[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6H05M123PM4KT3KETFYA520":3,"skill-same:01M6H05M123PM4KT3KETFYA520":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":24,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":54,"ownerDescription":55,"updatedAt":56,"install":57,"resources":70},"01M6H05M123PM4KT3KETFYA520","scan-for-license-compliance",null,"Use when shipping third-party code and a license policy must be met. Inventories every dependency's license and flags copyleft or unknown terms before release.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-scan-for-license-compliance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-scan-for-license-compliance\u002FSKILL.md",[19],{"categoryNo":20,"categoryName":21,"taxonomyType":22,"taxonomyTypeDesc":23},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"license","license compliance","compliance","scan for license compliance","for","scan","dependency","when","party","unknown","third-party","flags","policy","use","terms","shipping","release","code","2026-11-10 10:12:30",false,"---\nname: scan-for-license-compliance\ndescription: Use when shipping third-party code and a license policy must be met. Inventories every dependency's license and flags copyleft or unknown terms before release.\n---\n\n# Scan for License Compliance\n\nA single GPL dependency linked into a proprietary binary is a legal problem, and \"unknown\" licenses are the ones lawyers lose sleep over. Inventory licenses from the shipped graph and diff against an explicit allow list.\n\n## Procedure\n\n1. Scan the resolved dependencies, per ecosystem:\n   - Node: `npx license-checker --production --json > licenses.json`\n   - Python: `pip-licenses --format=json --with-license-file > licenses.json`\n   - Go: `go-licenses check .\u002F...` or `go-licenses csv .\u002F...`\n   - Rust: `cargo license --json` or `cargo deny check licenses`\n   - JVM: `mvn license:aggregate-add-third-party`\n2. For deep or mixed trees use ScanCode: `scancode -clpieu --json out.json vendor\u002F` (it reads LICENSE files, not just metadata, and catches missing declarations).\n3. Define the policy as data. Allow: MIT, Apache-2.0, BSD-2\u002F3-Clause, ISC, MPL-2.0 (weak copyleft, per-file). Review: LGPL-2.1\u002F3.0 (dynamic linking question). Deny: GPL-2.0\u002F3.0, AGPL-3.0, SSPL, and any `UNKNOWN`\u002Fempty license.\n4. Compare and fail on deny-list hits or unknowns:\n   `cargo deny check licenses` with `[licenses] allow = [\"MIT\", \"Apache-2.0\"]`, or filter `licenses.json` with `jq`.\n5. Handle transitive hits by traceback: find who pulls the GPL package (`npm ls \u003Cpkg>`) and either replace it, drop the feature, or seek legal sign-off in writing.\n6. For dual-licensed packages (e.g. `MIT OR Apache-2.0`), record which side you rely on.\n7. Ship the attribution file the licenses require (Apache-2.0 NOTICE, MIT copyright lines): generate `THIRD_PARTY_LICENSES` and keep it in the release.\n8. Re-run on every dependency change; a new transitive import is how violations enter.\n\n## Pitfalls\n\n- Scanning only direct dependencies misses the transitive package that carries the GPL.\n- Dev-only dependencies do not ship, so exclude them with `--production`; reporting them as violations wastes review time.\n- A package with no `LICENSE` file may still be licensed by its `package.json` field — check both before marking unknown.\n- SPDX expressions with `AND`\u002F`OR` differ from a bare `MIT OR GPL-3.0`; you must actually elect a branch.\n- Copying a license into a vendored tree does not satisfy attribution for a distributed binary; the notices travel with the artifact.\n\n## Verification\n\n    go-licenses check .\u002F... && jq '[.[] | select(.licenses==\"UNKNOWN\")] | length' licenses.json\n\nNo deny-listed license and zero `UNKNOWN` entries, with the attribution file regenerated to match.\n\nReport: \"Scanned \u003CN> shipped deps: \u003Callowed classes>; 0 deny-listed, 0 unknown; THIRD_PARTY_LICENSES regenerated and attached.\"\n","# Scan for License Compliance\n\nA single GPL dependency linked into a proprietary binary is a legal problem, and \"unknown\" licenses are the ones lawyers lose sleep over. Inventory licenses from the shipped graph and diff against an explicit allow list.\n\n## Procedure\n\n1. Scan the resolved dependencies, per ecosystem:\n   - Node: `npx license-checker --production --json > licenses.json`\n   - Python: `pip-licenses --format=json --with-license-file > licenses.json`\n   - Go: `go-licenses check .\u002F...` or `go-licenses csv .\u002F...