[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-anthropic-oss-review":3,"mdc-kqdl9k-key":34,"related-repo-anthropic-oss-review":2345,"related-org-anthropic-oss-review":2443},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"oss-review","check open source license compliance","Open source license compliance check for a dependency list, a single library, or outbound code. Use when reviewing a manifest, SBOM, or repo for copyleft obligations and license compatibility, when asked whether a library can ship, or when preparing code to be open-sourced.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"anthropic","Anthropic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fanthropic.png","anthropics",[13,17,20],{"name":14,"slug":15,"type":16},"Compliance","compliance","tag",{"name":18,"slug":19,"type":16},"Legal","legal",{"name":21,"slug":22,"type":16},"Code Analysis","code-analysis",8721,"https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-for-legal","2026-05-14T06:00:49.217249",null,1642,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"A suite of plugins for legal workflows","https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-for-legal\u002Ftree\u002FHEAD\u002Fip-legal\u002Fskills\u002Foss-review","---\nname: oss-review\ndescription: >\n  Open source license compliance check for a dependency list, a single\n  library, or outbound code. Use when reviewing a manifest, SBOM, or repo for\n  copyleft obligations and license compatibility, when asked whether a library\n  can ship, or when preparing code to be open-sourced.\nargument-hint: \"[file path to manifest \u002F SBOM | package name | repo path | paste text]\"\n---\n\n# \u002Foss-review\n\nRuns an open source license compliance check against the practice profile in `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fip-legal\u002FCLAUDE.md`. Classifies dependencies by license family, maps obligations to the deployment model, flags license-unknown and non-OSI-posing-as-OSS packages, and recommends actions — comply, replace, remove, seek legal review, seek commercial license.\n\n## Instructions\n\n1. **Load `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fip-legal\u002FCLAUDE.md`.** If placeholders present, stop and prompt: \"Run `\u002Fip-legal:cold-start-interview` first — I need to learn your practice profile (and OSS policy, if any) before I can review.\" If the practice profile points at an uploaded OSS policy, read that too — it is the source of truth for accepted \u002F review \u002F banned licenses on this team.\n\n2. **Establish the scope:** a dependency list (package.json, requirements.txt, go.mod, Gemfile, Cargo.toml, pom.xml, SBOM), a single library, or outbound code the team is preparing to open-source. If the user passed a path, infer from the file; otherwise ask.\n\n3. **Establish the deployment model** before classifying obligations — SaaS, distributed binary, internal only, or embedded. The same dependency list triggers different obligations depending on this.\n\n4. **Follow the workflow below.** In particular:\n   - Read the actual license text, not just metadata — LICENSE files can be wrong, package metadata can be stale.\n   - Classify each package into permissive \u002F weak copyleft \u002F strong copyleft \u002F public domain \u002F non-OSI \u002F unknown.\n   - Flag license-unknown as \"needs review,\" not permissive by default.\n   - Flag non-OSI source-available licenses (SSPL, BUSL, Commons Clause, Elastic License, fair-source) — these are not open source.\n   - For outbound code, check that the chosen outbound license is compatible with every embedded dependency.\n\n5. **Output the memo** per the template below — work-product header first, bottom line, top-of-memo flags, per-package blocks grouped by severity, jurisdiction note, outbound check (if applicable), approval routing.\n\n6. **Respect the decision posture.** When a copyleft-trigger analysis turns on a contested question (AGPL's \"interacts over a network,\" GPL-3.0's \"conveying,\" LGPL linking scope), flag for attorney review and surface the factors cutting both ways. Anything flagged as strong copyleft or license-unknown goes to an attorney before the dependency ships or the code is released.\n\n## Examples\n\n```\n\u002Fip-legal:oss-review ~\u002Fcode\u002Fmy-project\u002Fpackage.json\n\u002Fip-legal:oss-review ~\u002Fcode\u002Fmy-project\u002Frequirements.txt\n\u002Fip-legal:oss-review redis\n\u002Fip-legal:oss-review ~\u002Fcode\u002Fmy-project  # repo root — scan all manifests\n```\n\n---\n\n## Works better connected\n\nOSS clearance requests usually come in via a ticketing system. Connected to\nJira, Linear, or Asana, this skill can: monitor incoming OSS requests, respond\nwith guidance directly in the ticket (flagging incomplete info, asking for the\nrepo link, returning the license-family classification), and track clearance\nstatus across requests.\n\nWithout a connector, paste the ticket or describe the request and I'll handle\nit one at a time. See `CONNECTORS.md` at the repo root for how to add a\nticketing connector.\n\n## Matter context\n\n**Matter context.** Check `## Matter workspaces` in the practice-level CLAUDE.md. If `Enabled` is `✗` (the default for in-house users), skip the rest of this paragraph — skills use practice-level context and the matter machinery is invisible. If enabled and there is no active matter, ask: \"Which matter is this for? Run `\u002Fip-legal:matter-workspace switch \u003Cslug>` or say `practice-level`.\" Load the active matter's `matter.md` for matter-specific context and overrides. Write outputs to the matter folder at `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fip-legal\u002Fmatters\u002F\u003Cmatter-slug>\u002F`. Never read another matter's files unless `Cross-matter context` is `on`.\n\n---\n\n## Purpose\n\nTell the user what licenses are in their dependency tree, what obligations those licenses trigger given how the code will be deployed, and what to do about each one. The output is a memo the lawyer (or the engineer with attorney access) can act on — comply, replace, remove, seek legal review, seek commercial license.\n\n**This is a first-pass classification.** Copyleft analysis depends on the deployment model, the degree of linking, the jurisdiction, and sometimes on legal questions that have not been tested in court (notably AGPL's \"interacts over a network,\" GPL-3.0's patent clause). For anything that classifies as strong copyleft or license-unknown, an attorney evaluates before the dependency ships or the code is released. The skill reports what it found; the lawyer decides what to do.\n\n## Precondition: load the practice profile\n\n**Before scanning dependencies, read `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fip-legal\u002FCLAUDE.md`.** If it is missing or still contains placeholders, stop and run `\u002Fip-legal:cold-start-interview`. The practice profile tells you:\n\n- Who owns OSS review on this team (often engineering with legal sign-off)\n- Escalation routing for copyleft obligations\n- The work-product header to prepend\n\nIf the practice profile has an OSS policy uploaded, read that too — it is the source of truth for which licenses the team accepts, which trigger review, and which are banned.\n\n## Workflow\n\n### Step 1: What's the scope?\n\nAsk (or infer from what the user provided):\n\n> What are we reviewing?\n>\n> 1. **A dependency list** — `package.json`, `requirements.txt`, `go.mod`, `Gemfile`, `Cargo.toml`, `pom.xml`, an SBOM (SPDX \u002F CycloneDX), a lockfile\n> 2. **A single library** — one specific package you're considering adding\n> 3. **Our own code** — we're planning to open-source this and need to check what's embedded\n\nThe analysis path differs:\n\n- Dependency list → classify every entry, roll up obligations\n- Single library → classify one package and walk its transitive dependencies if available\n- Outbound code → check what's embedded (direct and transitive), check whether chosen outbound license is compatible with all embedded licenses, check that LICENSE \u002F NOTICE files are correct\n\n### Step 2: What's the deployment model?\n\nThis is the single most important input after the license list — the same library carries different obligations depending on how the software is delivered. Ask:\n\n> How will this be deployed?\n>\n> 1. **SaaS \u002F hosted service** — users access over a network; nothing ships to the user\n> 2. **Distributed binary** — we ship compiled code to users (desktop app, mobile app, on-prem server, CLI tool)\n> 3. **Internal only** — used only inside the company, not distributed outside\n> 4. **Embedded \u002F firmware** — shipped in hardware or as closed-system firmware\n\n| Deployment | Licenses that materially matter |\n|---|---|\n| SaaS | AGPL (network-trigger), permissive attribution in any UI, SSPL\u002FBUSL\u002FElastic if repurposing as competing service |\n| Distributed binary | GPL, LGPL, MPL, EPL (all trigger on distribution), permissive attribution |\n| Internal only | Most copyleft does not trigger — no distribution. Permissive attribution still good hygiene. AGPL still triggers if users outside the company interact over the network. |\n| Embedded \u002F firmware | GPL is especially hard to comply with here (source disclosure + reproducible build + installation information in some cases). Plan for this before shipping, not after. |\n\nFlag the deployment model in the output memo — the same dependency list reviewed against \"SaaS\" vs. \"distributed binary\" yields different obligations.\n\n### Step 3: Classify each dependency\n\nFor every package, determine the license. Read the actual license text, not just the metadata — LICENSE files can be wrong (the file says MIT but the headers say GPL; the README claims Apache but there's no license file), and package manager metadata can be stale.\n\nClassify into:\n\n| Bucket | Examples | Key obligations |\n|---|---|---|\n| **Permissive** | MIT, BSD-2-Clause, BSD-3-Clause, Apache-2.0, ISC, Zlib, Unlicense | Attribution, preserve license text, Apache-2.0 adds patent grant + NOTICE requirement |\n| **Weak copyleft** | LGPL-2.1, LGPL-3.0, MPL-2.0, EPL-1.0, EPL-2.0, CDDL | File-level or library-level source disclosure; linking rules vary |\n| **Strong copyleft** | GPL-2.0, GPL-3.0, AGPL-3.0, OSL, EUPL (depending on version) | Broad source disclosure; AGPL extends to network use |\n| **Public domain \u002F dedication** | CC0, Unlicense, WTFPL | Typically no obligations, but some are contested in jurisdictions that don't recognize dedication to public domain |\n| **Non-OSI source-available** | SSPL, BUSL, Commons Clause, Elastic License, Confluent Community, fair-source family | Not open source — restrict commercial use, competing-service use, or both. Read the specific license. |\n| **Other \u002F custom \u002F unknown** | vendor-specific, proprietary, missing license file, license conflict between file and headers | Stop — do not treat as permissive by default |\n\nFlag:\n\n- **Dual-licensed packages** — which license are we using? The choice may change obligations.\n- **Deprecated packages** — the package is no longer maintained; is there a supported replacement?\n- **Packages with a copyleft dependency in their own tree** — the top-level license is permissive but a transitive dependency is copyleft.\n- **Packages that changed license recently** — Redis, MongoDB, Elastic, HashiCorp — make sure the version pinned is under the license you think it is.\n\n### Step 4: Map obligations to the deployment model\n\nFor each classified dependency, state what the deployment model triggers:\n\n```markdown\n### [package@version] — [License]\n\n**Classification:** [Permissive \u002F Weak copyleft \u002F Strong copyleft \u002F Public domain \u002F Non-OSI \u002F Unknown]\n\n**Obligations for our deployment ([SaaS \u002F binary \u002F internal \u002F embedded]):**\n\n- [ ] [Specific obligation — e.g., \"Include attribution in a NOTICES file shipped with the app\"]\n- [ ] [e.g., \"If we modify and distribute, publish source of our modifications\"]\n- [ ] [e.g., \"AGPL network trigger — if users access our modified version over a network, source must be offered to them\"]\n\n**Risk:** 🔴 Critical | 🟠 High | 🟡 Medium | 🟢 Low\n\n**Recommendation:** [Comply with obligations | Replace with [alternative] | Remove | Attorney review before shipping | Seek commercial license from [vendor]]\n```\n\n> **How is the copyleft dependency consumed?** The linking relationship determines whether copyleft actually triggers. Ask or determine:\n> - **Static linking \u002F compilation together:** The works are combined into one binary. Strong signal that copyleft triggers (LGPL \"work based on the Library,\" GPL derivative work).\n> - **Dynamic linking \u002F shared library:** The works remain separable at runtime. LGPL explicitly permits this (\"work that uses the Library\"). GPL's position is contested (FSF says derivative, others disagree).