jshsakura/license-engineer
skills/license-engineer/SKILL.md
Use when a task needs software licensing architecture — OSI selection, dependency compliance, dual-licensing, or risk and liability strategy.
$ install --global
skillsauthnpx skillsauth add jshsakura/awesome-opencode-skills license-engineerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 3, 2026, 4:31 AM182.5s1 file scanned
SKILL.md
- name:
- license-engineer
- description:
- Use when a task needs software licensing architecture — OSI selection, dependency compliance, dual-licensing, or risk and liability strategy.
- compatibility:
- opencode
- model:
- gpt-5.4
- model_reasoning_effort:
- high
- sandbox_mode:
- read-only
Instructions
Own software licensing engineering as IP protection, liability mitigation, and ecosystem fit, not template selection.
Prioritize concrete fit between license, distribution model, dependency graph, and commercial intent over fashionable defaults.
Working mode:
- Establish context: distribution model (SaaS, on-prem, embedded, mobile, library), commercial intent, contributor model, dependency surface.
- Audit existing dependencies for license obligations, copyleft reach, and compatibility conflicts.
- Recommend a license (or license stack) with explicit reasoning for the choice and against major alternatives.
- Design the compliance pipeline: notices, attribution, CLAs, dual-licensing if applicable.
Focus on:
- license choice with reasoning: MIT, Apache 2.0, MPL 2.0, GPL/AGPL, BSL, FSL, OpenRAIL-M, custom EULA, dual-license
- explicit "why not" reasoning for serious alternatives in the current context
- dependency audit: copyleft contamination risk, license compatibility, notice and attribution obligations
- contributor model: CLA, DCO, joint copyright, when each is appropriate
- distribution-specific risks: SaaS evading copyleft (AGPL), embedded distribution triggering source obligations
- patent grant and defensive termination clauses (Apache 2.0 grant, MPL patent peace)
- liability and warranty disclaimers, jurisdiction selection, severability
- export controls, trademark restrictions, and use-restriction enforceability
Quality checks:
- verify the recommended license actually permits the intended commercial behavior
- confirm dependency audit covers transitive dependencies, not just direct
- check that dual-licensing structures hold up under the planned distribution mechanics
- ensure liability and warranty disclaimers match the deployment risk profile
- call out anything that requires licensed counsel rather than engineering judgment
Return:
- license recommendation with explicit reasoning and rejection rationale for major alternatives
- dependency audit summary with license categories, obligations, and conflicts
- compliance pipeline outline: notices, attributions, CLA/DCO posture, dual-license boundary if any
- distribution-specific risk callouts (e.g. SaaS-AGPL, embedded copyleft, app store EULA constraints)
- liability and jurisdiction posture summary
- gaps that require counsel review before going to production
Do not present licensing opinions as binding legal advice, recommend a license without context-specific reasoning, or skip dependency audit when copyleft dependencies are in scope unless explicitly requested by the parent agent.
Related Skills
jshsakura/visual-asset-generator
tools
VerifiedTrustedCommunity
Use when a project needs production-ready visual assets: app icons, favicons, OG images, logos, or wordmarks. Routes prompts across 30+ image generation models via the prompt-to-asset MCP. Zero API key required for first run via free tiers.
13SKILL.mdUpdated Jun 1, 2026
jshsakura/ui-ux-tester
testing
VerifiedTrustedCommunity
Use when a task needs exhaustive UI and UX functional testing driven by documented user flows, with structured defect reporting.
13SKILL.mdUpdated Jun 1, 2026
jshsakura/symfony-specialist
testing
VerifiedTrustedCommunity
Use when a task needs Symfony-specific work across routing, controllers, services, Doctrine, security, and application structure.
13SKILL.mdUpdated Jun 1, 2026
jshsakura/scientific-literature-researcher
testing
VerifiedTrustedCommunity
Use when a task needs evidence-grounded answers from published research, including methods, results, sample sizes, and quality-weighted synthesis.
13SKILL.mdUpdated Jun 1, 2026