`\n   - Rust: `cargo license --json` or `cargo deny check licenses`\n   - JVM: `mvn license:aggregate-add-third-party`\n2. For deep or mixed trees use ScanCode: `scancode -clpieu --json out.json vendor\u002F` (it reads LICENSE files, not just metadata, and catches missing declarations).\n3. Define the policy as data. Allow: MIT, Apache-2.0, BSD-2\u002F3-Clause, ISC, MPL-2.0 (weak copyleft, per-file). Review: LGPL-2.1\u002F3.0 (dynamic linking question). Deny: GPL-2.0\u002F3.0, AGPL-3.0, SSPL, and any `UNKNOWN`\u002Fempty license.\n4. Compare and fail on deny-list hits or unknowns:\n   `cargo deny check licenses` with `[licenses] allow = [\"MIT\", \"Apache-2.0\"]`, or filter `licenses.json` with `jq`.\n5. Handle transitive hits by traceback: find who pulls the GPL package (`npm ls \u003Cpkg>`) and either replace it, drop the feature, or seek legal sign-off in writing.\n6. For dual-licensed packages (e.g. `MIT OR Apache-2.0`), record which side you rely on.\n7. Ship the attribution file the licenses require (Apache-2.0 NOTICE, MIT copyright lines): generate `THIRD_PARTY_LICENSES` and keep it in the release.\n8. Re-run on every dependency change; a new transitive import is how violations enter.\n\n## Pitfalls\n\n- Scanning only direct dependencies misses the transitive package that carries the GPL.\n- Dev-only dependencies do not ship, so exclude them with `--production`; reporting them as violations wastes review time.\n- A package with no `LICENSE` file may still be licensed by its `package.json` field — check both before marking unknown.\n- SPDX expressions with `AND`\u002F`OR` differ from a bare `MIT OR GPL-3.0`; you must actually elect a branch.\n- Copying a license into a vendored tree does not satisfy attribution for a distributed binary; the notices travel with the artifact.\n\n## Verification\n\n    go-licenses check .\u002F... && jq '[.[] | select(.licenses==\"UNKNOWN\")] | length' licenses.json\n\nNo deny-listed license and zero `UNKNOWN` entries, with the attribution file regenerated to match.\n\nReport: \"Scanned \u003CN> shipped deps: \u003Callowed classes>; 0 deny-listed, 0 unknown; THIRD_PARTY_LICENSES regenerated and attached.\"\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fpayments\u002F0xklen-scan-for-license-compliance",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-13 02:31:19",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill scan-for-license-compliance",{"tool":63,"command":64},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill scan-for-license-compliance",{"tool":66,"command":67},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill scan-for-license-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-scan-for-license-compliance\u002FSKILL.md",true,[71,75,81],{"path":72,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":16},"LICENSE","许可证",1063,{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"SOURCE.md","REFERENCE","参考文档",353,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-scan-for-license-compliance\u002FSOURCE.md",{"path":82,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":83,"sourceHtmlUrl":84},"TRUST.auto.yaml",2134,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-scan-for-license-compliance\u002FTRUST.auto.yaml",[86,114,136,154,167,177],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":90,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":43},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":118,"licenseFileUrl":119,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":43},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[123,124,125,126,127,128,129,130,131,132,29,133,134,135],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","api keys","maintenance","protobuf",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":118,"licenseFileUrl":140,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":43},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[144,124,145,146,147,148,149,133,29,132,150,151,152,128,153,127,126],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","data","orders",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":118,"licenseFileUrl":158,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":43},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[162,163,125,164,165,134,29,166,131,130,128,127],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":168,"name":169,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":170,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":43},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[174,175,176],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":181,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":43},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[185,186,187,188,189,190,191,38,192,42,193],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","share"]