\n> - **Header inclusion \u002F inline functions:** Can create a derivative work depending on how much is included.\n> - **Subprocess \u002F IPC:** Separate processes communicating over well-defined interfaces. Generally not derivative.\n> - **Network API call:** For most licenses, no. For **AGPL**, the network-interaction clause means serving the software over a network IS distribution. In a microservices architecture, an AGPL component behind an API still triggers.\n> - **File-scope copyleft (MPL):** Only the modified files carry copyleft, not the whole work. Check whether any copyleft files were modified.\n>\n> **The severity rating depends on this.** \"LGPL — weak copyleft, linking rules vary\" without the linking analysis is the answer that gets an engineer sued. Static-linked LGPL in a proprietary product is 🔴 Critical. Dynamic-linked LGPL is 🟢 Low. Same license, opposite rating.\n\n**Severity calibration:**\n\n| Level | Means |\n|---|---|\n| 🔴 Critical | Strong copyleft in a deployment that triggers it (e.g., GPL in a distributed binary, AGPL in a SaaS). Non-OSI license that the business model actually conflicts with (e.g., SSPL while we're building a managed service). License cannot be determined and the package is load-bearing. |\n| 🟠 High | Weak copyleft with obligations the team hasn't set up for (file-level disclosure, NOTICE requirements). Dual-licensed where the chosen license is ambiguous. License file says one thing, headers say another. |\n| 🟡 Medium | Permissive with attribution requirements that haven't been wired into the build (missing NOTICES file, missing LICENSE in distribution). Transitive copyleft in a position that may or may not trigger, depending on how the library is consumed. |\n| 🟢 Low | Permissive with obligations already satisfied. Copyleft in a deployment model that doesn't trigger it (e.g., GPL library used internally only, with no redistribution). |\n\n### Step 5: Flag failure modes\n\nCall out any of the following in a top-of-memo section:\n\n- **License unknown** — classify as \"needs review,\" not permissive. An unclassified dependency should stop a ship decision, not slip through.\n- **License file conflicts with file headers** — read both and report the conflict.\n- **Incompatible combinations** — GPL-2.0 only + Apache-2.0 historically a known incompatibility; check MPL \u002F EPL \u002F GPL combinations carefully.\n- **Non-OSI licenses posing as open source** — SSPL, BUSL, Commons Clause, Elastic License, Confluent Community. Read the license; don't rely on GitHub's \"open source\" badge.\n- **License changes** — if a prior version was permissive and the current version is source-available, the pin matters.\n\n### Step 6: Outbound check (if reviewing our own code before open-sourcing)\n\nIf the user is preparing to open-source code:\n\n- Confirm the chosen outbound license is compatible with every embedded dependency's license (e.g., you cannot release under MIT if you've embedded GPL code — the combined work must be GPL)\n- Confirm LICENSE file is present and correct\n- Confirm NOTICE file is present and lists required attributions (Apache-2.0 and others)\n- Confirm third-party license texts are bundled where required\n- Confirm no proprietary or confidential code, no customer data, no embedded credentials in the repo history\n- Confirm trademark and brand policy for any project name (separate from the copyright license)\n\n### Step 7: Assemble the memo\n\nPrepend the work-product header from `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fip-legal\u002FCLAUDE.md` → `## Outputs` (differs by user role — see `## Who's using this`).\n\nThis memo and any dependency list reviewed may be privileged, confidential, or both. The output inherits that status from the source. Distribute only within the privilege circle; strip the work-product header before any external delivery (including before attaching the memo to an engineering ticket outside the privilege circle).\n\n> **No silent supplement.** If a research query to the configured legal research tool returns few or no results for a rule the memo needs (enforceability of AGPL's network trigger in a given jurisdiction, scope of GPL-3.0's patent grant, latest license text for a recently-relicensed package), report what was found and stop. Do NOT fill the gap from web search or model knowledge without asking. Say: \"The search returned [N] results from [tool]. Coverage appears thin for [rule \u002F license \u002F jurisdiction]. Options: (1) broaden the search query, (2) try a different research tool, (3) search the web — results will be tagged `[web search — verify]` and should be checked against a primary source before relying, or (4) flag as unverified and stop. Which would you like?\" A lawyer decides whether to accept lower-confidence sources.\n>\n> **Source attribution.** Where the memo cites a license text, a court decision interpreting a license, or guidance from a steward (FSF, OSI, SPDX, SFLC), tag the citation: `[OSI]`, `[SPDX]`, `[FSF]`, `[SFC\u002FSFLC]`, `[Westlaw]`, or the MCP tool name for citations retrieved from a connector; `[web search — verify]` for web-search citations; `[model knowledge — verify]` for citations recalled from training data; `[user provided]` for license text read directly from the repo. Citations tagged `verify` carry higher fabrication risk. Never strip or collapse the tags.\n\n```markdown\n[WORK-PRODUCT HEADER — per plugin config ## Outputs]\n\n# OSS Review: [Project \u002F Dependency List \u002F Package]\n\n**Reviewed:** [date]\n**Scope:** [Dependency list \u002F Single library \u002F Outbound code]\n**Deployment model:** [SaaS \u002F Binary \u002F Internal \u002F Embedded]\n\n---\n\n## Bottom line\n\n[Two sentences. Can this ship? What has to happen first?]\n\n**Packages reviewed:** [N]\n**By classification:** [N permissive, N weak copyleft, N strong copyleft, N public domain, N non-OSI, N unknown]\n**Issues:** [N]🔴 [N]🟠 [N]🟡 [N]🟢\n\n**Approval needed from:** [name, per practice profile]\n\n---\n\n## Top-of-memo flags\n\n[License-unknown list, license-conflict list, non-OSI-posing-as-OSS list, incompatible combinations]\n\n---\n\n## By package\n\n[Blocks from Step 4, grouped by severity]\n\n---\n\n## Jurisdiction note\n\nOSS license enforceability varies — AGPL's network trigger has not been broadly tested in court; GPL-3.0's patent clause reads differently under US vs. EU patent law; dedications to public domain are not universally recognized. State the governing-law choice for any downstream distribution (e.g., vendor agreements incorporating the code) and flag jurisdictions the practice profile marks as escalate.\n\n---\n\n## Outbound check (if applicable)\n\n[From Step 6]\n\n---\n\n## Approval routing\n\n[From practice profile — who approves, what triggers automatic escalation]\n```\n\n## Decision posture\n\nWhen a license cannot be confidently classified, flag it as **\"needs review\"** — do not call it permissive. Under-classifying license risk is a one-way door: a ship decision made on a permissive-by-default assumption becomes a source-disclosure obligation or an injunction months later. Over-flagging is a two-way door — the attorney narrows the list in review.\n\nLikewise, when the copyleft-trigger analysis turns on a contested question (AGPL's \"interacts over a network,\" GPL-3.0's \"conveying,\" the scope of LGPL linking), flag for attorney review and surface the factors cutting both ways.\n\n## Quality checks before delivering\n\n- [ ] Practice profile and any OSS policy were loaded\n- [ ] Deployment model was established before classifying obligations\n- [ ] Every dependency has a classification, including transitives where available\n- [ ] License-unknown packages are flagged, not defaulted to permissive\n- [ ] License text was read (not just metadata) for any copyleft or non-OSI finding\n- [ ] Source tags applied to citations; no stripped `verify` tags\n- [ ] Approver named per practice profile\n- [ ] Output marked with the work-product header\n\n## Close with the next-steps decision tree\n\nEnd with the next-steps decision tree per CLAUDE.md `## Outputs`. Customize the options to what this skill just produced — the five default branches (draft the X, escalate, get more facts, watch and wait, something else) are a starting point, not a lock-in. The tree is the output; the lawyer picks.\n\nIf the scan surfaced more than ~10 packages, or any time the user asks: offer the dashboard (see CLAUDE.md `## Outputs → Dashboard offer for data-heavy outputs`). Shape the offer to what's useful here — counts by license family (permissive \u002F weak copyleft \u002F strong copyleft \u002F AGPL \u002F proprietary \u002F unknown), risk distribution, and a table of findings with severity and package version.\n\n",{"data":35,"body":37},{"name":4,"description":6,"argument-hint":36},"[file path to manifest \u002F SBOM | package name | repo path | paste text]",{"type":38,"children":39},"root",[40,48,63,70,180,186,198,202,208,213,226,232,312,315,321,326,336,342,365,383,388,394,401,406,492,497,515,521,526,577,654,659,665,670,675,827,832,875,881,886,1143,1236,1244,1318,1324,1329,1382,1388,1393,1426,1432,1460,1465,1584,2192,2198,2210,2215,2221,2308,2314,2326,2339],{"type":41,"tag":42,"props":43,"children":44},"element","h1",{"id":4},[45],{"type":46,"value":47},"text","\u002Foss-review",{"type":41,"tag":49,"props":50,"children":51},"p",{},[52,54,61],{"type":46,"value":53},"Runs an open source license compliance check against the practice profile in ",{"type":41,"tag":55,"props":56,"children":58},"code",{"className":57},[],[59],{"type":46,"value":60},"~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fip-legal\u002FCLAUDE.md",{"type":46,"value":62},". Classifies dependencies by license family, maps obligations to the deployment model, flags license-unknown and non-OSI-posing-as-OSS packages, and recommends actions — comply, replace, remove, seek legal review, seek commercial license.",{"type":41,"tag":64,"props":65,"children":67},"h2",{"id":66},"instructions",[68],{"type":46,"value":69},"Instructions",{"type":41,"tag":71,"props":72,"children":73},"ol",{},[74,101,111,121,160,170],{"type":41,"tag":75,"props":76,"children":77},"li",{},[78,91,93,99],{"type":41,"tag":79,"props":80,"children":81},"strong",{},[82,84,89],{"type":46,"value":83},"Load ",{"type":41,"tag":55,"props":85,"children":87},{"className":86},[],[88],{"type":46,"value":60},{"type":46,"value":90},".",{"type":46,"value":92}," If placeholders present, stop and prompt: \"Run ",{"type":41,"tag":55,"props":94,"children":96},{"className":95},[],[97],{"type":46,"value":98},"\u002Fip-legal:cold-start-interview",{"type":46,"value":100}," first — I need to learn your practice profile (and OSS policy, if any) before I can review.\" If the practice profile points at an uploaded OSS policy, read that too — it is the source of truth for accepted \u002F review \u002F banned licenses on this team.",{"type":41,"tag":75,"props":102,"children":103},{},[104,109],{"type":41,"tag":79,"props":105,"children":106},{},[107],{"type":46,"value":108},"Establish the scope:",{"type":46,"value":110}," a dependency list (package.json, requirements.txt, go.mod, Gemfile, Cargo.toml, pom.xml, SBOM), a single library, or outbound code the team is preparing to open-source. If the user passed a path, infer from the file; otherwise ask.",{"type":41,"tag":75,"props":112,"children":113},{},[114,119],{"type":41,"tag":79,"props":115,"children":116},{},[117],{"type":46,"value":118},"Establish the deployment model",{"type":46,"value":120}," before classifying obligations — SaaS, distributed binary, internal only, or embedded. The same dependency list triggers different obligations depending on this.",{"type":41,"tag":75,"props":122,"children":123},{},[124,129,131],{"type":41,"tag":79,"props":125,"children":126},{},[127],{"type":46,"value":128},"Follow the workflow below.",{"type":46,"value":130}," In particular:",{"type":41,"tag":132,"props":133,"children":134},"ul",{},[135,140,145,150,155],{"type":41,"tag":75,"props":136,"children":137},{},[138],{"type":46,"value":139},"Read the actual license text, not just metadata — LICENSE files can be wrong, package metadata can be stale.",{"type":41,"tag":75,"props":141,"children":142},{},[143],{"type":46,"value":144},"Classify each package into permissive \u002F weak copyleft \u002F strong copyleft \u002F public domain \u002F non-OSI \u002F unknown.",{"type":41,"tag":75,"props":146,"children":147},{},[148],{"type":46,"value":149},"Flag license-unknown as \"needs review,\" not permissive by default.",{"type":41,"tag":75,"props":151,"children":152},{},[153],{"type":46,"value":154},"Flag non-OSI source-available licenses (SSPL, BUSL, Commons Clause, Elastic License, fair-source) — these are not open source.",{"type":41,"tag":75,"props":156,"children":157},{},[158],{"type":46,"value":159},"For outbound code, check that the chosen outbound license