endor-license
Analyze dependency license compliance and identify license risks. Use when the user says "check licenses", "license compliance", "any GPL dependencies", "copyleft risk", "endor license", or wants to know if dependencies are compatible with their project license. Flags copyleft (GPL, AGPL), unknown, and no-license packages. Do NOT use for vulnerability scanning (/endor-sca) or policy enforcement (/endor-policy).
64
75%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Passed
No known issues
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/endor-license/SKILL.mdQuality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that hits all the marks. It provides specific capabilities, rich natural trigger terms, explicit 'Use when' and 'Do NOT use' guidance, and clearly distinguishes itself from related skills. The negative boundary conditions (what NOT to use it for) are a particularly strong feature for disambiguation in a multi-skill environment.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple concrete actions: analyze dependency license compliance, identify license risks, flag copyleft (GPL, AGPL), unknown, and no-license packages. Also specifies what it does NOT do, adding further clarity. | 3 / 3 |
Completeness | Clearly answers both 'what' (analyze dependency license compliance, flag copyleft/unknown/no-license packages) and 'when' (explicit 'Use when...' clause with multiple trigger phrases). Also includes a 'Do NOT use' clause to prevent misuse, which adds further completeness. | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural trigger terms: 'check licenses', 'license compliance', 'any GPL dependencies', 'copyleft risk', 'endor license', plus the concept of dependency compatibility with project license. These are terms users would naturally say. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive with a clear niche (license compliance analysis). Explicitly differentiates itself from related skills by stating 'Do NOT use for vulnerability scanning (/endor-sca) or policy enforcement (/endor-policy)', which directly reduces conflict risk with sibling skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
50%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This skill provides a reasonable framework for license compliance analysis with useful reference tables and a clear output format. Its main weaknesses are the vagueness of Step 2, the lack of validation checkpoints between steps, and the somewhat verbose output template that Claude could largely generate from simpler instructions. The compatibility matrices add value but contribute to overall length.
Suggestions
Make Step 2 actionable by providing specific commands or code to parse manifest files (e.g., `jq '.dependencies' package.json`) rather than the vague 'Read project manifests' instruction.
Add a validation checkpoint after Step 1 to verify findings were retrieved (e.g., 'If no findings returned, check if scan completed successfully before proceeding').
Trim the output template—specify the structure and key fields but let Claude generate the markdown formatting, which it already knows how to do.
Ensure referenced files (references/cli-parsing.md, references/data-sources.md) are included in the bundle, or remove the references if they don't exist.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The content is mostly efficient but includes some elements that could be tightened—the compatibility matrix tables are somewhat redundant given the license categories table already establishes risk levels, and the full output template is quite verbose with placeholder formatting that Claude could generate on its own. | 2 / 3 |
Actionability | Provides a concrete CLI command and MCP tool invocation with specific parameters, which is good. However, Step 2 ('Read project manifests to build a complete license inventory') is vague with no concrete code or commands, and the output template is more of a formatting guide than executable guidance. | 2 / 3 |
Workflow Clarity | The three-step workflow is clearly sequenced, and error handling is included. However, there are no validation checkpoints—no step to verify scan results were actually retrieved before proceeding to analysis, and no feedback loop if the manifest analysis reveals discrepancies with scan findings. | 2 / 3 |
Progressive Disclosure | References to 'references/cli-parsing.md' and 'references/data-sources.md' show good intent for progressive disclosure, but no bundle files were provided to verify these exist. The main content includes substantial inline detail (compatibility matrices, full output template) that could arguably be split into reference files. | 2 / 3 |
Total | 8 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- endorlabs/skills-ideas
- Commit
b958adc
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.