What problem does it solve? License obligations hide in places a dependency manifest never shows: vendored code, fonts, images, datasets, and copied snippets. This Skill reconciles a repository's declared license against everything it actually ships, classifies risk per finding, and produces evidence-backed reports without ever making legal conclusions. ## Core Features & Use Cases - Full-surface inventory: Enumerates manifests, lockfiles, vendored directories, submodules, SPDX headers, fonts, media assets, datasets, and copied-snippet provenance markers via stdlib-only Python scripts. - Risk classification with legal boundaries: Assigns critical/high/medium/low/info risk levels using a defined taxonomy, phrases findings as likely obligation gaps, and escalates categories like cross-copyleft compatibility and linking triggers to human/legal review. - Structured reports and gated issue drafts: Normalizes findings to a stable JSON schema, renders a terminal summary plus markdown/JSON reports carrying the non-legal-advice disclaimer, and drafts grouped GitHub issues only after explicit confirmation. - Use Case: Before open-sourcing a project, run a full audit to surface a GPL dependency bundled into an MIT-declared repo, an OFL font missing its license text, and a CC-BY-NC image conflicting with commercial distribution. ## Quick Start Use the license-compliance-auditor skill to run a full license audit of this repository and write the compliance report and findings JSON.