is compatible with every embedded dependency.",{"type":41,"tag":75,"props":161,"children":162},{},[163,168],{"type":41,"tag":79,"props":164,"children":165},{},[166],{"type":46,"value":167},"Output the memo",{"type":46,"value":169}," per the template below — work-product header first, bottom line, top-of-memo flags, per-package blocks grouped by severity, jurisdiction note, outbound check (if applicable), approval routing.",{"type":41,"tag":75,"props":171,"children":172},{},[173,178],{"type":41,"tag":79,"props":174,"children":175},{},[176],{"type":46,"value":177},"Respect the decision posture.",{"type":46,"value":179}," When a copyleft-trigger analysis turns on a contested question (AGPL's \"interacts over a network,\" GPL-3.0's \"conveying,\" LGPL linking scope), flag for attorney review and surface the factors cutting both ways. Anything flagged as strong copyleft or license-unknown goes to an attorney before the dependency ships or the code is released.",{"type":41,"tag":64,"props":181,"children":183},{"id":182},"examples",[184],{"type":46,"value":185},"Examples",{"type":41,"tag":187,"props":188,"children":192},"pre",{"className":189,"code":191,"language":46},[190],"language-text","\u002Fip-legal:oss-review ~\u002Fcode\u002Fmy-project\u002Fpackage.json\n\u002Fip-legal:oss-review ~\u002Fcode\u002Fmy-project\u002Frequirements.txt\n\u002Fip-legal:oss-review redis\n\u002Fip-legal:oss-review ~\u002Fcode\u002Fmy-project  # repo root — scan all manifests\n",[193],{"type":41,"tag":55,"props":194,"children":196},{"__ignoreMap":195},"",[197],{"type":46,"value":191},{"type":41,"tag":199,"props":200,"children":201},"hr",{},[],{"type":41,"tag":64,"props":203,"children":205},{"id":204},"works-better-connected",[206],{"type":46,"value":207},"Works better connected",{"type":41,"tag":49,"props":209,"children":210},{},[211],{"type":46,"value":212},"OSS clearance requests usually come in via a ticketing system. Connected to\nJira, Linear, or Asana, this skill can: monitor incoming OSS requests, respond\nwith guidance directly in the ticket (flagging incomplete info, asking for the\nrepo link, returning the license-family classification), and track clearance\nstatus across requests.",{"type":41,"tag":49,"props":214,"children":215},{},[216,218,224],{"type":46,"value":217},"Without a connector, paste the ticket or describe the request and I'll handle\nit one at a time. See ",{"type":41,"tag":55,"props":219,"children":221},{"className":220},[],[222],{"type":46,"value":223},"CONNECTORS.md",{"type":46,"value":225}," at the repo root for how to add a\nticketing connector.",{"type":41,"tag":64,"props":227,"children":229},{"id":228},"matter-context",[230],{"type":46,"value":231},"Matter context",{"type":41,"tag":49,"props":233,"children":234},{},[235,240,242,248,250,256,258,264,266,272,274,280,282,288,290,296,298,304,305,311],{"type":41,"tag":79,"props":236,"children":237},{},[238],{"type":46,"value":239},"Matter context.",{"type":46,"value":241}," Check ",{"type":41,"tag":55,"props":243,"children":245},{"className":244},[],[246],{"type":46,"value":247},"## Matter workspaces",{"type":46,"value":249}," in the practice-level CLAUDE.md. If ",{"type":41,"tag":55,"props":251,"children":253},{"className":252},[],[254],{"type":46,"value":255},"Enabled",{"type":46,"value":257}," is ",{"type":41,"tag":55,"props":259,"children":261},{"className":260},[],[262],{"type":46,"value":263},"✗",{"type":46,"value":265}," (the default for in-house users), skip the rest of this paragraph — skills use practice-level context and the matter machinery is invisible. If enabled and there is no active matter, ask: \"Which matter is this for? Run ",{"type":41,"tag":55,"props":267,"children":269},{"className":268},[],[270],{"type":46,"value":271},"\u002Fip-legal:matter-workspace switch \u003Cslug>",{"type":46,"value":273}," or say ",{"type":41,"tag":55,"props":275,"children":277},{"className":276},[],[278],{"type":46,"value":279},"practice-level",{"type":46,"value":281},".\" Load the active matter's ",{"type":41,"tag":55,"props":283,"children":285},{"className":284},[],[286],{"type":46,"value":287},"matter.md",{"type":46,"value":289}," for matter-specific context and overrides. Write outputs to the matter folder at ",{"type":41,"tag":55,"props":291,"children":293},{"className":292},[],[294],{"type":46,"value":295},"~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fip-legal\u002Fmatters\u002F\u003Cmatter-slug>\u002F",{"type":46,"value":297},". Never read another matter's files unless ",{"type":41,"tag":55,"props":299,"children":301},{"className":300},[],[302],{"type":46,"value":303},"Cross-matter context",{"type":46,"value":257},{"type":41,"tag":55,"props":306,"children":308},{"className":307},[],[309],{"type":46,"value":310},"on",{"type":46,"value":90},{"type":41,"tag":199,"props":313,"children":314},{},[],{"type":41,"tag":64,"props":316,"children":318},{"id":317},"purpose",[319],{"type":46,"value":320},"Purpose",{"type":41,"tag":49,"props":322,"children":323},{},[324],{"type":46,"value":325},"Tell the user what licenses are in their dependency tree, what obligations those licenses trigger given how the code will be deployed, and what to do about each one. The output is a memo the lawyer (or the engineer with attorney access) can act on — comply, replace, remove, seek legal review, seek commercial license.",{"type":41,"tag":49,"props":327,"children":328},{},[329,334],{"type":41,"tag":79,"props":330,"children":331},{},[332],{"type":46,"value":333},"This is a first-pass classification.",{"type":46,"value":335}," Copyleft analysis depends on the deployment model, the degree of linking, the jurisdiction, and sometimes on legal questions that have not been tested in court (notably AGPL's \"interacts over a network,\" GPL-3.0's patent clause). For anything that classifies as strong copyleft or license-unknown, an attorney evaluates before the dependency ships or the code is released. The skill reports what it found; the lawyer decides what to do.",{"type":41,"tag":64,"props":337,"children":339},{"id":338},"precondition-load-the-practice-profile",[340],{"type":46,"value":341},"Precondition: load the practice profile",{"type":41,"tag":49,"props":343,"children":344},{},[345,356,358,363],{"type":41,"tag":79,"props":346,"children":347},{},[348,350,355],{"type":46,"value":349},"Before scanning dependencies, read ",{"type":41,"tag":55,"props":351,"children":353},{"className":352},[],[354],{"type":46,"value":60},{"type":46,"value":90},{"type":46,"value":357}," If it is missing or still contains placeholders, stop and run ",{"type":41,"tag":55,"props":359,"children":361},{"className":360},[],[362],{"type":46,"value":98},{"type":46,"value":364},". The practice profile tells you:",{"type":41,"tag":132,"props":366,"children":367},{},[368,373,378],{"type":41,"tag":75,"props":369,"children":370},{},[371],{"type":46,"value":372},"Who owns OSS review on this team (often engineering with legal sign-off)",{"type":41,"tag":75,"props":374,"children":375},{},[376],{"type":46,"value":377},"Escalation routing for copyleft obligations",{"type":41,"tag":75,"props":379,"children":380},{},[381],{"type":46,"value":382},"The work-product header to prepend",{"type":41,"tag":49,"props":384,"children":385},{},[386],{"type":46,"value":387},"If the practice profile has an OSS policy uploaded, read that too — it is the source of truth for which licenses the team accepts, which trigger review, and which are banned.",{"type":41,"tag":64,"props":389,"children":391},{"id":390},"workflow",[392],{"type":46,"value":393},"Workflow",{"type":41,"tag":395,"props":396,"children":398},"h3",{"id":397},"step-1-whats-the-scope",[399],{"type":46,"value":400},"Step 1: What's the scope?",{"type":41,"tag":49,"props":402,"children":403},{},[404],{"type":46,"value":405},"Ask (or infer from what the user provided):",{"type":41,"tag":407,"props":408,"children":409},"blockquote",{},[410,415],{"type":41,"tag":49,"props":411,"children":412},{},[413],{"type":46,"value":414},"What are we reviewing?",{"type":41,"tag":71,"props":416,"children":417},{},[418,472,482],{"type":41,"tag":75,"props":419,"children":420},{},[421,426,428,434,436,442,443,449,450,456,457,463,464,470],{"type":41,"tag":79,"props":422,"children":423},{},[424],{"type":46,"value":425},"A dependency list",{"type":46,"value":427}," — ",{"type":41,"tag":55,"props":429,"children":431},{"className":430},[],[432],{"type":46,"value":433},"package.json",{"type":46,"value":435},", ",{"type":41,"tag":55,"props":437,"children":439},{"className":438},[],[440],{"type":46,"value":441},"requirements.txt",{"type":46,"value":435},{"type":41,"tag":55,"props":444,"children":446},{"className":445},[],[447],{"type":46,"value":448},"go.mod",{"type":46,"value":435},{"type":41,"tag":55,"props":451,"children":453},{"className":452},[],[454],{"type":46,"value":455},"Gemfile",{"type":46,"value":435},{"type":41,"tag":55,"props":458,"children":460},{"className":459},[],[461],{"type":46,"value":462},"Cargo.toml",{"type":46,"value":435},{"type":41,"tag":55,"props":465,"children":467},{"className":466},[],[468],{"type":46,"value":469},"pom.xml",{"type":46,"value":471},", an SBOM (SPDX \u002F CycloneDX), a lockfile",{"type":41,"tag":75,"props":473,"children":474},{},[475,480],{"type":41,"tag":79,"props":476,"children":477},{},[478],{"type":46,"value":479},"A single library",{"type":46,"value":481}," — one specific package you're considering adding",{"type":41,"tag":75,"props":483,"children":484},{},[485,490],{"type":41,"tag":79,"props":486,"children":487},{},[488],{"type":46,"value":489},"Our own code",{"type":46,"value":491}," — we're planning to open-source this and need to check what's embedded",{"type":41,"tag":49,"props":493,"children":494},{},[495],{"type":46,"value":496},"The analysis path differs:",{"type":41,"tag":132,"props":498,"children":499},{},[500,505,510],{"type":41,"tag":75,"props":501,"children":502},{},[503],{"type":46,"value":504},"Dependency list → classify every entry, roll up obligations",{"type":41,"tag":75,"props":506,"children":507},{},[508],{"type":46,"value":509},"Single library → classify one package and walk its transitive dependencies if available",{"type":41,"tag":75,"props":511,"children":512},{},[513],{"type":46,"value":514},"Outbound code → check what's embedded (direct and transitive), check whether chosen outbound license is compatible with all embedded licenses, check that LICENSE \u002F NOTICE files are correct",{"type":41,"tag":395,"props":516,"children":518},{"id":517},"step-2-whats-the-deployment-model",[519],{"type":46,"value":520},"Step 2: What's the deployment model?",{"type":41,"tag":49,"props":522,"children":523},{},[524],{"type":46,"value":525},"This is the single most important input after the license list — the same library carries different obligations depending on how the software is delivered. Ask:",{"type":41,"tag":407,"props":527,"children":528},{},[529,534],{"type":41,"tag":49,"props":530,"children":531},{},[532],{"type":46,"value":533},"How will this be deployed?",{"type":41,"tag":71,"props":535,"children":536},{},[537,547,557,567],{"type":41,"tag":75,"props":538,"children":539},{},[540,545],{"type":41,"tag":79,"props":541,"children":542},{},[543],{"type":46,"value":544},"SaaS \u002F hosted service",{"type":46,"value":546}," — users access over a network; nothing ships to the user",{"type":41,"tag":75,"props":548,"children":549},{},[550,555],{"type":41,"tag":79,"props":551,"children":552},{},[553],{"type":46,"value":554},"Distributed binary",{"type":46,"value":556}," — we ship compiled code to users (desktop app, mobile app, on-prem server, CLI tool)",{"type":41,"tag":75,"props":558,"children":559},{},[560,565],{"type":41,"tag":79,"props":561,"children":562},{},[563],{"type":46,"value":564},"Internal only",{"type":46,"value":566}," — used only inside the company, not distributed outside",{"type":41,"tag":75,"props":568,"children":569},{},[570,575],{"type":41,"tag":79,"props":571,"children":572},{},[573],{"type":46,"value":574},"Embedded \u002F firmware",{"type":46,"value":576}," — shipped in hardware or as closed-system firmware",{"type":41,"tag":578,"props":579,"children":580},"table",{},[581,600],{"type":41,"tag":582,"props":583,"children":584},"thead",{},[585],{"type":41,"tag":586,"props":587,"children":588},"tr",{},[589,595],{"type":41,"tag":590,"props":591,"children":592},"th",{},[593],{"type":46,"value":594},"Deployment",{"type":41,"tag":590,"props":596,"children":597},{},[598],{"type":46,"value":599},"Licenses that materially matter",{"type":41,"tag":601,"props":602,"children":603},"tbody",{},[604,618,630,642],{"type":41,"tag":586,"props":605,"children":606},{},[607,613],{"type":41,"tag":608,"props":609,"children":610},"td",{},[611],{"type":46,"value":612},"SaaS",{"type":41,"tag":608,"props":614,"children":615},{},[616],{"type":46,"value":617},"AGPL (network-trigger), permissive attribution in any UI, SSPL\u002FBUSL\u002FElastic if repurposing as competing