/licensing

name: memstack-business-licensing
description: "Use this skill when the user says 'licensing', 'license audit', 'can I use this commercially', 'OSS license check', 'license compatibility', 'GPL', 'MIT', 'AGPL', 'copyleft'. Scans the repository for every dependency and asset license, then produces a per-package verdict table: ready for commercial use, citation/attribution required, more information needed, or commercial use not allowed. Do NOT use for vulnerability scanning (use dependency-audit) or contract drafting (use contract-template)."
version: 1.0.0
license: "Proprietary, MemStack™ Pro by CW Affiliate Investments LLC. See LICENSE.txt"

Licensing: Commercial-use license audit from the repo...

*Scans a repository for every license that touches the product (deps, vendored code, fonts, assets), then produces a per-package verdict table marking each as Ready, Citation Required, Needs Info, or Not Allowed for commercial use.*

Activation

When this skill activates, output:

`Licensing, Commercial-use license audit from the repo...`

Then execute the protocol below.

Context Guard

| Context | Status | |---------|--------| | User says "license audit", "licensing", "license check" | ACTIVE | | User asks "can I use this commercially?" or "is this safe to ship?" | ACTIVE | | User mentions GPL, AGPL, LGPL, MPL, MIT, BSD, Apache, copyleft | ACTIVE | | User is preparing to ship, sell, or relicense a product | ACTIVE | | User wants security vulnerability scanning | DORMANT: use dependency-audit | | User wants a service contract or NDA | DORMANT: use contract-template |

Common Mistakes

| Mistake | Why It's Wrong | |---------|---------------| | "MIT and GPL are both open source so they're compatible" | Combining MIT into GPL is fine; the reverse forces your code under GPL. Direction matters. | | "We don't distribute, so AGPL doesn't apply" | AGPL §13 triggers on *network use*. SaaS counts. | | "It's on GitHub so it's free to use" | Public ≠ licensed. No LICENSE file = all rights reserved. | | "Transitive dependencies don't matter" | Your bundle ships every dep in the tree. Copyleft transitives can taint the whole product. | | "License from package.json metadata is authoritative" | The actual `LICENSE` file in upstream source is authoritative. Metadata is often wrong, missing, or outdated. | | "BSL / SSPL / Elastic / Commons Clause are open source" | They are not OSI-approved and usually restrict commercial hosting or competition. Read the actual terms. |

**Disclaimer:** Produces a license inventory and risk assessment, not legal advice. License interpretation (especially copyleft scope, "linking", and SaaS triggers) is contested. Engage IP counsel before shipping high-stakes products.

Protocol

Step 1: Confirm the distribution model

Just one question, the verdict logic depends on it:

> How is the product distributed? > - **A. SaaS / hosted** (users access over the network, no binary handed out) > - **B. Distributed binary** (desktop, mobile, on-prem install, downloadable executable) > - **C. Open-source library** you publish for others to consume > - **D. Internal only** (no users outside your organisation)

Default to A if the repo contains web framework code (Next.js, FastAPI, Rails, etc.) and no installer/build target.

Step 2: Scan the repo for every license source

Walk every manifest, lockfile, vendored directory, and asset folder. Never trust a single source: cross-check.

| Stack | Manifest | Discovery command | |-------|----------|-------------------| | Node.js | `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock` | `npm ls --all --json` then `npx license-checker --json --production` | | Python | `requirements*.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock` | `pip-licenses --format=json --with-license-file --with-urls` | | Rust | `Cargo.toml`, `Cargo.lock` | `cargo license --json` | | Go | `go.mod`, `go.sum` | `go-licenses report ./... --template '{{.Name}},{{.LicenseName}},{{.LicenseURL}}'` | | Java | `pom.xml`, `build.gradle` | `mvn license:add-third-party` or `gradle-license-report` | | Ruby | `Gemfile`, `Gemfile.lock` | `bundle exec license_finder report --format json` | | PHP | `composer.json`, `composer.lock` | `composer licenses --format=json` | | .NET | `*.csproj`, `packages.lock.json` | `dotnet list package --include-transitive` + `nuget-license` | | Container base images | `Dockerfile` | `syft <image> -o spdx-json` then read package licenses | | Vendored / submodules | `vendor/`, `third_party/`, `.gitmodules` | walk directories: look for `LICENSE`, `LICENSE.md`, `COPYING`, `NOTICE` | | Fonts / icons / media | `assets/`, `public/`, `static/` | check each asset's source license: **commonly missed** | | Snippets and copy-pasted code | comments, headers | `grep -rEin "Copyright|SPDX-License-Identifier"` |

For everything found, capture:

| Package | Version | Declared license (manifest) | License file present | Direct/transitive | Source URL |
|---------|---------|----------------------------|---------------------|-------------------|------------|
| react | 18.3.1 | MIT | Yes | direct | github.com/facebook/react |
| ... | ... | ... | ... | ... | ... |

Step 3: Resolve the actual license (don't trust metadata)

For every entry that is HIGH-impact (copyleft candidate, missing license, or version where licenses are known to change), open the upstream `LICENSE` file and confirm the SPDX identifier.

Watch for **license changes between versions**:

| Project | Version cut | Old → New | |---------|-------------|-----------| | Elasticsearch | 7.10 → 7.11 | Apache-2.0 → SSPL/Elastic | | Redis | 7.2 → 7.4 | BSD → SSPL/RSAL | | Terraform | 1.5 → 1.6 | MPL-2.0 → BSL | | MongoDB | 4.0 | AGPL → SSPL | | HashiCorp tools | 2023 | MPL-2.0 → BSL | | Sentry | 8.x | BSD → FSL |

Pin to the last compliant version or migrate.

Also check for:

• **Dual licensing** ("MIT OR Apache-2.0"), pick the option you'll comply with and r