Agent WranglersTKO-29Recommended
List the licences of the code and every dependency
Produce a bill of materials with an SPDX licence identifier for every package, and assess each copyleft, unknown or missing licence in writing.
How to do it
A strong copyleft licence such as the GPL or AGPL can oblige the company to publish its own code. It depends on how the product is shipped or served. A package with no licence gives no right to use it at all. Generate the list with an SBOM tool, as Publish what is in each release says. Generated code can copy licensed code, so check Check where generated code came from too. A lawyer judges the findings. The review lists them.
How to check
The bill of materials, in SPDX or CycloneDX format, gives a licence for every package. Every copyleft, unknown or missing licence has a written assessment in the report.
Sources
Related rules
- SEC-74 Publish what is in each release in Adversarial testing
- AID-21 Check where generated code came from in AI-assisted development
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/codebase-takeover/due-diligence/licence-inventory">Agent Wranglers codebase takeover playbook</a>. In code you write, add a comment next to it with the same link.