service",{"type":41,"tag":586,"props":619,"children":620},{},[621,625],{"type":41,"tag":608,"props":622,"children":623},{},[624],{"type":46,"value":554},{"type":41,"tag":608,"props":626,"children":627},{},[628],{"type":46,"value":629},"GPL, LGPL, MPL, EPL (all trigger on distribution), permissive attribution",{"type":41,"tag":586,"props":631,"children":632},{},[633,637],{"type":41,"tag":608,"props":634,"children":635},{},[636],{"type":46,"value":564},{"type":41,"tag":608,"props":638,"children":639},{},[640],{"type":46,"value":641},"Most copyleft does not trigger — no distribution. Permissive attribution still good hygiene. AGPL still triggers if users outside the company interact over the network.",{"type":41,"tag":586,"props":643,"children":644},{},[645,649],{"type":41,"tag":608,"props":646,"children":647},{},[648],{"type":46,"value":574},{"type":41,"tag":608,"props":650,"children":651},{},[652],{"type":46,"value":653},"GPL is especially hard to comply with here (source disclosure + reproducible build + installation information in some cases). Plan for this before shipping, not after.",{"type":41,"tag":49,"props":655,"children":656},{},[657],{"type":46,"value":658},"Flag the deployment model in the output memo — the same dependency list reviewed against \"SaaS\" vs. \"distributed binary\" yields different obligations.",{"type":41,"tag":395,"props":660,"children":662},{"id":661},"step-3-classify-each-dependency",[663],{"type":46,"value":664},"Step 3: Classify each dependency",{"type":41,"tag":49,"props":666,"children":667},{},[668],{"type":46,"value":669},"For every package, determine the license. Read the actual license text, not just the metadata — LICENSE files can be wrong (the file says MIT but the headers say GPL; the README claims Apache but there's no license file), and package manager metadata can be stale.",{"type":41,"tag":49,"props":671,"children":672},{},[673],{"type":46,"value":674},"Classify into:",{"type":41,"tag":578,"props":676,"children":677},{},[678,698],{"type":41,"tag":582,"props":679,"children":680},{},[681],{"type":41,"tag":586,"props":682,"children":683},{},[684,689,693],{"type":41,"tag":590,"props":685,"children":686},{},[687],{"type":46,"value":688},"Bucket",{"type":41,"tag":590,"props":690,"children":691},{},[692],{"type":46,"value":185},{"type":41,"tag":590,"props":694,"children":695},{},[696],{"type":46,"value":697},"Key obligations",{"type":41,"tag":601,"props":699,"children":700},{},[701,722,743,764,785,806],{"type":41,"tag":586,"props":702,"children":703},{},[704,712,717],{"type":41,"tag":608,"props":705,"children":706},{},[707],{"type":41,"tag":79,"props":708,"children":709},{},[710],{"type":46,"value":711},"Permissive",{"type":41,"tag":608,"props":713,"children":714},{},[715],{"type":46,"value":716},"MIT, BSD-2-Clause, BSD-3-Clause, Apache-2.0, ISC, Zlib, Unlicense",{"type":41,"tag":608,"props":718,"children":719},{},[720],{"type":46,"value":721},"Attribution, preserve license text, Apache-2.0 adds patent grant + NOTICE requirement",{"type":41,"tag":586,"props":723,"children":724},{},[725,733,738],{"type":41,"tag":608,"props":726,"children":727},{},[728],{"type":41,"tag":79,"props":729,"children":730},{},[731],{"type":46,"value":732},"Weak copyleft",{"type":41,"tag":608,"props":734,"children":735},{},[736],{"type":46,"value":737},"LGPL-2.1, LGPL-3.0, MPL-2.0, EPL-1.0, EPL-2.0, CDDL",{"type":41,"tag":608,"props":739,"children":740},{},[741],{"type":46,"value":742},"File-level or library-level source disclosure; linking rules vary",{"type":41,"tag":586,"props":744,"children":745},{},[746,754,759],{"type":41,"tag":608,"props":747,"children":748},{},[749],{"type":41,"tag":79,"props":750,"children":751},{},[752],{"type":46,"value":753},"Strong copyleft",{"type":41,"tag":608,"props":755,"children":756},{},[757],{"type":46,"value":758},"GPL-2.0, GPL-3.0, AGPL-3.0, OSL, EUPL (depending on version)",{"type":41,"tag":608,"props":760,"children":761},{},[762],{"type":46,"value":763},"Broad source disclosure; AGPL extends to network use",{"type":41,"tag":586,"props":765,"children":766},{},[767,775,780],{"type":41,"tag":608,"props":768,"children":769},{},[770],{"type":41,"tag":79,"props":771,"children":772},{},[773],{"type":46,"value":774},"Public domain \u002F dedication",{"type":41,"tag":608,"props":776,"children":777},{},[778],{"type":46,"value":779},"CC0, Unlicense, WTFPL",{"type":41,"tag":608,"props":781,"children":782},{},[783],{"type":46,"value":784},"Typically no obligations, but some are contested in jurisdictions that don't recognize dedication to public domain",{"type":41,"tag":586,"props":786,"children":787},{},[788,796,801],{"type":41,"tag":608,"props":789,"children":790},{},[791],{"type":41,"tag":79,"props":792,"children":793},{},[794],{"type":46,"value":795},"Non-OSI source-available",{"type":41,"tag":608,"props":797,"children":798},{},[799],{"type":46,"value":800},"SSPL, BUSL, Commons Clause, Elastic License, Confluent Community, fair-source family",{"type":41,"tag":608,"props":802,"children":803},{},[804],{"type":46,"value":805},"Not open source — restrict commercial use, competing-service use, or both. Read the specific license.",{"type":41,"tag":586,"props":807,"children":808},{},[809,817,822],{"type":41,"tag":608,"props":810,"children":811},{},[812],{"type":41,"tag":79,"props":813,"children":814},{},[815],{"type":46,"value":816},"Other \u002F custom \u002F unknown",{"type":41,"tag":608,"props":818,"children":819},{},[820],{"type":46,"value":821},"vendor-specific, proprietary, missing license file, license conflict between file and headers",{"type":41,"tag":608,"props":823,"children":824},{},[825],{"type":46,"value":826},"Stop — do not treat as permissive by default",{"type":41,"tag":49,"props":828,"children":829},{},[830],{"type":46,"value":831},"Flag:",{"type":41,"tag":132,"props":833,"children":834},{},[835,845,855,865],{"type":41,"tag":75,"props":836,"children":837},{},[838,843],{"type":41,"tag":79,"props":839,"children":840},{},[841],{"type":46,"value":842},"Dual-licensed packages",{"type":46,"value":844}," — which license are we using? The choice may change obligations.",{"type":41,"tag":75,"props":846,"children":847},{},[848,853],{"type":41,"tag":79,"props":849,"children":850},{},[851],{"type":46,"value":852},"Deprecated packages",{"type":46,"value":854}," — the package is no longer maintained; is there a supported replacement?",{"type":41,"tag":75,"props":856,"children":857},{},[858,863],{"type":41,"tag":79,"props":859,"children":860},{},[861],{"type":46,"value":862},"Packages with a copyleft dependency in their own tree",{"type":46,"value":864}," — the top-level license is permissive but a transitive dependency is copyleft.",{"type":41,"tag":75,"props":866,"children":867},{},[868,873],{"type":41,"tag":79,"props":869,"children":870},{},[871],{"type":46,"value":872},"Packages that changed license recently",{"type":46,"value":874}," — Redis, MongoDB, Elastic, HashiCorp — make sure the version pinned is under the license you think it is.",{"type":41,"tag":395,"props":876,"children":878},{"id":877},"step-4-map-obligations-to-the-deployment-model",[879],{"type":46,"value":880},"Step 4: Map obligations to the deployment model",{"type":41,"tag":49,"props":882,"children":883},{},[884],{"type":46,"value":885},"For each classified dependency, state what the deployment model triggers:",{"type":41,"tag":187,"props":887,"children":891},{"className":888,"code":889,"language":890,"meta":195,"style":195},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","### [package@version] — [License]\n\n**Classification:** [Permissive \u002F Weak copyleft \u002F Strong copyleft \u002F Public domain \u002F Non-OSI \u002F Unknown]\n\n**Obligations for our deployment ([SaaS \u002F binary \u002F internal \u002F embedded]):**\n\n- [ ] [Specific obligation — e.g., \"Include attribution in a NOTICES file shipped with the app\"]\n- [ ] [e.g., \"If we modify and distribute, publish source of our modifications\"]\n- [ ] [e.g., \"AGPL network trigger — if users access our modified version over a network, source must be offered to them\"]\n\n**Risk:** 🔴 Critical | 🟠 High | 🟡 Medium | 🟢 Low\n\n**Recommendation:** [Comply with obligations | Replace with [alternative] | Remove | Attorney review before shipping | Seek commercial license from [vendor]]\n","markdown",[892],{"type":41,"tag":55,"props":893,"children":894},{"__ignoreMap":195},[895,938,948,974,982,1000,1008,1022,1035,1048,1056,1078,1086],{"type":41,"tag":896,"props":897,"children":900},"span",{"class":898,"line":899},"line",1,[901,907,913,918,923,928,933],{"type":41,"tag":896,"props":902,"children":904},{"style":903},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[905],{"type":46,"value":906},"### [",{"type":41,"tag":896,"props":908,"children":910},{"style":909},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[911],{"type":46,"value":912},"package@version",{"type":41,"tag":896,"props":914,"children":915},{"style":903},[916],{"type":46,"value":917},"]",{"type":41,"tag":896,"props":919,"children":921},{"style":920},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[922],{"type":46,"value":427},{"type":41,"tag":896,"props":924,"children":925},{"style":903},[926],{"type":46,"value":927},"[",{"type":41,"tag":896,"props":929,"children":930},{"style":909},[931],{"type":46,"value":932},"License",{"type":41,"tag":896,"props":934,"children":935},{"style":903},[936],{"type":46,"value":937},"]\n",{"type":41,"tag":896,"props":939,"children":941},{"class":898,"line":940},2,[942],{"type":41,"tag":896,"props":943,"children":945},{"emptyLinePlaceholder":944},true,[946],{"type":46,"value":947},"\n",{"type":41,"tag":896,"props":949,"children":951},{"class":898,"line":950},3,[952,958,964,968],{"type":41,"tag":896,"props":953,"children":955},{"style":954},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[956],{"type":46,"value":957},"**",{"type":41,"tag":896,"props":959,"children":961},{"style":960},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[962],{"type":46,"value":963},"Classification:",{"type":41,"tag":896,"props":965,"children":966},{"style":954},[967],{"type":46,"value":957},{"type":41,"tag":896,"props":969,"children":971},{"style":970},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[972],{"type":46,"value":973}," [Permissive \u002F Weak copyleft \u002F Strong copyleft \u002F Public domain \u002F Non-OSI \u002F Unknown]\n",{"type":41,"tag":896,"props":975,"children":977},{"class":898,"line":976},4,[978],{"type":41,"tag":896,"props":979,"children":980},{"emptyLinePlaceholder":944},[981],{"type":46,"value":947},{"type":41,"tag":896,"props":983,"children":985},{"class":898,"line":984},5,[986,990,995],{"type":41,"tag":896,"props":987,"children":988},{"style":954},[989],{"type":46,"value":957},{"type":41,"tag":896,"props":991,"children":992},{"style":960},[993],{"type":46,"value":994},"Obligations for our deployment ([SaaS \u002F binary \u002F internal \u002F embedded]):",{"type":41,"tag":896,"props":996,"children":997},{"style":954},[998],{"type":46,"value":999},"**\n",{"type":41,"tag":896,"props":1001,"children":1003},{"class":898,"line":1002},6,[1004],{"type":41,"tag":896,"props":1005,"children":1006},{"emptyLinePlaceholder":944},[1007],{"type":46,"value":947},{"type":41,"tag":896,"props":1009,"children":1011},{"class":898,"line":1010},7,[1012,1017],{"type":41,"tag":896,"props":1013,"children":1014},{"style":903},[1015],{"type":46,"value":1016},"-",{"type":41,"tag":896,"props":1018,"children":1019},{"style":970},[1020],{"type":46,"value":1021}," [ ] [Specific obligation — e.g., \"Include attribution in a NOTICES file shipped with the app\"]\n",{"type":41,"tag":896,"props":1023,"children":1025},{"class":898,"line":1024},8,[1026,1030],{"type":41,"tag":896,"props":1027,"children":1028},{"style":903},[1029],{"type":46,"value":1016},{"type":41,"tag":896,"props":1031,"children":1032},{"style":970},[1033],{"type":46,"value":1034}," [ ] [e.g., \"If we modify and distribute, publish source of our modifications\"]\n",{"type":41,"tag":896,"props":1036,"children":1038},{"class":898,"line":1037},9,[1039,1043],{"type":41,"tag":896,"props":1040,"children":1041},{"style":903},[1042],{"type":46,"value":1016},{"type":41,"tag":896,"props":1044,"children":1045},{"style":970},[1046],{"type":46,"value":1047}," [ ] [e.g., \"AGPL network trigger — if users access our modified version over a network, source must be offered to them\"]\n",{"type":41,"tag":896,"props":1049,"children":1051},{"class":898,"line":1050},10,[1052],{"type":41,"tag":896,"props":1053,"children":1054},{"emptyLinePlaceholder":944},[1055],{"type":46,"value":947},{"type":41,"tag":896,"props":1057,"children":1059},{"class":898,"line":1058},11,[1060,1064,1069,1073],{"type":41,"tag":896,"props":1061,"children":1062},{"style":954},[1063],{"type":46,"value":957},{"type":41,"tag":896,"props":1065,"children":1066},{"style":960},[1067],{"type":46,"value":1068},"Risk:",{"type":41,"tag":896,"props":1070,"children":1071},{"style":954},[1072],{"type":46,"value":957},{"type":41,"tag":896,"props":1074,"children":1075},{"style":970},[1076],{"type":46,"value":1077}," 