endor-license

Analyze dependency license compliance and identify license risks. Use when the user says "check licenses", "license compliance", "any GPL dependencies", "copyleft risk", "endor license", or wants to know if dependencies are compatible with their project license. Flags copyleft (GPL, AGPL), unknown, and no-license packages. Do NOT use for vulnerability scanning (/endor-sca) or policy enforcement (/endor-policy).

Quality

78%

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

Securityby

Passed

No known issues

Optimize this skill with Tessl

npx tessl skill review --optimize ./skills/endor-license/SKILL.md

Quality

Discovery

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is an excellent skill description that hits all the marks. It provides specific capabilities, rich natural trigger terms, explicit 'Use when' and 'Do NOT use' guidance, and clearly distinguishes itself from related skills. The negative boundary conditions (what NOT to use it for) are a particularly strong feature for disambiguation in a multi-skill environment.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions: analyze dependency license compliance, identify license risks, flag copyleft (GPL, AGPL), unknown, and no-license packages. Also specifies what it does NOT do, adding further clarity.	3 / 3
Completeness	Clearly answers both 'what' (analyze dependency license compliance, flag copyleft/unknown/no-license packages) and 'when' (explicit 'Use when...' clause with multiple trigger phrases). Also includes a 'Do NOT use' clause to prevent misuse, which adds further completeness.	3 / 3
Trigger Term Quality	Excellent coverage of natural trigger terms: 'check licenses', 'license compliance', 'any GPL dependencies', 'copyleft risk', 'endor license', plus the concept of dependency compatibility with project license. These are terms users would naturally say.	3 / 3
Distinctiveness Conflict Risk	Highly distinctive with a clear niche (license compliance analysis). Explicitly differentiates itself from related skills by stating 'Do NOT use for vulnerability scanning (/endor-sca) or policy enforcement (/endor-policy)', which directly reduces conflict risk with sibling skills.	3 / 3
	Total	12 / 12 Passed

Implementation

57%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill provides a solid structure for license compliance analysis with useful reference tables and a clear output template. However, Step 2 is vague ('Read project manifests') without concrete instructions, and the workflow lacks validation checkpoints to verify license classification accuracy. The compatibility matrices and license categories are helpful references, though some could be trimmed given Claude's existing knowledge.

Suggestions

Make Step 2 actionable by providing specific code or commands for reading manifests and cross-referencing license data, rather than the vague 'Read project manifests' instruction.

Add a validation checkpoint between Steps 2 and 3 to verify license classifications are correct (e.g., cross-check SPDX identifiers, handle dual-licensed packages).

Trim the license categories table since Claude already knows common open-source licenses — focus only on the risk classification mapping that's specific to this workflow.

Dimension	Reasoning	Score
Conciseness	The content is mostly efficient but includes some elements that could be tightened. The compatibility matrix tables and the full output template are somewhat verbose, though they do provide useful reference information. The license categories table is a good reference but Claude likely knows common license classifications.	2 / 3
Actionability	Provides a concrete CLI command and MCP tool invocation, but Step 2 ('Read project manifests to build a complete license inventory') is vague with no concrete code or specific instructions. The output template is detailed but the actual analysis steps lack executable specificity.	2 / 3
Workflow Clarity	Steps are listed in sequence (scan, analyze, present), but Step 2 lacks specificity and there are no validation checkpoints or feedback loops. For a workflow that could produce incorrect license classifications, there's no verification step to confirm findings accuracy before presenting results.	2 / 3
Progressive Disclosure	Content is well-structured with clear sections and appropriate references to external files (references/cli-parsing.md, references/data-sources.md). Navigation to related skills (/endor-policy, /endor-scan, /endor-cicd) is clearly signaled. The overview stays at the right level without deeply nesting references.	3 / 3
	Total	9 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository: endorlabs/skills-ideas
Commit: 344e7ff

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.