How to use the Open Source License Review agent skill (oss-review)

What the oss-review skill makes the agent do

An agent skill is a folder containing a SKILL.md file that gives an AI agent specific instructions for one kind of task. This skill is for open source license review. Once installed, the agent reviews a project's dependency list (such as package.json, requirements.txt, go.mod, Gemfile, Cargo.toml, pom.xml, an SBOM, or a lockfile), a single library, or code the team plans to open-source.

The agent classifies each license into a family: permissive, weak copyleft, strong copyleft, public domain, non-OSI, or unknown. It flags source-available licenses such as SSPL, BUSL, Commons Clause, Elastic License, and fair-source as not open source, and it treats license-unknown packages as needing review rather than as permissive by default. It then maps obligations to the deployment model (SaaS, distributed binary, internal only, or embedded) and recommends an action for each item: comply, replace, remove, seek legal review, or seek commercial license.

Install the oss-review skill

You can install the skill in one of two ways. Download the ZIP from the skill's page on this site and unzip it into your user skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only in that project.

Alternatively, upload the skill in the Claude apps under Settings → Capabilities → Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload

Set up the practice profile before the first review

The skill reads a practice profile at ~/.claude/plugins/config/claude-for-legal/ip-legal/CLAUDE.md. If that file is missing or still contains placeholders, the skill stops and asks you to run the setup interview. The profile records who owns OSS review on your team, escalation routing for copyleft obligations, and the work-product header to prepend to memos.

Run this command to create the profile:

• If your practice profile points to an uploaded OSS policy, the skill reads it and treats it as the source of truth for accepted, review, and banned licenses.

Trigger the skill with natural requests and command examples

You can invoke the skill with a slash command that takes a file path, a package name, or a repo path. The skill will ask for the scope and deployment model if you do not provide them.

You can also ask in plain language, for example when reviewing a manifest, SBOM, or repo for copyleft obligations, when asking whether a library can ship, or when preparing code to be open-sourced. The skill's description lists these triggers.

• Can we ship the redis library in our desktop app?
• Review the package.json in this project for copyleft obligations.
• Check whether this repo is ready to be open-sourced under Apache-2.0.

Understand the deployment question

The skill asks how the software will be deployed before it classifies obligations, because the same library can trigger different duties. For example, GPL, LGPL, MPL, and EPL are described as triggering on distribution, while AGPL can be triggered by users interacting over a network. Internal-only use generally avoids most copyleft triggers, though AGPL still matters if outside users interact with the software over a network.

Be ready to answer one of four options: SaaS or hosted service, distributed binary, internal only, or embedded or firmware. Embedded firmware is flagged as especially hard to comply with for GPL code, so plan for it before shipping.

Read the memo and understand what it does not decide

The output is a memo the lawyer, or an engineer working with attorney access, can act on. It opens with a work-product header and bottom line, lists top-of-memo flags, groups per-package blocks by severity, and includes a jurisdiction note, an outbound check if relevant, and approval routing.

The skill does not give final legal advice. Anything classified as strong copyleft or license-unknown goes to an attorney before the dependency ships or the code is released. Contested questions, such as AGPL's network interaction, GPL-3.0's conveying, and LGPL linking scope, are flagged with the factors cutting both ways.

Safety notes: scripts and network

According to the skill's listing, it runs no scripts and uses no network access. It reads the files you point it to, the practice profile, and any uploaded OSS policy. Because it does not connect to the network, package metadata it reads is what is in your files; the skill's instructions tell it to check actual license text, since LICENSE files can be wrong and package metadata can be stale.

• Runs scripts: no
• Uses network: no
• Optional ticketing connector (Jira, Linear, or Asana) for incoming clearance requests, described in CONNECTORS.md

Tips for better results

Give the skill a complete input. A manifest plus a lockfile or SBOM gives a fuller picture of transitive dependencies than a single package name. Name the deployment model up front, and confirm your practice profile is current before you start.

• Provide the deployment model in your first message to avoid a follow-up question.
• Upload your OSS policy and reference it in the practice profile so the skill uses your team's accepted list.
• Treat every strong copyleft or unknown flag as a case for an attorney, not a decision for the agent.