🔴 Critical | 🟠 High | 🟡 Medium | 🟢 Low\n",{"type":41,"tag":896,"props":1079,"children":1081},{"class":898,"line":1080},12,[1082],{"type":41,"tag":896,"props":1083,"children":1084},{"emptyLinePlaceholder":944},[1085],{"type":46,"value":947},{"type":41,"tag":896,"props":1087,"children":1089},{"class":898,"line":1088},13,[1090,1094,1099,1103,1108,1112,1117,1121,1126,1130,1135,1139],{"type":41,"tag":896,"props":1091,"children":1092},{"style":954},[1093],{"type":46,"value":957},{"type":41,"tag":896,"props":1095,"children":1096},{"style":960},[1097],{"type":46,"value":1098},"Recommendation:",{"type":41,"tag":896,"props":1100,"children":1101},{"style":954},[1102],{"type":46,"value":957},{"type":41,"tag":896,"props":1104,"children":1105},{"style":970},[1106],{"type":46,"value":1107}," [Comply with obligations | Replace with ",{"type":41,"tag":896,"props":1109,"children":1110},{"style":903},[1111],{"type":46,"value":927},{"type":41,"tag":896,"props":1113,"children":1114},{"style":909},[1115],{"type":46,"value":1116},"alternative",{"type":41,"tag":896,"props":1118,"children":1119},{"style":903},[1120],{"type":46,"value":917},{"type":41,"tag":896,"props":1122,"children":1123},{"style":970},[1124],{"type":46,"value":1125}," | Remove | Attorney review before shipping | Seek commercial license from ",{"type":41,"tag":896,"props":1127,"children":1128},{"style":903},[1129],{"type":46,"value":927},{"type":41,"tag":896,"props":1131,"children":1132},{"style":909},[1133],{"type":46,"value":1134},"vendor",{"type":41,"tag":896,"props":1136,"children":1137},{"style":903},[1138],{"type":46,"value":917},{"type":41,"tag":896,"props":1140,"children":1141},{"style":970},[1142],{"type":46,"value":937},{"type":41,"tag":407,"props":1144,"children":1145},{},[1146,1156,1226],{"type":41,"tag":49,"props":1147,"children":1148},{},[1149,1154],{"type":41,"tag":79,"props":1150,"children":1151},{},[1152],{"type":46,"value":1153},"How is the copyleft dependency consumed?",{"type":46,"value":1155}," The linking relationship determines whether copyleft actually triggers. Ask or determine:",{"type":41,"tag":132,"props":1157,"children":1158},{},[1159,1169,1179,1189,1199,1216],{"type":41,"tag":75,"props":1160,"children":1161},{},[1162,1167],{"type":41,"tag":79,"props":1163,"children":1164},{},[1165],{"type":46,"value":1166},"Static linking \u002F compilation together:",{"type":46,"value":1168}," The works are combined into one binary. Strong signal that copyleft triggers (LGPL \"work based on the Library,\" GPL derivative work).",{"type":41,"tag":75,"props":1170,"children":1171},{},[1172,1177],{"type":41,"tag":79,"props":1173,"children":1174},{},[1175],{"type":46,"value":1176},"Dynamic linking \u002F shared library:",{"type":46,"value":1178}," The works remain separable at runtime. LGPL explicitly permits this (\"work that uses the Library\"). GPL's position is contested (FSF says derivative, others disagree).",{"type":41,"tag":75,"props":1180,"children":1181},{},[1182,1187],{"type":41,"tag":79,"props":1183,"children":1184},{},[1185],{"type":46,"value":1186},"Header inclusion \u002F inline functions:",{"type":46,"value":1188}," Can create a derivative work depending on how much is included.",{"type":41,"tag":75,"props":1190,"children":1191},{},[1192,1197],{"type":41,"tag":79,"props":1193,"children":1194},{},[1195],{"type":46,"value":1196},"Subprocess \u002F IPC:",{"type":46,"value":1198}," Separate processes communicating over well-defined interfaces. Generally not derivative.",{"type":41,"tag":75,"props":1200,"children":1201},{},[1202,1207,1209,1214],{"type":41,"tag":79,"props":1203,"children":1204},{},[1205],{"type":46,"value":1206},"Network API call:",{"type":46,"value":1208}," For most licenses, no. For ",{"type":41,"tag":79,"props":1210,"children":1211},{},[1212],{"type":46,"value":1213},"AGPL",{"type":46,"value":1215},", the network-interaction clause means serving the software over a network IS distribution. In a microservices architecture, an AGPL component behind an API still triggers.",{"type":41,"tag":75,"props":1217,"children":1218},{},[1219,1224],{"type":41,"tag":79,"props":1220,"children":1221},{},[1222],{"type":46,"value":1223},"File-scope copyleft (MPL):",{"type":46,"value":1225}," Only the modified files carry copyleft, not the whole work. Check whether any copyleft files were modified.",{"type":41,"tag":49,"props":1227,"children":1228},{},[1229,1234],{"type":41,"tag":79,"props":1230,"children":1231},{},[1232],{"type":46,"value":1233},"The severity rating depends on this.",{"type":46,"value":1235}," \"LGPL — weak copyleft, linking rules vary\" without the linking analysis is the answer that gets an engineer sued. Static-linked LGPL in a proprietary product is 🔴 Critical. Dynamic-linked LGPL is 🟢 Low. Same license, opposite rating.",{"type":41,"tag":49,"props":1237,"children":1238},{},[1239],{"type":41,"tag":79,"props":1240,"children":1241},{},[1242],{"type":46,"value":1243},"Severity calibration:",{"type":41,"tag":578,"props":1245,"children":1246},{},[1247,1263],{"type":41,"tag":582,"props":1248,"children":1249},{},[1250],{"type":41,"tag":586,"props":1251,"children":1252},{},[1253,1258],{"type":41,"tag":590,"props":1254,"children":1255},{},[1256],{"type":46,"value":1257},"Level",{"type":41,"tag":590,"props":1259,"children":1260},{},[1261],{"type":46,"value":1262},"Means",{"type":41,"tag":601,"props":1264,"children":1265},{},[1266,1279,1292,1305],{"type":41,"tag":586,"props":1267,"children":1268},{},[1269,1274],{"type":41,"tag":608,"props":1270,"children":1271},{},[1272],{"type":46,"value":1273},"🔴 Critical",{"type":41,"tag":608,"props":1275,"children":1276},{},[1277],{"type":46,"value":1278},"Strong copyleft in a deployment that triggers it (e.g., GPL in a distributed binary, AGPL in a SaaS). Non-OSI license that the business model actually conflicts with (e.g., SSPL while we're building a managed service). License cannot be determined and the package is load-bearing.",{"type":41,"tag":586,"props":1280,"children":1281},{},[1282,1287],{"type":41,"tag":608,"props":1283,"children":1284},{},[1285],{"type":46,"value":1286},"🟠 High",{"type":41,"tag":608,"props":1288,"children":1289},{},[1290],{"type":46,"value":1291},"Weak copyleft with obligations the team hasn't set up for (file-level disclosure, NOTICE requirements). Dual-licensed where the chosen license is ambiguous. License file says one thing, headers say another.",{"type":41,"tag":586,"props":1293,"children":1294},{},[1295,1300],{"type":41,"tag":608,"props":1296,"children":1297},{},[1298],{"type":46,"value":1299},"🟡 Medium",{"type":41,"tag":608,"props":1301,"children":1302},{},[1303],{"type":46,"value":1304},"Permissive with attribution requirements that haven't been wired into the build (missing NOTICES file, missing LICENSE in distribution). Transitive copyleft in a position that may or may not trigger, depending on how the library is consumed.",{"type":41,"tag":586,"props":1306,"children":1307},{},[1308,1313],{"type":41,"tag":608,"props":1309,"children":1310},{},[1311],{"type":46,"value":1312},"🟢 Low",{"type":41,"tag":608,"props":1314,"children":1315},{},[1316],{"type":46,"value":1317},"Permissive with obligations already satisfied. Copyleft in a deployment model that doesn't trigger it (e.g., GPL library used internally only, with no redistribution).",{"type":41,"tag":395,"props":1319,"children":1321},{"id":1320},"step-5-flag-failure-modes",[1322],{"type":46,"value":1323},"Step 5: Flag failure modes",{"type":41,"tag":49,"props":1325,"children":1326},{},[1327],{"type":46,"value":1328},"Call out any of the following in a top-of-memo section:",{"type":41,"tag":132,"props":1330,"children":1331},{},[1332,1342,1352,1362,1372],{"type":41,"tag":75,"props":1333,"children":1334},{},[1335,1340],{"type":41,"tag":79,"props":1336,"children":1337},{},[1338],{"type":46,"value":1339},"License unknown",{"type":46,"value":1341}," — classify as \"needs review,\" not permissive. An unclassified dependency should stop a ship decision, not slip through.",{"type":41,"tag":75,"props":1343,"children":1344},{},[1345,1350],{"type":41,"tag":79,"props":1346,"children":1347},{},[1348],{"type":46,"value":1349},"License file conflicts with file headers",{"type":46,"value":1351}," — read both and report the conflict.",{"type":41,"tag":75,"props":1353,"children":1354},{},[1355,1360],{"type":41,"tag":79,"props":1356,"children":1357},{},[1358],{"type":46,"value":1359},"Incompatible combinations",{"type":46,"value":1361}," — GPL-2.0 only + Apache-2.0 historically a known incompatibility; check MPL \u002F EPL \u002F GPL combinations carefully.",{"type":41,"tag":75,"props":1363,"children":1364},{},[1365,1370],{"type":41,"tag":79,"props":1366,"children":1367},{},[1368],{"type":46,"value":1369},"Non-OSI licenses posing as open source",{"type":46,"value":1371}," — SSPL, BUSL, Commons Clause, Elastic License, Confluent Community. Read the license; don't rely on GitHub's \"open source\" badge.",{"type":41,"tag":75,"props":1373,"children":1374},{},[1375,1380],{"type":41,"tag":79,"props":1376,"children":1377},{},[1378],{"type":46,"value":1379},"License changes",{"type":46,"value":1381}," — if a prior version was permissive and the current version is source-available, the pin matters.",{"type":41,"tag":395,"props":1383,"children":1385},{"id":1384},"step-6-outbound-check-if-reviewing-our-own-code-before-open-sourcing",[1386],{"type":46,"value":1387},"Step 6: Outbound check (if reviewing our own code before open-sourcing)",{"type":41,"tag":49,"props":1389,"children":1390},{},[1391],{"type":46,"value":1392},"If the user is preparing to open-source code:",{"type":41,"tag":132,"props":1394,"children":1395},{},[1396,1401,1406,1411,1416,1421],{"type":41,"tag":75,"props":1397,"children":1398},{},[1399],{"type":46,"value":1400},"Confirm the chosen outbound license is compatible with every embedded dependency's license (e.g., you cannot release under MIT if you've embedded GPL code — the combined work must be GPL)",{"type":41,"tag":75,"props":1402,"children":1403},{},[1404],{"type":46,"value":1405},"Confirm LICENSE file is present and correct",{"type":41,"tag":75,"props":1407,"children":1408},{},[1409],{"type":46,"value":1410},"Confirm NOTICE file is present and lists required attributions (Apache-2.0 and others)",{"type":41,"tag":75,"props":1412,"children":1413},{},[1414],{"type":46,"value":1415},"Confirm third-party license texts are bundled where required",{"type":41,"tag":75,"props":1417,"children":1418},{},[1419],{"type":46,"value":1420},"Confirm no proprietary or confidential code, no customer data, no embedded credentials in the repo history",{"type":41,"tag":75,"props":1422,"children":1423},{},[1424],{"type":46,"value":1425},"Confirm trademark and brand policy for any project name (separate from the copyright license)",{"type":41,"tag":395,"props":1427,"children":1429},{"id":1428},"step-7-assemble-the-memo",[1430],{"type":46,"value":1431},"Step 7: Assemble the memo",{"type":41,"tag":49,"props":1433,"children":1434},{},[1435,1437,1442,1444,1450,1452,1458],{"type":46,"value":1436},"Prepend the work-product header from ",{"type":41,"tag":55,"props":1438,"children":1440},{"className":1439},[],[1441],{"type":46,"value":60},{"type":46,"value":1443}," → ",{"type":41,"tag":55,"props":1445,"children":1447},{"className":1446},[],[1448],{"type":46,"value":1449},"## Outputs",{"type":46,"value":1451}," (differs by user role — see ",{"type":41,"tag":55,"props":1453,"children":1455},{"className":1454},[],[1456],{"type":46,"value":1457},"## Who's using this",{"type":46,"value":1459},").",{"type":41,"tag":49,"props":1461,"children":1462},{},[1463],{"type":46,"value":1464},"This memo and any dependency list reviewed may be privileged, confidential, or both. The output inherits that status from the source. Distribute only within the privilege circle; strip the work-product header before any external delivery (including before attaching the memo to an engineering ticket outside the privilege circle).",{"type":41,"tag":407,"props":1466,"children":1467},{},[1468,1507],{"type":41,"tag":49,"props":1469,"children":1470},{},[1471,1476,1478,1483,1485,1490,1492,1497,1499,1505],{"type":41,"tag":79,"props":1472,"children":1473},{},[1474],{"type":46,"value":1475},"No silent supplement.",{"type":46,"value":1477}," If a research query to the configured legal research tool returns few or no results for a rule the memo needs (enforceability of AGPL's network trigger in a given jurisdiction, scope of GPL-3.0's patent grant, latest license text for a recently-relicensed package), report what was found and stop. Do NOT fill the gap from web search or model knowledge without asking. Say: \"The search returned ",{"type":41,"tag":896,"props":1479,"children":1480},{},[1481],{"type":46,"value":1482},"N",{"type":46,"value":1484}," results from ",{"type":41,"tag":896,"props":1486,"children":1487},{},[1488],{"type":46,"value":1489},"tool",{"type":46,"value":1491},". Coverage appears thin for ",{"type":41,"tag":896,"props":1493,"children":1494},{},[1495],{"type":46,"value":1496},"rule \u002F license \u002F jurisdiction",{"type":46,"value":1498},". Options: (1) broaden the search query, (2) try a different research tool, (3) search the web — results will be tagged ",{"type":41,"tag":55,"props":1500,"children":1502},{"className":1501},[],[1503],{"type":46,"value":1504},"[web search — verify]",{"type":46,"value":1506}," and should be checked against a primary source before relying, or (4) flag as unverified and stop. Which would you like?