|
| 1 | +# AI Compliance Plugin |
| 2 | + |
| 3 | +AI-powered software compliance auditing for open-source license detection, risk assessment, and attribution file generation. |
| 4 | + |
| 5 | +## Overview |
| 6 | + |
| 7 | +Open-source license compliance is a legal obligation that many projects overlook. Using a GPL-licensed dependency in a proprietary project could require disclosing your source code. A dependency with no license at all is legally "all rights reserved" and can't be used without explicit permission. This plugin scans your dependency tree, identifies every license, flags incompatibilities with your project's license, and generates the attribution files required by licenses like MIT, BSD, and Apache 2.0. |
| 8 | + |
| 9 | +## Skills |
| 10 | + |
| 11 | +### `/compliance-license-audit` - License Compliance Audit |
| 12 | + |
| 13 | +Interactive, comprehensive audit of all open-source licenses in your dependency tree. |
| 14 | + |
| 15 | +**Features:** |
| 16 | +- Auto-detects your project's license with confirmation |
| 17 | +- Scans all dependency manifests (package.json, requirements.txt, .csproj, go.mod, Cargo.toml, etc.) |
| 18 | +- Identifies direct and transitive dependency licenses |
| 19 | +- Scans source code for license headers and vendored/copied code |
| 20 | +- Classifies licenses: Permissive, Weak Copyleft, Strong Copyleft, Unknown |
| 21 | +- Flags incompatibilities with your project's license |
| 22 | +- Identifies dependencies with no license (highest legal risk) |
| 23 | +- Produces a License Compliance Score (0-100) |
| 24 | +- Lists all unfulfilled license obligations (missing NOTICE files, attribution, etc.) |
| 25 | +- Provides specific alternatives for problematic dependencies |
| 26 | + |
| 27 | +**Usage:** |
| 28 | +```bash |
| 29 | +/compliance-license-audit |
| 30 | +``` |
| 31 | + |
| 32 | +The skill will interactively ask about: |
| 33 | +1. Your project's license (auto-detected with confirmation) |
| 34 | +2. Audit scope (full, dependencies only, or source code only) |
| 35 | +3. Risk tolerance (strict, moderate, permissive only, or informational) |
| 36 | +4. Whether to include transitive dependencies |
| 37 | + |
| 38 | +**Report output:** `/docs/compliance/YYYY-MM-DD-HHMMSS-license-audit.md` |
| 39 | + |
| 40 | +### `/compliance-notice-generate` - Generate NOTICE / Attribution File |
| 41 | + |
| 42 | +Generates legally compliant NOTICE, ATTRIBUTION, or THIRD-PARTY-NOTICES files from your dependency tree. |
| 43 | + |
| 44 | +**Features:** |
| 45 | +- Four output formats: NOTICE, THIRD-PARTY-NOTICES.md, ATTRIBUTION.md, licenses.json |
| 46 | +- Configurable scope (production only, all, or custom dependency groups) |
| 47 | +- Optional full license text inclusion |
| 48 | +- Extracts actual copyright notices from LICENSE files |
| 49 | +- Handles dual-licensed packages |
| 50 | +- Supports all major package ecosystems |
| 51 | +- Detects and handles existing attribution files |
| 52 | + |
| 53 | +**Usage:** |
| 54 | +```bash |
| 55 | +/compliance-notice-generate |
| 56 | +``` |
| 57 | + |
| 58 | +The skill will interactively ask about: |
| 59 | +1. Output format (NOTICE, THIRD-PARTY-NOTICES.md, ATTRIBUTION.md, or licenses.json) |
| 60 | +2. Content scope (production only, all, or custom) |
| 61 | +3. Whether to include full license texts |
| 62 | +4. How to handle existing attribution files (if any) |
| 63 | + |
| 64 | +**Output:** Generated file saved to project root directory. |
| 65 | + |
| 66 | +## License Classifications |
| 67 | + |
| 68 | +| Classification | Examples | Risk Level | |
| 69 | +|---------------|----------|------------| |
| 70 | +| Permissive | MIT, Apache-2.0, BSD-2, BSD-3, ISC, Unlicense | Low | |
| 71 | +| Weak Copyleft | LGPL-2.1, LGPL-3.0, MPL-2.0, EPL-2.0 | Moderate | |
| 72 | +| Strong Copyleft | GPL-2.0, GPL-3.0, AGPL-3.0, SSPL-1.0 | High-Critical | |
| 73 | +| No License | All rights reserved by default | Critical | |
| 74 | + |
| 75 | +## Supported Package Ecosystems |
| 76 | + |
| 77 | +| Ecosystem | Manifest | Lock File | |
| 78 | +|-----------|----------|-----------| |
| 79 | +| Node.js | package.json | package-lock.json, yarn.lock, pnpm-lock.yaml | |
| 80 | +| Python | requirements.txt, pyproject.toml, Pipfile | Pipfile.lock, poetry.lock | |
| 81 | +| .NET | *.csproj, packages.config | packages.lock.json | |
| 82 | +| Go | go.mod | go.sum | |
| 83 | +| Rust | Cargo.toml | Cargo.lock | |
| 84 | +| Ruby | Gemfile | Gemfile.lock | |
| 85 | +| PHP | composer.json | composer.lock | |
| 86 | +| Java/Kotlin | pom.xml, build.gradle | - | |
| 87 | + |
| 88 | +## Why This Matters |
| 89 | + |
| 90 | +- **MIT License** requires: "The above copyright notice and this permission notice shall be included in all copies" |
| 91 | +- **Apache 2.0** requires: Reproducing the NOTICE file in any distribution |
| 92 | +- **BSD 3-Clause** requires: "Redistributions in binary form must reproduce the above copyright notice" |
| 93 | +- **No license** means: "All rights reserved" - you legally cannot use the code |
| 94 | +- **GPL in proprietary code** means: You may be obligated to release your source code |
| 95 | + |
| 96 | +A single overlooked AGPL dependency in a SaaS application could theoretically require you to open-source your entire application. |
| 97 | + |
| 98 | +## Recommended Workflow |
| 99 | + |
| 100 | +1. Run `/compliance-license-audit` to get a full picture of your license landscape |
| 101 | +2. Address any critical findings (incompatible licenses, missing licenses) |
| 102 | +3. Run `/compliance-notice-generate` to create attribution files fulfilling your obligations |
| 103 | +4. Add attribution file maintenance to your release checklist |
| 104 | + |
| 105 | +## Plugin Details |
| 106 | + |
| 107 | +| Field | Value | |
| 108 | +|-------|-------| |
| 109 | +| Version | 1.0.0 | |
| 110 | +| Author | [Charles Jones](https://charlesjones.dev) | |
| 111 | +| License | MIT | |
| 112 | +| Repository | [claude-code-plugins-dev](https://github.com/charlesjones-dev/claude-code-plugins-dev) | |
0 commit comments