codebase; --policy strict allowlists only MIT, Apache-2.0, BSD-2/3-Clause, ISC, MPL-2.0.
• Custom allowlist via .vulnetix/license-policy.yaml overrides the built-in policy.
• License detection uses package metadata; dual-licensed packages (MIT OR Apache-2.0) are reported as the FIRST license unless the policy file says otherwise.
• SPDX expression parsing handles common patterns (MIT, Apache-2.0, BSD-3-Clause) but not custom non-SPDX strings like "see LICENSE file" — those flag as "Unknown".
• Transitive deps are included by default; pass --direct-only to scope to top-level packages.
• License findings DO NOT include legal review — flag them for legal counsel, do not auto-approve based on the skill output.