\" A lawyer decides whether to accept lower-confidence sources.",{"type":41,"tag":49,"props":1508,"children":1509},{},[1510,1515,1517,1523,1524,1530,1531,1537,1538,1544,1545,1551,1553,1558,1560,1566,1568,1574,1576,1582],{"type":41,"tag":79,"props":1511,"children":1512},{},[1513],{"type":46,"value":1514},"Source attribution.",{"type":46,"value":1516}," Where the memo cites a license text, a court decision interpreting a license, or guidance from a steward (FSF, OSI, SPDX, SFLC), tag the citation: ",{"type":41,"tag":55,"props":1518,"children":1520},{"className":1519},[],[1521],{"type":46,"value":1522},"[OSI]",{"type":46,"value":435},{"type":41,"tag":55,"props":1525,"children":1527},{"className":1526},[],[1528],{"type":46,"value":1529},"[SPDX]",{"type":46,"value":435},{"type":41,"tag":55,"props":1532,"children":1534},{"className":1533},[],[1535],{"type":46,"value":1536},"[FSF]",{"type":46,"value":435},{"type":41,"tag":55,"props":1539,"children":1541},{"className":1540},[],[1542],{"type":46,"value":1543},"[SFC\u002FSFLC]",{"type":46,"value":435},{"type":41,"tag":55,"props":1546,"children":1548},{"className":1547},[],[1549],{"type":46,"value":1550},"[Westlaw]",{"type":46,"value":1552},", or the MCP tool name for citations retrieved from a connector; ",{"type":41,"tag":55,"props":1554,"children":1556},{"className":1555},[],[1557],{"type":46,"value":1504},{"type":46,"value":1559}," for web-search citations; ",{"type":41,"tag":55,"props":1561,"children":1563},{"className":1562},[],[1564],{"type":46,"value":1565},"[model knowledge — verify]",{"type":46,"value":1567}," for citations recalled from training data; ",{"type":41,"tag":55,"props":1569,"children":1571},{"className":1570},[],[1572],{"type":46,"value":1573},"[user provided]",{"type":46,"value":1575}," for license text read directly from the repo. Citations tagged ",{"type":41,"tag":55,"props":1577,"children":1579},{"className":1578},[],[1580],{"type":46,"value":1581},"verify",{"type":46,"value":1583}," carry higher fabrication risk. Never strip or collapse the tags.",{"type":41,"tag":187,"props":1585,"children":1587},{"className":888,"code":1586,"language":890,"meta":195,"style":195},"[WORK-PRODUCT HEADER — per plugin config ## Outputs]\n\n# OSS Review: [Project \u002F Dependency List \u002F Package]\n\n**Reviewed:** [date]\n**Scope:** [Dependency list \u002F Single library \u002F Outbound code]\n**Deployment model:** [SaaS \u002F Binary \u002F Internal \u002F Embedded]\n\n---\n\n## Bottom line\n\n[Two sentences. Can this ship? What has to happen first?]\n\n**Packages reviewed:** [N]\n**By classification:** [N permissive, N weak copyleft, N strong copyleft, N public domain, N non-OSI, N unknown]\n**Issues:** [N]🔴 [N]🟠 [N]🟡 [N]🟢\n\n**Approval needed from:** [name, per practice profile]\n\n---\n\n## Top-of-memo flags\n\n[License-unknown list, license-conflict list, non-OSI-posing-as-OSS list, incompatible combinations]\n\n---\n\n## By package\n\n[Blocks from Step 4, grouped by severity]\n\n---\n\n## Jurisdiction note\n\nOSS license enforceability varies — AGPL's network trigger has not been broadly tested in court; GPL-3.0's patent clause reads differently under US vs. EU patent law; dedications to public domain are not universally recognized. State the governing-law choice for any downstream distribution (e.g., vendor agreements incorporating the code) and flag jurisdictions the practice profile marks as escalate.\n\n---\n\n## Outbound check (if applicable)\n\n[From Step 6]\n\n---\n\n## Approval routing\n\n[From practice profile — who approves, what triggers automatic escalation]\n",[1588],{"type":41,"tag":55,"props":1589,"children":1590},{"__ignoreMap":195},[1591,1599,1606,1619,1626,1656,1677,1698,1705,1713,1720,1733,1740,1748,1756,1785,1807,1892,1900,1922,1930,1938,1946,1959,1967,1976,1984,1992,2000,2013,2021,2030,2038,2046,2054,2067,2075,2084,2092,2100,2108,2121,2129,2138,2146,2154,2162,2175,2183],{"type":41,"tag":896,"props":1592,"children":1593},{"class":898,"line":899},[1594],{"type":41,"tag":896,"props":1595,"children":1596},{"style":970},[1597],{"type":46,"value":1598},"[WORK-PRODUCT HEADER — per plugin config ## Outputs]\n",{"type":41,"tag":896,"props":1600,"children":1601},{"class":898,"line":940},[1602],{"type":41,"tag":896,"props":1603,"children":1604},{"emptyLinePlaceholder":944},[1605],{"type":46,"value":947},{"type":41,"tag":896,"props":1607,"children":1608},{"class":898,"line":950},[1609,1614],{"type":41,"tag":896,"props":1610,"children":1611},{"style":903},[1612],{"type":46,"value":1613},"# ",{"type":41,"tag":896,"props":1615,"children":1616},{"style":920},[1617],{"type":46,"value":1618},"OSS Review: [Project \u002F Dependency List \u002F Package]\n",{"type":41,"tag":896,"props":1620,"children":1621},{"class":898,"line":976},[1622],{"type":41,"tag":896,"props":1623,"children":1624},{"emptyLinePlaceholder":944},[1625],{"type":46,"value":947},{"type":41,"tag":896,"props":1627,"children":1628},{"class":898,"line":984},[1629,1633,1638,1642,1647,1652],{"type":41,"tag":896,"props":1630,"children":1631},{"style":954},[1632],{"type":46,"value":957},{"type":41,"tag":896,"props":1634,"children":1635},{"style":960},[1636],{"type":46,"value":1637},"Reviewed:",{"type":41,"tag":896,"props":1639,"children":1640},{"style":954},[1641],{"type":46,"value":957},{"type":41,"tag":896,"props":1643,"children":1644},{"style":903},[1645],{"type":46,"value":1646}," [",{"type":41,"tag":896,"props":1648,"children":1649},{"style":909},[1650],{"type":46,"value":1651},"date",{"type":41,"tag":896,"props":1653,"children":1654},{"style":903},[1655],{"type":46,"value":937},{"type":41,"tag":896,"props":1657,"children":1658},{"class":898,"line":1002},[1659,1663,1668,1672],{"type":41,"tag":896,"props":1660,"children":1661},{"style":954},[1662],{"type":46,"value":957},{"type":41,"tag":896,"props":1664,"children":1665},{"style":960},[1666],{"type":46,"value":1667},"Scope:",{"type":41,"tag":896,"props":1669,"children":1670},{"style":954},[1671],{"type":46,"value":957},{"type":41,"tag":896,"props":1673,"children":1674},{"style":970},[1675],{"type":46,"value":1676}," [Dependency list \u002F Single library \u002F Outbound code]\n",{"type":41,"tag":896,"props":1678,"children":1679},{"class":898,"line":1010},[1680,1684,1689,1693],{"type":41,"tag":896,"props":1681,"children":1682},{"style":954},[1683],{"type":46,"value":957},{"type":41,"tag":896,"props":1685,"children":1686},{"style":960},[1687],{"type":46,"value":1688},"Deployment model:",{"type":41,"tag":896,"props":1690,"children":1691},{"style":954},[1692],{"type":46,"value":957},{"type":41,"tag":896,"props":1694,"children":1695},{"style":970},[1696],{"type":46,"value":1697}," [SaaS \u002F Binary \u002F Internal \u002F Embedded]\n",{"type":41,"tag":896,"props":1699,"children":1700},{"class":898,"line":1024},[1701],{"type":41,"tag":896,"props":1702,"children":1703},{"emptyLinePlaceholder":944},[1704],{"type":46,"value":947},{"type":41,"tag":896,"props":1706,"children":1707},{"class":898,"line":1037},[1708],{"type":41,"tag":896,"props":1709,"children":1710},{"style":903},[1711],{"type":46,"value":1712},"---\n",{"type":41,"tag":896,"props":1714,"children":1715},{"class":898,"line":1050},[1716],{"type":41,"tag":896,"props":1717,"children":1718},{"emptyLinePlaceholder":944},[1719],{"type":46,"value":947},{"type":41,"tag":896,"props":1721,"children":1722},{"class":898,"line":1058},[1723,1728],{"type":41,"tag":896,"props":1724,"children":1725},{"style":903},[1726],{"type":46,"value":1727},"## ",{"type":41,"tag":896,"props":1729,"children":1730},{"style":920},[1731],{"type":46,"value":1732},"Bottom line\n",{"type":41,"tag":896,"props":1734,"children":1735},{"class":898,"line":1080},[1736],{"type":41,"tag":896,"props":1737,"children":1738},{"emptyLinePlaceholder":944},[1739],{"type":46,"value":947},{"type":41,"tag":896,"props":1741,"children":1742},{"class":898,"line":1088},[1743],{"type":41,"tag":896,"props":1744,"children":1745},{"style":970},[1746],{"type":46,"value":1747},"[Two sentences. Can this ship? What has to happen first?]\n",{"type":41,"tag":896,"props":1749,"children":1751},{"class":898,"line":1750},14,[1752],{"type":41,"tag":896,"props":1753,"children":1754},{"emptyLinePlaceholder":944},[1755],{"type":46,"value":947},{"type":41,"tag":896,"props":1757,"children":1759},{"class":898,"line":1758},15,[1760,1764,1769,1773,1777,1781],{"type":41,"tag":896,"props":1761,"children":1762},{"style":954},[1763],{"type":46,"value":957},{"type":41,"tag":896,"props":1765,"children":1766},{"style":960},[1767],{"type":46,"value":1768},"Packages reviewed:",{"type":41,"tag":896,"props":1770,"children":1771},{"style":954},[1772],{"type":46,"value":957},{"type":41,"tag":896,"props":1774,"children":1775},{"style":903},[1776],{"type":46,"value":1646},{"type":41,"tag":896,"props":1778,"children":1779},{"style":909},[1780],{"type":46,"value":1482},{"type":41,"tag":896,"props":1782,"children":1783},{"style":903},[1784],{"type":46,"value":937},{"type":41,"tag":896,"props":1786,"children":1788},{"class":898,"line":1787},16,[1789,1793,1798,1802],{"type":41,"tag":896,"props":1790,"children":1791},{"style":954},[1792],{"type":46,"value":957},{"type":41,"tag":896,"props":1794,"children":1795},{"style":960},[1796],{"type":46,"value":1797},"By classification:",{"type":41,"tag":896,"props":1799,"children":1800},{"style":954},[1801],{"type":46,"value":957},{"type":41,"tag":896,"props":1803,"children":1804},{"style":970},[1805],{"type":46,"value":1806}," [N permissive, N weak copyleft, N strong copyleft, N public domain, N non-OSI, N unknown]\n",{"type":41,"tag":896,"props":1808,"children":1810},{"class":898,"line":1809},17,[1811,1815,1820,1824,1828,1832,1836,1841,1845,1849,1853,1858,1862,1866,1870,1875,1879,1883,1887],{"type":41,"tag":896,"props":1812,"children":1813},{"style":954},[1814],{"type":46,"value":957},{"type":41,"tag":896,"props":1816,"children":1817},{"style":960},[1818],{"type":46,"value":1819},"Issues:",{"type":41,"tag":896,"props":1821,"children":1822},{"style":954},[1823],{"type":46,"value":957},{"type":41,"tag":896,"props":1825,"children":1826},{"style":903},[1827],{"type":46,"value":1646},{"type":41,"tag":896,"props":1829,"children":1830},{"style":909},[1831],{"type":46,"value":1482},{"type":41,"tag":896,"props":1833,"children":1834},{"style":903},[1835],{"type":46,"value":917},{"type":41,"tag":896,"props":1837,"children":1838},{"style":970},[1839],{"type":46,"value":1840},"🔴 ",{"type":41,"tag":896,"props":1842,"children":1843},{"style":903},[1844],{"type":46,"value":927},{"type":41,"tag":896,"props":1846,"children":1847},{"style":909},[1848],{"type":46,"value":1482},{"type":41,"tag":896,"props":1850,"children":1851},{"style":903},[1852],{"type":46,"value":917},{"type":41,"tag":896,"props":1854,"children":1855},{"style":970},[1856],{"type":46,"value":1857},"🟠 ",{"type":41,"tag":896,"props":1859,"children":1860},{"style":903},[1861],{"type":46,"value":927},{"type":41,"tag":896,"props":1863,"children":1864},{"style":909},[1865],{"type":46,"value":1482},{"type":41,"tag":896,"props":1867,"children":1868},{"style":903},[1869],{"type":46,"value":917},{"type":41,"tag":896,"props":1871,"children":1872},{"style":970},[1873],{"type":46,"value":1874},"🟡 ",{"type":41,"tag":896,"props":1876,"children":1877},{"style":903},[1878],{"type":46,"value":927},{"type":41,"tag":896,"props":1880,"children":1881},{"style":909},[1882],{"type":46,"value":1482},{"type":41,"tag":896,"props":1884,"children":1885},{"style":903},[1886],{"type":46,"value":917},{"type":41,"tag":896,"props":1888,"children":1889},{"style":970},[1890],{"type":46,"value":1891},"🟢\n",{"type":41,"tag":896,"props":1893,"children":1895},{"class":898,"line":1894},18,[1896],{"type":41,"tag":896,"props":1897,"children":1898},{"emptyLinePlaceholder":944},[1899],{"type":46,"value":947},{"type":41,"tag":896,"props":1901,"children":1903},{"class":898,"line":1902},19,[1904,1908,1913,1917],{"type":41,"tag":896,"props":1905,"children":1906},{"style":954},[1907],{"type":46,"value":957},{"type":41,"tag":896,"props":1909,"children":1910},{"style":960},[1911],{"type":46,"value":1912},"Approval needed from:",{"type":41,"tag":896,"props":1914,"children":1915},{"style":954},[1916],{"type":46,"value":957},{"type":41,"tag":896,"props":1918,"children":1919},{"style":970},[1920],{"type":46,"value":1921}," [name, per practice profile]\n",{"type":41,"tag":896,"props":1923,"children":1925},{"class":898,"line":1924},20,[1926],{"type":41,"tag":896,"props":1927,"children":1928},{"emptyLinePlaceholder":944},[1929],{"type":46,"value":947},{"type":41,"tag":896,"props":1931,"children":1933},{"class":898,"line":1932},21,[1934],{"type":41,"tag":896,"props":1935,"children":1936},{"style":903},[1937],{"type":46,"value":1712},{"type":41,"tag":896,"props":1939,"children":1941},{"class":898,"line":1940},22,[1942],{"type":41,"tag":896,"props":1943,"children":1944},{"emptyLinePlaceholder":944},[1945],{"type":46,"value":947},{"type":41,"tag":896,"props":1947,"children":1949},{"class":898,"line":1948},23,[1950,1954],{"type":41,"tag":896,"props":1951,"children":1952},{"style":903},[1953],{"type":46,"value":1727},{"type":41,"tag":896,"props":1955,"children":1956},{"style":920},[1957],{"type":46,"value":1958},"Top-of-memo flags\n",{"type":41,"tag":896,"props":1960,"children":1962},{"class":898,"line":1961},24,[1963],{"type":41,"tag":896,"props":1964,"children":1965},{"emptyLinePlaceholder":944},[1966],{"type":46,"value":947},{"type":41,"tag":896,"props":1968,"children":1970},{"class":898,"line":1969},25,[1971],{"type":41,"tag":896,"props":1972,"children":1973},{"style":970},[1974],{"type":46,"value":1975},"[License-unknown list, license-conflict list, non-OSI-posing-as-OSS list, incompatible combinations]\n",{"type":41,"tag":896,"props":1977,"children":1979},{"class":898,"line":1978},26,[1980],{"type":41,"tag":896,"props":1981,"children":1982},{"emptyLinePlaceholder":944},[1983],{"type":46,"value":947},{"type":41,"tag":896,"props":1985,"children":1987},{"class":898,"line":1986},27,[1988],{"type":41,"tag":896,"props":1989,"children":1990},{"style":903},[1991],{"type":46,"value":1712},{"type":41,"tag":896,"props":1993,"children":1995},{"class":898,"line":1994},28,[1996],{"type":41,"tag":896,"props":1997,"children":1998},{"emptyLinePlaceholder":944},[1999],{"type":46,"value":947},{"type":41,"tag":896,"props":2001,"children":2003},{"class":898,"line":2002},29,[2004,2008],{"type":41,"tag":896,"props":2005,"children":2006},{"style":903},[2007],{"type":46,"value":1727},{"type":41,"tag":896,"props":2009,"children":2010},{"style":920},[2011],{"type":46,"value":2012},"By package\n",{"type":41,"tag":896,"props":2014,"children":2016},{"class":898,"line":2015},30,[2017],{"type":41,"tag":896,"props":2018,"children":2019},{"emptyLinePlaceholder":944},[2020],{"type":46,"value":947},{"type":41,"tag":896,"props":2022,"children":2024},{"class":898,"line":2023},31,[2025],{"type":41,"tag":896,"props":2026,"children":2027},{"style":970},[2028],{"type":46,"value":2029},"[Blocks from Step 4, grouped by severity]\n",{"type":41,"tag":896,"props":2031,"children":2033},{"class":898,"line":2032},32,[2034],{"type":41,"tag":896,"props":2035,"children":2036},{"emptyLinePlaceholder":944},[2037],{"type":46,"value":947},{"type":41,"tag":896,"props":2039,"children":2041},{"class":898,"line":2040},33,[2042],{"type":41,"tag":896,"props":2043,"children":2044},{"style":903},[2045],{"type":46,"value":1712},{"type":41,"tag":896,"props":2047,"children":2049},{"class":898,"line":2048},34,[2050],{"type":41,"tag":896,"props":2051,"children":2052},{"emptyLinePlaceholder":944},[2053],{"type":46,"value":947},{"type":41,"tag":896,"props":2055,"children":2057},{"class":898,"line":2056},35,[2058,2062],{"type":41,"tag":896,"props":2059,"children":2060},{"style":903},[2061],{"type":46,"value":1727},{"type":41,"tag":896,"props":2063,"children":2064},{"style":920},[2065],{"type":46,"value":2066},"Jurisdiction note\n",{"type":41,"tag":896,"props":2068,"children":2070},{"class":898,"line":2069},36,[2071],{"type":41,"tag":896,"props":2072,"children":2073},{"emptyLinePlaceholder":944},[2074],{"type":46,"value":947},{"type":41,"tag":896,"props":2076,"children":2078},{"class":898,"line":2077},37,[2079],{"type":41,"tag":896,"props":2080,"children":2081},{"style":970},[2082],{"type":46,"value":2083},"OSS license enforceability varies — AGPL's network trigger has not been broadly tested in court; GPL-3.0's patent clause reads differently under US vs. EU patent law; dedications to public domain are not universally recognized. State the governing-law choice for any downstream distribution (e.g., vendor agreements incorporating the code) and flag jurisdictions the practice profile marks as escalate.\n",{"type":41,"tag":896,"props":2085,"children":2087},{"class":898,"line":2086},38,[2088],{"type":41,"tag":896,"props":2089,"children":2090},{"emptyLinePlaceholder":944},[2091],{"type":46,"value":947},{"type":41,"tag":896,"props":2093,"children":2095},{"class":898,"line":2094},39,[2096],{"type":41,"tag":896,"props":2097,"children":2098},{"style":903},[2099],{"type":46,"value":1712},{"type":41,"tag":896,"props":2101,"children":2103},{"class":898,"line":2102},40,[2104],{"type":41,"tag":896,"props":2105,"children":2106},{"emptyLinePlaceholder":944},[2107],{"type":46,"value":947},{"type":41,"tag":896,"props":2109,"children":2111},{"class":898,"line":2110},41,[2112,2116],{"type":41,"tag":896,"props":2113,"children":2114},{"style":903},[2115],{"type":46,"value":1727},{"type":41,"tag":896,"props":2117,"children":2118},{"style":920},[2119],{"type":46,"value":2120},"Outbound check (if applicable)\n",{"type":41,"tag":896,"props":2122,"children":2124},{"class":898,"line":2123},42,[2125],{"type":41,"tag":896,"props":2126,"children":2127},{"emptyLinePlaceholder":944},[2128],{"type":46,"value":947},{"type":41,"tag":896,"props":2130,"children":2132},{"class":898,"line":2131},43,[2133],{"type":41,"tag":896,"props":2134,"children":2135},{"style":970},[2136],{"type":46,"value":2137},"[From Step 6]\n",{"type":41,"tag":896,"props":2139,"children":2141},{"class":898,"line":2140},44,[2142],{"type":41,"tag":896,"props":2143,"children":2144},{"emptyLinePlaceholder":944},[2145],{"type":46,"value":947},{"type":41,"tag":896,"props":2147,"children":2149},{"class":898,"line":2148},45,[2150],{"type":41,"tag":896,"props":2151,"children":2152},{"style":903},[2153],{"type":46,"value":1712},{"type":41,"tag":896,"props":2155,"children":2157},{"class":898,"line":2156},46,[2158],{"type":41,"tag":896,"props":2159,"children":2160},{"emptyLinePlaceholder":944},[2161],{"type":46,"value":947},{"type":41,"tag":896,"props":2163,"children":2165},{"class":898,"line":2164},47,[2166,2170],{"type":41,"tag":896,"props":2167,"children":2168},{"style":903},[2169],{"type":46,"value":1727},{"type":41,"tag":896,"props":2171,"children":2172},{"style":920},[2173],{"type":46,"value":2174},"Approval routing\n",{"type":41,"tag":896,"props":2176,"children":2178},{"class":898,"line":2177},48,[2179],{"type":41,"tag":896,"props":2180,"children":2181},{"emptyLinePlaceholder":944},[2182],{"type":46,"value":947},{"type":41,"tag":896,"props":2184,"children":2186},{"class":898,"line":2185},49,[2187],{"type":41,"tag":896,"props":2188,"children":2189},{"style":970},[2190],{"type":46,"value":2191},"[From practice profile — who approves, what triggers automatic escalation]\n",{"type":41,"tag":64,"props":2193,"children":2195},{"id":2194},"decision-posture",[2196],{"type":46,"value":2197},"Decision posture",{"type":41,"tag":49,"props":2199,"children":2200},{},[2201,2203,2208],{"type":46,"value":2202},"When a license cannot be confidently classified, flag it as ",{"type":41,"tag":79,"props":2204,"children":2205},{},[2206],{"type":46,"value":2207},"\"needs review\"",{"type":46,"value":2209}," — do not call it permissive. Under-classifying license risk is a one-way door: a ship decision made on a permissive-by-default assumption becomes a source-disclosure obligation or an injunction months later. Over-flagging is a two-way door — the attorney narrows the list in review.",{"type":41,"tag":49,"props":2211,"children":2212},{},[2213],{"type":46,"value":2214},"Likewise, when the copyleft-trigger analysis turns on a contested question (AGPL's \"interacts over a network,\" GPL-3.0's \"conveying,\" the scope of LGPL linking), flag for attorney review and surface the factors cutting both ways.",{"type":41,"tag":64,"props":2216,"children":2218},{"id":2217},"quality-checks-before-delivering",[2219],{"type":46,"value":2220},"Quality checks before delivering",{"type":41,"tag":132,"props":2222,"children":2225},{"className":2223},[2224],"contains-task-list",[2226,2238,2247,2256,2265,2274,2290,2299],{"type":41,"tag":75,"props":2227,"children":2230},{"className":2228},[2229],"task-list-item",[2231,2236],{"type":41,"tag":2232,"props":2233,"children":2235},"input",{"disabled":944,"type":2234},"checkbox",[],{"type":46,"value":2237}," Practice profile and any OSS policy were loaded",{"type":41,"tag":75,"props":2239,"children":2241},{"className":2240},[2229],[2242,2245],{"type":41,"tag":2232,"props":2243,"children":2244},{"disabled":944,"type":2234},[],{"type":46,"value":2246}," Deployment model was established before classifying obligations",{"type":41,"tag":75,"props":2248,"children":2250},{"className":2249},[2229],[2251,2254],{"type":41,"tag":2232,"props":2252,"children":2253},{"disabled":944,"type":2234},[],{"type":46,"value":2255}," Every dependency has a classification, including transitives where available",{"type":41,"tag":75,"props":2257,"children":2259},{"className":2258},[2229],[2260,2263],{"type":41,"tag":2232,"props":2261,"children":2262},{"disabled":944,"type":2234},[],{"type":46,"value":2264}," License-unknown packages are flagged, not defaulted to permissive",{"type":41,"tag":75,"props":2266,"children":2268},{"className":2267},[2229],[2269,2272],{"type":41,"tag":2232,"props":2270,"children":2271},{"disabled":944,"type":2234},[],{"type":46,"value":2273}," License text was read (not just metadata) for any copyleft or non-OSI finding",{"type":41,"tag":75,"props":2275,"children":2277},{"className":2276},[2229],[2278,2281,2283,2288],{"type":41,"tag":2232,"props":2279,"children":2280},{"disabled":944,"type":2234},[],{"type":46,"value":2282}," Source tags applied to citations; no stripped ",{"type":41,"tag":55,"props":2284,"children":2286},{"className":2285},[],[2287],{"type":46,"value":1581},{"type":46,"value":2289}," tags",{"type":41,"tag":75,"props":2291,"children":2293},{"className":2292},[2229],[2294,2297],{"type":41,"tag":2232,"props":2295,"children":2296},{"disabled":944,"type":2234},[],{"type":46,"value":2298}," Approver named per practice profile",{"type":41,"tag":75,"props":2300,"children":2302},{"className":2301},[2229],[2303,2306],{"type":41,"tag":2232,"props":2304,"children":2305},{"disabled":944,"type":2234},[],{"type":46,"value":2307}," Output marked with the work-product header",{"type":41,"tag":64,"props":2309,"children":2311},{"id":2310},"close-with-the-next-steps-decision-tree",[2312],{"type":46,"value":2313},"Close with the next-steps decision tree",{"type":41,"tag":49,"props":2315,"children":2316},{},[2317,2319,2324],{"type":46,"value":2318},"End with the next-steps decision tree per CLAUDE.md ",{"type":41,"tag":55,"props":2320,"children":2322},{"className":2321},[],[2323],{"type":46,"value":1449},{"type":46,"value":2325},". Customize the options to what this skill just produced — the five default branches (draft the X, escalate, get more facts, watch and wait, something else) are a starting point, not a lock-in. The tree is the output; the lawyer picks.",{"type":41,"tag":49,"props":2327,"children":2328},{},[2329,2331,2337],{"type":46,"value":2330},"If the scan surfaced more than ~10 packages, or any time the user asks: offer the dashboard (see CLAUDE.md ",{"type":41,"tag":55,"props":2332,"children":2334},{"className":2333},[],[2335],{"type":46,"value":2336},"## Outputs → Dashboard offer for data-heavy outputs",{"type":46,"value":2338},"). Shape the offer to what's useful here — counts by license family (permissive \u002F weak copyleft \u002F strong copyleft \u002F AGPL \u002F proprietary \u002F unknown), risk distribution, and a table of findings with severity and package version.",{"type":41,"tag":2340,"props":2341,"children":2342},"style",{},[2343],{"type":46,"value":2344},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2346,"total":2442},[2347,2359,2376,2393,2405,2416,2427],{"slug":2348,"name":2348,"fn":2349,"description":2350,"org":2351,"tags":2352,"stars":23,"repoUrl":24,"updatedAt":2358},"ai-inventory","track AI systems for EU AI Act","EU AI Act per-system inventory — track each AI system's role (provider, deployer, importer, distributor, authorized representative, product manufacturer) and risk tier (prohibited, high-risk, limited, minimal, GPAI, GPAI+systemic). Role and tier are assessed per system, not per company. Use when the user says \"ai inventory\", \"add an ai system\", \"what systems do we have\", \"classify this ai system\", \"eu ai act register\", or \"ai system registry\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2353,2354,2357],{"name":14,"slug":15,"type":16},{"name":2355,"slug":2356,"type":16},"Governance","governance",{"name":18,"slug":19,"type":16},"2026-05-14T06:02:19.677579",{"slug":2360,"name":2360,"fn":2361,"description":2362,"org":2363,"tags":2364,"stars":23,"repoUrl":24,"updatedAt":2375},"ai-tool-handoff","manage handoff to bulk legal review tools","Detects when Luminance, Kira, or a similar bulk-review tool is in use, hands off the high-volume clause extraction to it, and QAs its output per the trust level in `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fcorporate-legal\u002FCLAUDE.md`. Use when user says \"send to Luminance\", \"bulk review\", \"AI extraction\", or when diligence-issue-extraction hits a high-volume category.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2365,2368,2371,2372],{"name":2366,"slug":2367,"type":16},"Automation","automation",{"name":2369,"slug":2370,"type":16},"Contracts","contracts",{"name":18,"slug":19,"type":16},{"name":2373,"slug":2374,"type":16},"QA","qa","2026-05-14T06:01:31.00555",{"slug":2377,"name":2377,"fn":2378,"description":2379,"org":2380,"tags":2381,"stars":23,"repoUrl":24,"updatedAt":2392},"aia-generation","run AI impact assessments","Run an AI impact assessment — structured intake, risk analysis, regulatory classification per regime in scope, policy consistency diff, and recommendation with conditions. Uses the house-style structure learned from the seed impact assessment in `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md`. Use when user says \"impact assessment for\", \"assess this AI use case\", \"run an AIA\", \"generate an AIA\", \"we need to document this AI system\", \"AI risk assessment for X\", or follows a conditional triage result.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2382,2383,2386,2389],{"name":18,"slug":19,"type":16},{"name":2384,"slug":2385,"type":16},"Policy","policy",{"name":2387,"slug":2388,"type":16},"Regulatory Compliance","regulatory-compliance",{"name":2390,"slug":2391,"type":16},"Risk Assessment","risk-assessment","2026-05-13T06:03:19.61029",{"slug":2394,"name":2394,"fn":2395,"description":2396,"org":2397,"tags":2398,"stars":23,"repoUrl":24,"updatedAt":2404},"amendment-history","trace contract amendment history","Trace how a contract has changed across its base agreement and all amendments — either a summary of all changes over time, or a provision trace for a specific clause. Use when the user says \"what changed in this contract over time\", \"show me the amendment history\", \"where's the latest [clause]\", \"how has [provision] evolved\", or uploads multiple versions of an agreement.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2399,2400,2403],{"name":2369,"slug":2370,"type":16},{"name":2401,"slug":2402,"type":16},"Documents","documents",{"name":18,"slug":19,"type":16},"2026-05-13T06:03:34.070339",{"slug":2406,"name":2406,"fn":2407,"description":2408,"org":2409,"tags":2410,"stars":23,"repoUrl":24,"updatedAt":2415},"auto-updater","check for community skill updates","Check installed community skills for updates. Shows a diff and requires explicit approval before applying. Use when the user says \"check for updates\", \"update my skills\", \"anything new for my installed skills\", or when invoked from the registry-sync agent.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2411,2412],{"name":2366,"slug":2367,"type":16},{"name":2413,"slug":2414,"type":16},"Plugin Development","plugin-development","2026-05-13T06:02:55.642269",{"slug":2417,"name":2417,"fn":2418,"description":2419,"org":2420,"tags":2421,"stars":23,"repoUrl":24,"updatedAt":2426},"bar-prep-questions","provide bar exam practice questions","Bar prep questions — MBE or essay, targeted at your weak subjects and bar jurisdiction. Tracks misses and comes back to patterns. Use when the user says \"bar prep\", \"MBE questions\", \"practice essay\", or \"test me for the bar\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2422,2425],{"name":2423,"slug":2424,"type":16},"Education","education",{"name":18,"slug":19,"type":16},"2026-07-24T05:41:43.01243",{"slug":2428,"name":2428,"fn":2429,"description":2430,"org":2431,"tags":2432,"stars":23,"repoUrl":24,"updatedAt":2441},"board-minutes","draft board and committee meeting minutes","Drafts board or committee meeting minutes in your house format. Auto-detects upcoming board and committee meetings from your calendar, asks for the agenda and any slides or pre-read materials, and produces a complete draft in the format learned from your seed minutes. Also handles written consents in lieu of meetings. Trigger: \"board minutes\", \"draft minutes\", \"upcoming board meeting\", \"committee minutes\", \"written consent\", or calendar detection of an upcoming board or committee event.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2433,2436,2437,2438],{"name":2434,"slug":2435,"type":16},"Documentation","documentation",{"name":2355,"slug":2356,"type":16},{"name":18,"slug":19,"type":16},{"name":2439,"slug":2440,"type":16},"Meetings","meetings","2026-05-14T06:01:29.792942",118,{"items":2444,"total":2627},[2445,2466,2480,2492,2511,2522,2541,2561,2575,2590,2598,2611],{"slug":2446,"name":2446,"fn":2447,"description":2448,"org":2449,"tags":2450,"stars":2463,"repoUrl":2464,"updatedAt":2465},"algorithmic-art","create algorithmic art with p5.js","Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2451,2454,2457,2460],{"name":2452,"slug":2453,"type":16},"Creative","creative",{"name":2455,"slug":2456,"type":16},"Design","design",{"name":2458,"slug":2459,"type":16},"Generative Art","generative-art",{"name":2461,"slug":2462,"type":16},"JavaScript","javascript",161831,"https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fskills","2026-04-06T17:56:15.455818",{"slug":2467,"name":2467,"fn":2468,"description":2469,"org":2470,"tags":2471,"stars":2463,"repoUrl":2464,"updatedAt":2479},"brand-guidelines","apply Anthropic brand colors and typography","Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2472,2475,2476],{"name":2473,"slug":2474,"type":16},"Branding","branding",{"name":2455,"slug":2456,"type":16},{"name":2477,"slug":2478,"type":16},"Typography","typography","2026-04-06T17:56:05.042852",{"slug":2481,"name":2481,"fn":2482,"description":2483,"org":2484,"tags":2485,"stars":2463,"repoUrl":2464,"updatedAt":2491},"canvas-design","create posters and visual art as PNG or PDF","Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2486,2487,2488],{"name":2452,"slug":2453,"type":16},{"name":2455,"slug":2456,"type":16},{"name":2489,"slug":2490,"type":16},"PDF","pdf","2026-04-06T17:56:03.794732",{"slug":2493,"name":2493,"fn":2494,"description":2495,"org":2496,"tags":2497,"stars":2463,"repoUrl":2464,"updatedAt":2510},"claude-api","build apps with the Claude API","Reference for the Claude API \u002F Anthropic SDK — model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration.\nTRIGGER — read BEFORE opening the target file; don't skip because it \"looks like a one-liner\" — whenever: the prompt names Claude\u002FAnthropic in any form (Claude, Anthropic, Fable, Opus, Sonnet, Haiku, `anthropic`, `@anthropic-ai`, `claude-*`, `us.anthropic.*`, `[1m]`); the user asks about an LLM (pricing\u002Fmodel choice\u002Flimits\u002Fcaching) — never answer from memory; OR the task is LLM-shaped with provider unstated (agent\u002FMCP\u002Ftool-definition\u002Fmulti-agent\u002FRAG\u002FLLM-judge\u002Fcomputer-use; generate\u002Fsummarize\u002Fextract\u002Fclassify\u002Frewrite\u002Fconverse over NL; debugging refusals\u002Fcutoffs\u002Fstreaming\u002Ftool-calls\u002Ftokens).\nSKIP only when another provider is being worked on (overrides all triggers): OpenAI\u002FGPT\u002FGemini\u002FLlama\u002FMistral\u002FCohere\u002FOllama named in the query; OR `grep -rE 'openai|langchain_openai|google.generativeai|genai|mistralai|cohere|ollama'` over the project hits (run this grep FIRST if no provider named — don't Read the file).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2498,2501,2502,2505,2507],{"name":2499,"slug":2500,"type":16},"Agents","agents",{"name":9,"slug":8,"type":16},{"name":2503,"slug":2504,"type":16},"Anthropic SDK","anthropic-sdk",{"name":2506,"slug":2493,"type":16},"Claude API",{"name":2508,"slug":2509,"type":16},"LLM","llm","2026-07-28T05:36:08.213335",{"slug":2512,"name":2512,"fn":2513,"description":2514,"org":2515,"tags":2516,"stars":2463,"repoUrl":2464,"updatedAt":2521},"doc-coauthoring","co-author documentation and technical specs","Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2517,2518],{"name":2434,"slug":2435,"type":16},{"name":2519,"slug":2520,"type":16},"Technical Writing","technical-writing","2026-04-06T17:56:14.18897",{"slug":2523,"name":2523,"fn":2524,"description":2525,"org":2526,"tags":2527,"stars":2463,"repoUrl":2464,"updatedAt":2540},"docx","create and edit Word documents","Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', '.dotx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx or .dotx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2528,2529,2531,2534,2537],{"name":2401,"slug":2402,"type":16},{"name":2530,"slug":2523,"type":16},"DOCX",{"name":2532,"slug":2533,"type":16},"Office","office",{"name":2535,"slug":2536,"type":16},"Templates","templates",{"name":2538,"slug":2539,"type":16},"Word","word","2026-07-18T05:16:23.136271",{"slug":2542,"name":2542,"fn":2543,"description":2544,"org":2545,"tags":2546,"stars":2463,"repoUrl":2464,"updatedAt":2560},"frontend-design","design production-grade frontend interfaces","Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2547,2548,2551,2554,2557],{"name":2455,"slug":2456,"type":16},{"name":2549,"slug":2550,"type":16},"Frontend","frontend",{"name":2552,"slug":2553,"type":16},"React","react",{"name":2555,"slug":2556,"type":16},"Tailwind CSS","tailwind-css",{"name":2558,"slug":2559,"type":16},"UI Components","ui-components","2026-04-06T17:56:16.723469",{"slug":2562,"name":2562,"fn":2563,"description":2564,"org":2565,"tags":2566,"stars":2463,"repoUrl":2464,"updatedAt":2574},"internal-comms","write internal company communications","A set of resources to help me write all kinds of internal communications, using the formats that my company likes to use. Claude should use this skill whenever asked to write some sort of internal communications (status reports, leadership updates, 3P updates, company newsletters, FAQs, incident reports, project updates, etc.).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2567,2570,2571],{"name":2568,"slug":2569,"type":16},"Communications","communications",{"name":2535,"slug":2536,"type":16},{"name":2572,"slug":2573,"type":16},"Writing","writing","2026-04-06T17:56:20.695522",{"slug":2576,"name":2576,"fn":2577,"description":2578,"org":2579,"tags":2580,"stars":2463,"repoUrl":2464,"updatedAt":2589},"mcp-builder","build MCP servers","Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node\u002FTypeScript (MCP SDK).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2581,2582,2585,2586],{"name":2499,"slug":2500,"type":16},{"name":2583,"slug":2584,"type":16},"API Development","api-development",{"name":2508,"slug":2509,"type":16},{"name":2587,"slug":2588,"type":16},"MCP","mcp","2026-04-06T17:56:10.357665",{"slug":2490,"name":2490,"fn":2591,"description":2592,"org":2593,"tags":2594,"stars":2463,"repoUrl":2464,"updatedAt":2597},"read edit and manipulate PDF files","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2595,2596],{"name":2401,"slug":2402,"type":16},{"name":2489,"slug":2490,"type":16},"2026-04-06T17:56:02.483316",{"slug":2599,"name":2599,"fn":2600,"description":2601,"org":2602,"tags":2603,"stars":2463,"repoUrl":2464,"updatedAt":2610},"pptx","create and edit PowerPoint presentations","Use this skill any time a .pptx or .potx file is involved in any way — as input, output, or both. This includes: creating slide decks, pitch decks, or presentations; reading, parsing, or extracting text from any .pptx or .potx file (even if the extracted content will be used elsewhere, like in an email or summary); editing, modifying, or updating existing presentations; combining or splitting slide files; working with templates (.potx), layouts, speaker notes, or comments. Trigger whenever the user mentions \"deck,\" \"slides,\" \"presentation,\" or references a .pptx or .potx filename, regardless of what they plan to do with the content afterward. If a .pptx or .potx file needs to be opened, created, or touched, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2604,2607],{"name":2605,"slug":2606,"type":16},"PowerPoint","powerpoint",{"name":2608,"slug":2609,"type":16},"Presentations","presentations","2026-07-18T05:16:24.1471",{"slug":2612,"name":2612,"fn":2613,"description":2614,"org":2615,"tags":2616,"stars":2463,"repoUrl":2464,"updatedAt":2626},"skill-creator","create and optimize agent skills","Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2617,2618,2619,2622,2625],{"name":2499,"slug":2500,"type":16},{"name":2434,"slug":2435,"type":16},{"name":2620,"slug":2621,"type":16},"Evals","evals",{"name":2623,"slug":2624,"type":16},"Performance","performance",{"name":2519,"slug":2520,"type":16},"2026-04-19T06:45:40.804",490]